📋 Microsoft Entra Documentation Changes

- App Studio for Microsoft Teams

- Augmentation Loop

- Call Recorder

- Device Management Service

- EDU Assignments

- Enterprise Copilot Platform

- Groups Service

- IC3 Gateway

- IC3 Gateway Non Cae

- Insights Services

- INT Augmentation Loop 1P

- Legacy Smart Compose

- Loop Web Application

## How to get CertificateUserIds values from end user certificate

 

For this configuration, you can use [Microsoft Graph PowerShell] (/powershell/microsoftgraph/installation).

 

1. Start PowerShell with administrator privileges.

1. Install and import the Microsoft Graph PowerShell SDK.

 

```powershell

Install-Module Microsoft.Graph -Scope AllUsers

Import-Module Microsoft.Graph.Authentication

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

```

 

1. Connect to the tenant and accept all.

 

```powershell

Connect-MGGraph -Scopes "Directory.ReadWrite.All", "User.ReadWrite.All" -TenantId <tenantId>

ms.topic: how-to

In today's rapidly evolving digital landscape, organizations require robust and unified solutions to ensure secure and seamless connectivity. Microsoft and Zscaler offer complementary Secure Access Service Edge (SASE) capabilities that, when integrated, provide enhanced security and connectivity for diverse access scenarios.

This guide outlines how to configure and deploy Microsoft Entra solutions alongside Zscaler's Security Service Edge (SSE) offerings. By leveraging the strengths of both platforms, you can optimize your organization's security posture while maintaining high-performance connectivity for private applications, Microsoft 365 traffic, and internet access.

In today's rapidly evolving digital landscape, organizations require robust, and unified solutions to ensure secure and seamless connectivity. Microsoft and Zscaler offer complementary Secure Access Service Edge (SASE) capabilities that, when integrated, provide enhanced security and connectivity for diverse access scenarios.

This guide outlines how to configure and deploy Microsoft Entra solutions alongside Zscaler's Security Service Edge (SSE) offerings. By using the strengths of both platforms, you can optimize your organization's security posture while maintaining high-performance connectivity for private applications, Microsoft 365 traffic, and internet access.

In this scenario, Global Secure Access handles private application traffic. Zscaler only captures Internet traffic. Therefore, the Zscaler Private Access module is disabled from the Zscaler portal.

In this scenario, both clients handle traffic for separate private applications. Global Secure Access handles private applications in Microsoft Entra Private Access. Private applications in Zscaler use the Zscaler Private Access module. Zscaler Internet Access handles Internet traffic.

 

In this scenario, Global Secure Access handles all Microsoft 365 traffic. Zscaler Private Access handles Private application traffic and Zscaler Internet Access handles Internet traffic.

| 63 | Philippines |

| 20 | Egypt |

| 967 | Yemen |

| 84 | Vietnam |

| 62 | Indonesia |

| 234 | Nigeria |

| 972 | Israel |

| 233 | Ghana |

| 92 | Pakistan |

| 966 | Saudi Arabia |

| 971 | United Arab Emriates |

| 94 | Sri Lanka |

| 258 | Mozambique |

| 502 | Guatemala |

| 974 | Qatar |

| 591 | Bolivia |

| 254 | Kenya |

ms.date: 04/16/2025

As mentioned in the [Microsoft Digital Defense Report](https://www.microsoft.com/security/security-insider/microsoft-digital-defense-report-2023) from October 2023,

As part of this work, we're making Microsoft-managed policies available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which a [recent study](https://arxiv.org/abs/2305.00945) finds reduces the risk of compromise by more than 99%.

:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded-full.png":::

Refresh tokens will automatically expire once the lifetime period elapses. Additionally, they can be revoked by the sign-in service at any time before their expiration. Your app should handle such revocations gracefully by redirecting the user to an interactive sign-in prompt to reauthenticate and obtain a new token.

The Microsoft Entra ID Governance capabilities are currently available in six standalone products. These six products provide the same identity governance capabilities. The difference between the six products is that they have different prerequisites.

- A subscription to **Microsoft Entra ID Governance** or **MIcrosoft Entra ID Governance for Government**, listed in the product terms as the **Microsoft Entra ID Governance (User SL)** product, requires that the tenant also have an active subscription to another product, one that contains the `AAD_PREMIUM` or `AAD_PREMIUM_P2` service plan. Examples of products meeting this prerequisite include **Microsoft Entra ID P1**, **Microsoft 365 E3/E5/A3/A5/G3/G5** or **Enterprise Mobility + Security E3/E5**.

