📋 Microsoft Entra Documentation Changes

ms.date: 04/14/2025

> Refer to this article only after reviewing [the Microsoft Cloud Footprint FAQ](azure/cost-management-billing/manage/discover-cloud-footprint) to discover your organization’s inventory of tenants. This article outlines the specific existing Microsoft Entra capabilities administrators can leverage within their primary tenant to quarantine suspected unsanctioned tenants in their discovered list of tenants.

## What is quarantining a tenant?

Quarantining involves isolating suspected unsanctioned tenants by using existing Entra features which immediately reduces security risk that exists from exposure to tenants you don’t have administrative control of within your environment. By isolating, you introduce friction between your tenant and theirs, which pushes administrators of the suspected tenants to contact you in need of assistance. This gives you the opportunity to verify the legitimacy of relationships with these tenants and/or regain control over them. If no one is to contact you, then you can leave the tenants in the quarantined state indefinitely.

## When should I quarantine a tenant?

You are an IT Admin for the company "Contoso” with the primary tenant of "Contoso.com". To secure data in the central Contoso tenant, you need to ensure users and applications with privileged access to your tenant are in tenants that properly secure these resources. Likewise, you want to ensure that external tenants in which your tenant has permissions into are known and following secure practices. To do this, you want to find all tenants that have inbound or outbound relationships with your primary tenant.

After following the Microsoft Cloud Footprint FAQ, you have identify a few potential tenants that may or may not belong to your company. Let’s call these tenants ContosoTest.com and ContosoDemo.com for scenario purposes. Because you don’t know who the global admins are for these tenants, you worry they are possibly employee-managed and do not comply with your organization’s security policies. This poses a major security risk to your environment if they stay un-managed.

Since you don’t have direct control over ContosoTest.com and ContosoDemo.com, you can only modify settings on the Contoso.com tenant. You want to quarantine them to minimize potential vulnerabilities that come from the exposure to these tenants. However, it's crucial that any changes you make are easily reversible, ensuring that no critical systems are unintentionally affected in the process. After quarantining, you have introduced enough friction between your tenant and the suspected tenants to encourage the administrators of the tenants to contact your helpdesk.

ms.topic: how-to

The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings. In preview, the agent evaluates policies requiring multifactor authentication (MFA), enforces device based controls (device compliance, app protection policies, and Domain Joined Devices), and blocks legacy authentication and device code flow.

 

## Prerequisites

 

- You must be assigned the [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator) or [Global Administrator](../role-based-access-control/permissions-reference.md#global-administrator) role during the preview.

- You must have at least Microsoft Entra ID P1.

- You must have available [security compute units](/copilot/security/manage-usage).

 

### Limitations

 

- Once agents are started they can't be stopped or paused. It may take a few minutes to run.

 

## Getting started

> - Register a web API in the Microsoft Entra admin center

* An external tenant. To create one, choose from the following methods:

* (Recommended) Use the [Microsoft Entra External ID extension](https://aka.ms/ciamvscode/tutorials/marketplace) to set up an external tenant directly in Visual Studio Code.

* [Create a new external tenant](how-to-create-external-tenant-portal.md) in the Microsoft Entra admin center.

* Register a new app in the [Microsoft Entra admin center](https://entra.microsoft.com), configured for *Accounts in this organizational directory only*. Refer to [Register an application](quickstart-register-app.md) for more details. Record the following values from the application **Overview** page for later use:

* Application (client) ID

* Directory (tenant) ID

* Directory (tenant) subdomain. Refer to [read your tenant details](../external-id//customers/how-to-create-external-tenant-portal.md#get-the-external-tenant-details) for your tenant subdomain.

* Add a client secret to your app registration. **Do not** use client secrets in production apps. Use certificates or federated credentials instead. For more information, see [add credentials to your application](./how-to-add-credentials.md?tabs=client-secret).

ms.date: 04/14/2025

1. [Integrate Microsoft Entra logs with Azure Monitor logs](../monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs.yml).

**Conditional Access policy**: To view their combined impact, select one or more Conditional Access policies. Policies are separated into two groups: **Enabled** and **Report-only** policies. By default, all **Enabled** policies are selected. These policies are the policies currently enforced in your tenant.

**Time range**: Select a time range from 4 hours to as far back as 90 days. If you select a time range further back than when you integrated the Microsoft Entra logs with Azure Monitor, only sign-ins after the time of integration appear.

### Revoke all refresh tokens for user (Preview)

 

Allows all refresh and browser session tokens to be revoked for a user. This invalidates all the refresh tokens and browser session tokens issued to applications for a user, except external user sign-in sessions because external users sign in through their home tenant.

 

You're able to customize the task name and description for this task in the Microsoft Entra admin center.

 

 

For Microsoft Graph, the parameters for the **Remove all refresh tokens for user** task are as follows:

 

|Parameter |Definition |

|---------|---------|

|category | leaver,mover |

|displayName | Revoke all refresh tokens for user (Preview) |

|description | Revoke all refresh tokens for user |

|taskDefinitionId | 509589a4-0466-4471-829e-49c5e502bdee |

 

 

[!INCLUDE [applies-to-workforce-external](../external-id/includes/applies-to-external.md)]

 

* Register a new app in the [Microsoft Entra admin center](https://entra.microsoft.com), configured for *Accounts in any organizational directory and personal Microsoft accounts*. Refer to [Register an application](quickstart-register-app.md) for more details. Record the following values from the application **Overview** page for later use:

* Application (client) ID

* Directory (tenant) ID

* Directory (tenant) domain name (for example, *contoso.onmicrosoft.com* or *contoso.com*).

