Microsoft Entra Documentation Changes

MODIFIED docs/identity/authentication/how-to-unlock-users-for-mandatory-multifactor-authentication.md

Modified by gurua on Apr 19, 2025 12:14 PM
📖 View on learn.microsoft.com

+535 / -2 lines changed

Commit: Update how-to-unlock-users-for-mandatory-multifactor-authentication.md

Changes:

Before

After

 
The script takes the following actions:
 
- Asks for tenant ID, and optionally the date of enforcement. The default date is September 30th, 2025. The script picks the user's tenant if they have one, or presents a list of tenants for them to choose from.
- Logs the user into that tenant.
- Gets the relevant authentication tokens.
- Checks if user has elevated access. If not, the script does the elevation.
## Script
 
```powershell
 
```
 
## Related content
 
- [Planning for mandatory MFA for Azure and other admin portals](concept-mandatory-multifactor-authentication.md)
- [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md)

 
The script takes the following actions:
 
- The script picks the user's tenant if they have one, or presents a list of tenants for them to choose from. Optionally, asks for the date of enforcement. The default date is September 30th, 2025.
- Logs the user into that tenant.
- Gets the relevant authentication tokens.
- Checks if user has elevated access. If not, the script does the elevation.
## Script
 
```powershell
param (
    [Parameter(Mandatory=$false)]
    [string]$TenantId,
 
    [Parameter(Mandatory=$false)]
    [string]$PostponementDateInUTC
)
 
# Make sure the Az.Accounts module is imported
Import-Module Az.Accounts

MODIFIED docs/identity/users/groups-dynamic-membership.md

Modified by ShawnJackson on Apr 19, 2025 9:35 AM
📖 View on learn.microsoft.com

+207 / -195 lines changed

Commit: edit pass: microsoft-entra-dynamic-groups

Changes:

Before

After

---
title: Manage rules for dynamic membership groups in Microsoft Entra ID
description: How to manage rules for dynamic membership groups to automatically populate group members and rule references.
 
author: barclayn
manager: femila
 
# Manage rules for dynamic membership groups in Microsoft Entra ID
 
You can create user or device attribute-based rules to enable membership for dynamic membership groups in Microsoft Entra ID, part of Microsoft Entra. You can add and remove dynamic membership groups automatically using membership rules based on member attributes. In Microsoft Entra, a single tenant can have a maximum of 15,000 dynamic membership groups.
 
This article details the properties and syntax to create rules for dynamic membership groups based on users or devices.
 
> [!NOTE]
> Security groups can be used for either devices or users, but Microsoft 365 groups can include only users. 
 
When the attributes of a user or a device change, the system evaluates all rules for dynamic membership groups in a directory to see if the change would trigger any group adds or removes. If a user or device satisfies a rule on a group, they're added as a member of that group. If they no longer satisfy the rule, they're removed. You can't manually add or remove a member of a dynamic membership group.
 
- You can create a dynamic membership groups for users or devices, but you can't create a rule that contains both users and devices.
- You can't create a device membership group based on the user attributes of the device owner. Device membership rules can reference only device attributes.

---
title: Manage Rules for Dynamic Membership Groups in Microsoft Entra ID
description: Learn how to manage rules for dynamic membership groups to automatically populate group members and rule references.
 
author: barclayn
manager: femila
 
# Manage rules for dynamic membership groups in Microsoft Entra ID
 
You can create user-based or device attribute-based rules to enable membership for dynamic membership groups in Microsoft Entra ID. You can add and remove dynamic membership groups automatically by using membership rules based on member attributes. In Microsoft Entra, a single tenant can have a maximum of 15,000 dynamic membership groups.
 
This article details the properties and syntax to create rules for dynamic membership groups based on users or devices.
 
> [!NOTE]
> Security groups can include either devices or users, but Microsoft 365 groups can include only users.
 