- A subscription to **Microsoft Entra ID Governance Step Up for Microsoft Entra ID P2** or **Microsoft Entra ID Governance Add-on for Microsoft Entra ID P2 for Government**, listed in the product terms as the **Microsoft Entra ID Governance P2** product, requires that the tenant also have an active subscription to another product, one that contains the `AAD_PREMIUM_P2` service plan. Examples of products meeting this prerequisite include **Microsoft Entra ID P2**, **Microsoft 365 E5/A5/G5**, **Enterprise Mobility + Security E5**, **Microsoft 365 E5/F5 Security** or **Microsoft 365 F5 Security + Compliance**.

- A subscription to the **Entra ID Governance Frontline Worker (User SL)** product requires that the tenant also have an active subscription to another product, one that contains the `AAD_PREMIUM` or `AAD_PREMIUM_P2` service plan. Examples of products meeting this prerequisite include **Microsoft Entra ID P1**, **Microsoft 365 E3/E5/A3/A5/G3/G5**, **Enterprise Mobility + Security E3/E5** or **Microsoft 365 F1/F3**.

- A subscription to **Microsoft Entra ID Governance Step up for Microsoft Entra ID F2**, listed in the product terms as the **Microsoft Entra ID Governance F2** or **Microsoft Entra ID Governance Step-Up for Microsoft Entra ID F2 for Frontline Worker (User SL)** product, requires that the tenant also have an active subscription to another product, one that contains the `AAD_PREMIUM_P2` service plan. Examples of products meeting this prerequisite include **Microsoft Entra ID F2**.

 

Microsoft Entra ID Governance capabilities are also included in the Microsoft Entra Suite. The available Microsoft Entra Suite products include **Microsoft Entra Suite (User SL)**, **Microsoft Entra Suite Add-on for Microsoft Entra ID F2 for FLW (User SL)**, **Microsoft Entra Suite Add-on for Microsoft Entra ID P2 (User SL)**, **Microsoft Entra Suite Add-on for Microsoft Entra ID P2 EDU (User SL)**, **Microsoft Entra Suite FLW (User SL)**, and **Microsoft Entra Suite for EDU (User SL)**.

:::image type="content" source="media/concept-private-name-resolution/image2.png" alt-text="Screenshot of a diagram showing DNS queries resolved via Private DNS when a DNS suffix is configured in Quick Access.":::

 

 

To learn how Private DNS works with SSO, see [Use Kerberos for single sign-on (SSO) to your resources with Microsoft Entra Private Access](/entra/global-secure-access/how-to-configure-kerberos-sso).

To learn tips on DNS troubleshooting, see [Troubleshoot application access - Global Secure Access](/entra/global-secure-access/troubleshoot-app-access#how-does-dns-work-with-global-secure-access).

ms.date: 04/16/2025

### Microsoft service principal sign-in logs (preview)

 

The `MicrosoftServicePrincipalSignInLogs` provides visibility into scenarios where Microsoft-owned (first-party) services authenticate to other Microsoft services within a tenant, such as when a user opens a Word document inside Microsoft Teams. These logs were released to provide greater transparency around service-to-service authentication but are not necessary for most customers as they are complex and generate a high volume of data. These applications are monitored by Microsoft security to ensure the security of the applications and follows principles of least privilege. We want to emphasize that this data is not essential for security investigations and we strongly advise against taking actions such as disabling applications based on this data, as doing so could cause misconfigurations and potential adverse effects such as tenant lock-out. This data is offered as an opt-in through diagnostic settings only and is currently in preview. For more information and commonly asked questions, please visit our [FAQ page](reports-faq.yml).

 

ms.date: 04/16/2025

A Microsoft Entra Kerberos server object is created in your on-premises Active Directory instance and then securely published to Microsoft Entra ID by using Microsoft Entra Connect. The object isn't associated with any physical servers. It's simply a resource that can be used by Microsoft Entra ID to generate Kerberos TGTs for your Active Directory domain.

- Avoid overlapping app segments between Global Secure Access apps.

If you made changes to the out-of-box synchronization rules, then these rules are set back to the default configuration on upgrade. To make sure that your configuration is kept between upgrades, make sure that you make changes as they're described in [Best practices for changing the default configuration](how-to-connect-sync-best-practices-changing-default-configuration.md). If you already changed the default sync rules, please see how to [Fix modified default rules in Microsoft Entra Connect](./how-to-connect-sync-best-practices-changing-default-configuration.md), before starting the upgrade process.

The following table shows what features associated with identity governance are available with each license. For more information on other features, see [Microsoft Entra plans and pricing](https://www.microsoft.com/security/business/microsoft-entra-pricing). Not all features are available in all clouds; see [Microsoft Entra feature availability](~/identity/authentication/feature-availability.md) for Azure Government.

- [Introduction to Global Secure Access Proof of Concept Guidance](gsa-poc-guidance-intro.md)