* Add the following redirect URIs using the **Mobile and desktop applications** platform configuration. Refer to [How to add a redirect URI in your application](./how-to-add-redirect-uri.md) for more details.

* **Redirect URI**: `https://login.microsoftonline.com/common/oauth2/nativeclient`

* Associate your app with a user flow in the Microsoft Entra admin center. This user flow can be used across multiple applications. For more information, see [Create self-service sign-up user flows for apps in external tenants](../external-id/customers/how-to-user-flow-sign-up-sign-in-customers.md) and [Add your application to the user flow](../external-id/customers/how-to-user-flow-add-application.md).

* [.NET 7.0 SDK](https://dotnet.microsoft.com/download/dotnet/7.0) or later.

* Although any integrated development environment (IDE) that supports React applications can be used, this tutorial uses [Visual Studio Code](https://visualstudio.microsoft.com/downloads/).

ms.date: 04/14/2025

:::image type="content" source="media/how-to-add-attributes-to-token/select-app.png" alt-text="Screenshot of the overview page of the app registration." border="true":::

:::image type="content" source="media/how-to-add-attributes-to-token/managed-app-in-local-directory-link.png" alt-text="Screenshot of the managed application in local directory link." border="true":::

:::image type="content" source="media/how-to-add-attributes-to-token/single-sign-on-edit.png" alt-text="Screenshot of the attributes and claims section and the edit icon." border="true":::

> [!IMPORTANT]

> When requesting an access token using `.default`, do **not** combine it with delegated scopes like `User.Read`, `Mail.Read`, `profile`, or `offline_access` in the same `scope` parameter. Doing so results in an `AADSTS70011` error, because `.default` refers to pre-consented static permissions while the others require dynamic user consent at runtime.

>

> ✅ The only exception is when using **combined consent** with the [known client applications](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-on-behalf-of-flow#knownclientapplications) pattern. In that case, it's valid to request:

>

> ```

> scope=openid https://middle-tier-api.example.com/.default

> ```

>

> This flow allows the user to consent to both the frontend and the downstream API in one prompt. In some cases, `offline_access` may also work alongside `.default` to issue a refresh token, but mixing `.default` with other delegated scopes (e.g., `User.Read`) remains unsupported.

 

 

ms.date: 04/14/2025

- [Third-party Identity Provider (IdP) support](#third-party-idp-support)

### Third-party IdP support

- After April 7, 2025, configuration of Active Directory Federation Services (ADFS) scenarios through Microsoft Entra Connect wizard won't work.

- Your sync service will run as usual, and changes will continue to sync to Microsoft Entra.

1. Open a PowerShell session with "Run as administrator".

1. Run the following commands to import ADSyncTools module. If ADSyncTools is already present, this command updates it, otherwise it installs the latest version.

ms.date: 04/11/2025

This table maps the application IDs from the logs to the application name and a brief description of the application. This table is not exhaustive and will grow over time.

 

Some application display names might include acronyms or abbreviations from previous application names. For example, some services still retain "AAD" (Azure Active Directory) in their display name, even though the service was rebranded to Microsoft Entra ID.

 

ms.date: 04/14/2025

:::image type="content" source="media/cross-cloud-settings/cross-cloud-settings.png" alt-text="Screenshot showing Microsoft cloud settings." border="true":::

 

:::image type="content" source="media/cross-cloud-settings/cross-tenant-add-organization.png" alt-text="Screenshot showing adding an organization." border="true":::

ms.date: 04/14/2025

1. Select **Add user/group** to open the **Add Assignment** pane.

1. In the **Add Assignment** pane, select the link under **Users and groups**. A list of users and security groups appears. You can select multiple users and groups in the list.

1. In the **Add assignment** pane, select the link under **Select a role**. All the roles you defined for the application appear.

ms.date: 04/14/2025

> - **As of July 12, 2021**, if Microsoft Entra B2B customers set up new Google integrations for use with self-service sign-up for their custom or line-of-business applications, authentication with Google identities won’t work until authentications are moved to system web-views. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).

> - **On September 30, 2021**, Google [deprecated embedded web-view sign-in support](https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html). If your apps authenticate users with an embedded web-view and you're using Google federation with [Azure AD B2C](/azure/active-directory-b2c/identity-provider-google) or Microsoft Entra B2B for [external user invitations](google-federation.md) or [self-service sign-up](identity-providers.md), Google Gmail users won't be able to authenticate. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).

ms.date: 04/14/2025

After enforcement, a banner appears in the [Azure portal](https://aka.ms/managemfaforazure):

Global Administrators can go to the [Azure portal](https://aka.ms/managemfaforazure) to select the start date of enforcement for their tenant for admin portals in Phase 1. If you postponed the start date for Phase 1, Phase 2 enforcement *doesn't* begin before the start date you choose. Global Administrators must [elevate access](https://aka.ms/enableelevatedaccess) and use MFA before they can postpone the start date of MFA enforcement.