## Considerations for dynamic membership groups
 
When the attributes of a user or a device change, the system evaluates all rules for dynamic membership groups in a directory to see if the change would trigger any group adds or removes. If users or devices satisfy a rule on a group, they're added as members of that group. If they no longer satisfy the rule, they're removed. You can't manually add or remove a member of a dynamic membership group.
 

MODIFIED docs/identity/users/groups-create-rule.md

Modified by ShawnJackson on Apr 19, 2025 9:35 AM
📖 View on learn.microsoft.com

+53 / -44 lines changed

Commit: edit pass: microsoft-entra-dynamic-groups

Changes:

Before

After

Group membership based on user or device properties is supported for security groups and Microsoft 365 groups. When you apply a rule for a dynamic membership group, user and device attributes are evaluated for matches with the membership rule. When an attribute changes for a user or device, all rules for dynamic membership groups in the organization are processed for changes. Users and devices are added or removed if they meet the conditions for a dynamic membership group. In Microsoft Entra ID, a single tenant can have a maximum of 15,000 dynamic membership groups.
 
> [!NOTE]
> Security groups can be used for either devices or users, but Microsoft 365 groups can include only users.
 
Using dynamic membership groups requires a Microsoft Entra ID P1 license or an Intune for Education license. For more information, see [Manage rules for dynamic membership groups in Microsoft Entra ID](./groups-dynamic-membership.md).
 
## Rule builder in the Azure portal
 
Microsoft Entra ID provides a rule builder to create and update your important rules more quickly. The rule builder supports the construction up to five expressions. The rule builder makes it easier to form a rule with a few simple expressions, however, it can't be used to reproduce every rule. If the rule builder doesn't support the rule you want to create, you can use the text box.
 
Here are some examples of advanced rules or syntax for which we recommend that you construct using the text box:
 
- Rule with more than five expressions
- The Direct reports rule
- Setting [operator precedence](groups-dynamic-membership.md#operator-precedence)
- [Rules with complex expressions](groups-dynamic-membership.md#rules-with-complex-expressions); for example, `(user.proxyAddresses -any (_ -contains "contoso"))`
 
> [!NOTE]
> The rule builder might not be able to display some rules constructed in the text box. You might see a message when the rule builder is not able to display the rule. The rule builder doesn't change the supported syntax, validation, or processing of rules for dynamic membership groups in any way.

Group membership based on user or device properties is supported for security groups and Microsoft 365 groups. When you apply a rule for a dynamic membership group, user and device attributes are evaluated for matches with the membership rule. When an attribute changes for a user or device, all rules for dynamic membership groups in the organization are processed for changes. Users and devices are added or removed if they meet the conditions for a dynamic membership group. In Microsoft Entra ID, a single tenant can have a maximum of 15,000 dynamic membership groups.
 
> [!NOTE]
> Security groups can include either devices or users, but Microsoft 365 groups can include only users.
 
Using dynamic membership groups requires a Microsoft Entra ID P1 license or an Intune for Education license. For more information, see [Manage rules for dynamic membership groups in Microsoft Entra ID](./groups-dynamic-membership.md).
 
## Rule builder in the Azure portal
 
Microsoft Entra ID provides a rule builder to create and update your important rules more quickly. The rule builder supports the construction of up to five expressions.
 
The rule builder makes it easier to form a rule with a few simple expressions. However, it can't be used to reproduce every rule. If the rule builder doesn't support the rule that you want to create, you can use the text box.
 
Here are some examples of advanced rules or syntax for which we recommend that you use the text box:
 
- Rule with more than five expressions
- Rule for direct reports
- Setting [operator precedence](groups-dynamic-membership.md#operator-precedence)
- [Rule with complex expressions](groups-dynamic-membership.md#rules-with-complex-expressions); for example, `(user.proxyAddresses -any (_ -contains "contoso"))`
 

MODIFIED docs/global-secure-access/how-to-transport-layer-security.md

Modified by jayrusso on Apr 19, 2025 9:55 AM
📖 View on learn.microsoft.com

+23 / -23 lines changed

Commit: Apr 18 finalized docs and updated TOC

Changes:

Before

After

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 03/28/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (Preview)
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.   
 
A significant percentage of internet traffic is encrypted. By terminating Transport Layer Security (TLS) at the edge, Global Secure Access can inspect and apply security policies to decrypted traffic, which allows for threat detection, content filtering, and granular access controls.
 
This article shows how to create a context aware Transport Layer Security inspection policy and assign the policy to users in your organization.
 
## Prerequisites
To test the functionality provided in this preview, you need the following high-level prerequisites: 

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 04/18/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (preview)
A significant percentage of internet traffic is encrypted. By terminating Transport Layer Security (TLS) at the edge, Global Secure Access inspects and applies security policies to decrypted traffic, enabling threat detection, content filtering, and granular access controls.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.   
 
This article explains how to create a context-aware Transport Layer Security inspection policy and assign it to users in your organization.
 
## Prerequisites
To complete the steps in this process, you must have the following prerequisites in place: 

MODIFIED docs/identity/authentication/howto-sspr-windows.md

Modified by paulth1 on Apr 19, 2025 5:53 AM
📖 View on learn.microsoft.com

+20 / -20 lines changed

Commit: edit pass: sspr-articles

Changes:

Before

After

 
![Screenshot that shows examples of Windows sign-in screens with the SSPR link.](./media/howto-sspr-windows/windows-reset-password.png)
 
> [!IMPORTANT]
> This article shows an administrator how to enable SSPR for Windows devices in an enterprise.
>
> If your IT team hasn't enabled the ability to use SSPR from your Windows device or you have problems during sign-in, reach out to your help desk for more assistance.
 
## General limitations
 
- Disabling user account control via modification of the [EnableLUA registry key](/openspecs/windows_protocols/ms-gpsb/958053ae-5397-4f96-977f-b7700ee461ec) is known to cause issues.
- This feature doesn't work for networks with 802.1x network authentication deployed and the option **Perform immediately before user logon**. For networks with 802.1x network authentication deployed, we recommend that you use machine authentication to enable this feature.
- Microsoft Entra hybrid-joined machines must have network connectivity line of sight to a domain controller to use the new password and update cached credentials. The devices must either be on the organization's internal network or on a virtual private network with network access to an on-premises domain controller. If SSPR is the only requirement, the network connection line to the domain controller isn't required.
- If you use an image, prior to running `sysprep` ensure that the web cache is cleared for the built-in administrator before you perform the `CopyProfile` step. For more information, see [Performance poor when using custom default user profile](https://support.microsoft.com/help/4056823/performance-issue-with-custom-default-user-profile).
- The following settings are known to interfere with the ability to use and reset passwords on Windows 10 devices:
    - If lock screen notifications are turned off, **Reset password** won't work.
    - `HideFastUserSwitching` is set to **Enabled** or **1**.
    - `DontDisplayLastUserName` is set to **Enabled** or **1**.
 
- Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](~/identity/role-based-access-control/permissions-reference.md#authentication-policy-administrator) and [enable Microsoft Entra SSPR](tutorial-enable-sspr.md).

 
![Screenshot that shows examples of Windows sign-in screens with the SSPR link.](./media/howto-sspr-windows/windows-reset-password.png)
 
This article shows administrators how to enable SSPR for Windows devices in an enterprise.
 
If your IT team hasn't enabled the ability to use SSPR from your Windows device or you have problems during sign-in, reach out to your help desk for more assistance.
 
## General limitations
 
- Disabling user account control via modification of the [EnableLUA registry key](/openspecs/windows_protocols/ms-gpsb/958053ae-5397-4f96-977f-b7700ee461ec) is known to cause issues.
- This feature doesn't work for networks with 802.1x network authentication deployed and the option **Perform immediately before user logon**. For networks with 802.1x network authentication deployed, we recommend that you use machine authentication to enable this feature.
- Microsoft Entra hybrid-joined machines must have network connectivity line of sight to a domain controller to use the new password and update cached credentials. The devices must either be on the organization's internal network or on a virtual private network with network access to an on-premises domain controller. If SSPR is the only requirement, the network connection line to the domain controller isn't required.
- If you use an image, before you run `sysprep` ensure that the web cache is cleared for the built-in administrator before you perform the `CopyProfile` step. For more information, see [Performance poor when using custom default user profile](https://support.microsoft.com/help/4056823/performance-issue-with-custom-default-user-profile).
- The following settings are known to interfere with the ability to use and reset passwords on Windows 10 devices:
 
    - If lock screen notifications are turned off, **Reset password** won't work.
    - `HideFastUserSwitching` is set to **Enabled** or **1**.
    - `DontDisplayLastUserName` is set to **Enabled** or **1**.
 
- Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](~/identity/role-based-access-control/permissions-reference.md#authentication-policy-administrator) and [enable Microsoft Entra SSPR](tutorial-enable-sspr.md).

MODIFIED docs/global-secure-access/concept-private-name-resolution.md

Modified by Justinha on Apr 19, 2025 7:08 AM
📖 View on learn.microsoft.com

+18 / -19 lines changed

Commit: removed columns

Changes:

Before

After

 
A high-level Private DNS flow for Windows clients is shown in the following diagram.
 
:::row:::
   :::column span="2":::
      **Configuration**
 
      Admin enables Private DNS and adds a DNS suffix from Quick Access. 
 
      On the client, an entry in the Name Resolution Policy Table (NRPT) is generated for the suffix to resolve via the GSA client.
      
      Client traffic forwarding profile is updated to send private DNS queries to the GSA edge. 
   :::column-end:::
   :::column span="":::
      **Datapath**
 
      1. User requests a DNS query for app.contoso.com. If not cached locally, the DNS query is sent to the DNS proxy at the GSA edge. 
      2. DNS proxy either responds from its cache or forwards the query to the Connector Group defined in Quick Access.  
      3. Connector local resolvers resolve the DNS query and return it back to the DNS proxy. 
      4. DNS proxy responds back to the client with the internal IP. Client stores the internal IP address and returns a synthetic IP to the application.

 
A high-level Private DNS flow for Windows clients is shown in the following diagram.
 
**Configuration**
 
- An admin enables Private DNS and adds a DNS suffix from Quick Access. 
 
- On the client, an entry in the Name Resolution Policy Table (NRPT) is generated for the suffix to resolve via the GSA client.
 
- Client traffic forwarding profile is updated to send private DNS queries to the GSA edge. 
 
**Datapath**
 
1. User requests a DNS query for `app.contoso.com`. If not cached locally, the DNS query is sent to the DNS proxy at the GSA edge. 
1. DNS proxy either responds from its cache or forwards the query to the Connector Group defined in Quick Access.  
1. Connector local resolvers resolve the DNS query and return it back to the DNS proxy. 
1. DNS proxy responds back to the client with the internal IP. The client stores the internal IP address and returns a synthetic IP to the application.

MODIFIED docs/identity/multi-tenant-organizations/cross-tenant-synchronization-configure.md

Modified by rolyon on Apr 19, 2025 4:52 AM
📖 View on learn.microsoft.com

+30 / -7 lines changed

Commit: Incorporate feedback

Changes:

Before

After

 
## Supported cloud pairs
 
Cross-cloud synchronization supports these cloud pairs:
 
| Source | Target |
| --- | --- |
| Azure commercial | Azure Government |
| Azure Government | Azure commercial |
| Azure commercial | Azure operated by 21Vianet |
 
## Limitations
 
 
![Icon for the source tenant.](../../media/common/icons/entra-id-purple.png)<br/>**Source tenant**
 
- Microsoft Entra ID P1 or P2 license. For more information, see [License requirements](cross-tenant-synchronization-overview.md#license-requirements).
- [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator) role to configure cross-tenant access settings.
- [Hybrid Identity Administrator](../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role to configure cross-tenant synchronization.
- [Cloud Application Administrator](../role-based-access-control/permissions-reference.md#cloud-application-administrator) or [Application Administrator](../role-based-access-control/permissions-reference.md#application-administrator) role to assign users to a configuration and to delete a configuration.

 
## Supported cloud pairs
 
[!INCLUDE [cross-cloud-synchronization-pairs-include](../../includes/cross-cloud-synchronization-pairs-include.md)]
 
## Limitations
 
 
![Icon for the source tenant.](../../media/common/icons/entra-id-purple.png)<br/>**Source tenant**
 
::: zone pivot="same-cloud-synchronization"
- Microsoft Entra ID P1 or P2 license. For more information, see [License requirements](cross-tenant-synchronization-overview.md#license-requirements).
- [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator) role to configure cross-tenant access settings.
- [Hybrid Identity Administrator](../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role to configure cross-tenant synchronization.
- [Cloud Application Administrator](../role-based-access-control/permissions-reference.md#cloud-application-administrator) or [Application Administrator](../role-based-access-control/permissions-reference.md#application-administrator) role to assign users to a configuration and to delete a configuration.
::: zone-end
::: zone pivot="cross-cloud-synchronization"
- Microsoft Microsoft Entra ID Governance or Microsoft Entra Suite license. For more information, see [License requirements](cross-tenant-synchronization-overview.md#license-requirements).
- [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator) role to configure cross-tenant access settings.
- [Hybrid Identity Administrator](../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role to configure cross-tenant synchronization.

MODIFIED docs/identity/multi-tenant-organizations/cross-tenant-synchronization-overview.md

Modified by rolyon on Apr 19, 2025 4:52 AM
📖 View on learn.microsoft.com

+24 / -11 lines changed

Commit: Incorporate feedback

Changes:

Before

After

 
In the target tenant: Cross-tenant sync relies on the Microsoft Entra External ID billing model. To understand the external identities licensing model, see [MAU billing model for Microsoft Entra External ID](~/external-id/external-identities-pricing.md). You will also need at least one Microsoft Entra ID P1 license in the target tenant to enable auto-redemption.
 
[Cross-cloud synchronization](cross-tenant-synchronization-configure.md?pivots=cross-cloud-synchronization) requires TBD licenses.
 
## Frequently asked questions
 
#### Clouds
 
Which clouds can cross-tenant synchronization be used in?
 
- Cross-tenant synchronization is supported within the commercial cloud and Azure Government.
- Cross-tenant synchronization isn't supported within the Microsoft Azure operated by 21Vianet cloud.
- Synchronization is only supported between two tenants in the same Azure cloud. For information about the relationship between the Azure Cloud environments and Microsoft 365 (GCC, GCCH), see [Microsoft 365 integration](/azure/security/fundamentals/feature-availability#microsoft-365-integration). Synchronization between commercial and GCC is supported. 
- Cross-cloud (such as public cloud to Azure Government) isn't currently supported. 
 
#### Existing B2B users
 
Will cross-tenant synchronization manage existing B2B users?
What user attributes can be synchronized?

 
In the target tenant: Cross-tenant sync relies on the Microsoft Entra External ID billing model. To understand the external identities licensing model, see [MAU billing model for Microsoft Entra External ID](~/external-id/external-identities-pricing.md). You will also need at least one Microsoft Entra ID P1 license in the target tenant to enable auto-redemption.
 
[Cross-cloud synchronization](cross-tenant-synchronization-configure.md?pivots=cross-cloud-synchronization) requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses. For more information, see [Microsoft Entra ID Governance licensing fundamentals](../../id-governance/licensing-fundamentals.md).
 
## Frequently asked questions
 
#### Existing B2B users
 
Will cross-tenant synchronization manage existing B2B users?
What user attributes can be synchronized?
 
- Cross-tenant synchronization will sync commonly used attributes on the user object in Microsoft Entra ID, including (but not limited to) displayName, userPrincipalName, and directory extension attributes.
- Cross-tenant synchronization supports provisioning the manager attribute in the Azure commercial cloud. Manager synchronization is not yet supported in the US Government cloud. Both the user and their manager must be in scope for cross-tenant synchronization, in order to provision the manager attribute.
  - For cross-tenant synchronization configurations created after January 2024 with the default schema / attribute mappings:
    - The manager attribute will automatically be added to the attribute mappings.
    - Manager updates will apply on the incremental cycle for users that are undergoing changes (ex: manager change). The sync engine doesn't automatically update all existing users that were provisioned previously.
 
- No. No changes are made to the external users previously managed by cross-tenant synchronization if the relationship is severed (for example, if the cross-tenant synchronization policy is deleted).
 

MODIFIED docs/global-secure-access/concept-transport-layer-security.md

Modified by jayrusso on Apr 19, 2025 9:55 AM
📖 View on learn.microsoft.com

+13 / -13 lines changed

Commit: Apr 18 finalized docs and updated TOC

Changes:

Before

After

manager: femila
ms.service: global-secure-access
ms.topic: concept-article
ms.date: 04/01/2025
 
#customer intent: As a Global Secure Access administrator, I want to learn about the Transport Layer Security (TLS) protocol to support the creation of TLS inspection policies.   
 
---
# Transport Layer Security inspection (Preview) overview
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.   
 
The Transport Layer Security (TLS) protocol uses certificates at the transport layer to ensure the privacy, integrity, and authenticity of data exchanged between two communicating parties. This article provides an overview of the TLS inspection process, highlighting how it enhances security by enabling visibility into encrypted traffic. With TLS inspection, Global Secure Access administrators can effectively create and manage TLS inspection policies to detect and mitigate threats hidden within encrypted communications.
 
## The TLS inspection process
TLS secures application-layer protocols, like HTTP, by encrypting transmitted data. While TLS secures legitimate traffic, malicious traffic, such as malware and data leakage attacks, can still be hidden behind encryption.
 
The Microsoft Entra TLS inspection process brings visibility into encrypted traffic by making content available for malware detection, data loss prevention, prompt inspection, and other advanced security controls for enhanced protection.
 

manager: femila
ms.service: global-secure-access
ms.topic: concept-article
ms.date: 04/18/2025
 
#customer intent: As a Global Secure Access administrator, I want to learn about the Transport Layer Security (TLS) protocol to support the creation of TLS inspection policies.   
 
---
# Transport Layer Security inspection (preview) overview
The Transport Layer Security (TLS) protocol uses certificates at the transport layer to ensure the privacy, integrity, and authenticity of data exchanged between two communicating parties. This article provides an overview of the TLS inspection process and explains how it enhances security by enabling visibility into encrypted traffic. With TLS inspection, Global Secure Access admins can create and manage TLS inspection policies to detect and mitigate threats hidden within encrypted communications.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.   
 
## The TLS inspection process
TLS secures application-layer protocols like HTTP by encrypting transmitted data. While TLS secures legitimate traffic, malicious traffic like malware and data leakage attacks can still hide behind encryption.
 
The Microsoft Entra TLS inspection process provides visibility into encrypted traffic by making content available for malware detection, data loss prevention, prompt inspection, and other advanced security controls for enhanced protection.
 

MODIFIED docs/identity/authentication/howto-sspr-authenticationdata.md

Modified by paulth1 on Apr 19, 2025 5:53 AM
📖 View on learn.microsoft.com

+11 / -11 lines changed

Commit: edit pass: sspr-articles

Changes:

Before

After

---
# Prepopulate user authentication contact information for Microsoft Entra self-service password reset (SSPR)
 
To use Microsoft Entra self-service password reset (SSPR), authentication information for a user must be present. Most organizations have users register their authentication data themselves while collecting information for multifactor authentication. Some organizations prefer to bootstrap this process through synchronization of authentication data that already exists in Active Directory Domain Services. This synchronized data is made available to Microsoft Entra ID and SSPR without requiring user interaction. When users need to change or reset their password, they can do so even if they haven't previously registered their contact information.
 
You can prepopulate authentication contact information if you meet the following requirements:
 
* You formatted the data in your on-premises directory properly.
* You configured [Microsoft Entra Connect](~/identity/hybrid/connect/how-to-connect-install-express.md) for your Microsoft Entra tenant.
 
Phone numbers must be in the format *+CountryCode PhoneNumber*, such  as *+1 4251234567*.
 
> [!NOTE]
> There must be a space between the country code and the phone number.
>
> Password reset doesn't support phone extensions. Even in the *+1 4251234567X12345* format, extensions are removed before the call is placed.
 
## Fields populated
 
If you use the default settings in Microsoft Entra Connect, the following mappings are made to populate authentication contact information for SSPR:

---
# Prepopulate user authentication contact information for Microsoft Entra self-service password reset (SSPR)
 
To use Microsoft Entra self-service password reset (SSPR), authentication information for a user must be present. Most organizations have users register their authentication data themselves while collecting information for multifactor authentication.
 
Some organizations prefer to bootstrap this process through synchronization of authentication data that already exists in Active Directory Domain Services. This synchronized data is made available to Microsoft Entra ID and SSPR without requiring user interaction. When users need to change or reset their password, they can do so even if they haven't previously registered their contact information.
 
You can prepopulate authentication contact information if you meet the following requirements:
 
* You formatted the data in your on-premises directory properly.
* You configured [Microsoft Entra Connect](~/identity/hybrid/connect/how-to-connect-install-express.md) for your Microsoft Entra tenant.
 
Phone numbers must be in the format *+CountryCode PhoneNumber*, such as *+1 4251234567*. Further restrictions are:
 
- There must be a space between the country code and the phone number.
- Password reset doesn't support phone extensions. Even in the *+1 4251234567X12345* format, extensions are removed before the call is placed.
 
## Fields populated
 
If you use the default settings in Microsoft Entra Connect, the following mappings are made to populate authentication contact information for SSPR.

MODIFIED docs/global-secure-access/concept-edr-antivirus-coexistence.md

Modified by Janice Ricketts on Apr 19, 2025 2:46 AM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Update concept-edr-antivirus-coexistence.md

Changes:

Before

After

- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessEngineService.exe`
- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessETLController.exe`
- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessTunnelingService.exe`
- `C:\Program Files\Global Secure Access Client\TrayApp\\GlobalSecureAccessClient.exe`
- `C:\Program Files\Global Secure Access Client\PolicyService\\GlobalSecureAccessPolicyRetrieverService.exe`
- `C:\Program Files\Global Secure Access Client\LogsCollector\\LogsCollector.exe`
- `C:\Program Files\Global Secure Access Client\AuthenticationRunner\\GlobalSecureAccessAuthenticationRunner.exe`
- `C:\Program Files\Global Secure Access Client\AdvancedDiagnostics\\GlobalSecureAccessClientAdvancedDiagnostics.exe`
 
To exclude these processes from Microsoft Defender for Endpoint, see [Configure custom exclusions for Microsoft Defender Antivirus](/defender-endpoint/configure-exclusions-microsoft-defender-antivirus).
 

- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessEngineService.exe`
- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessETLController.exe`
- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessTunnelingService.exe`
- `C:\Program Files\Global Secure Access Client\TrayApp\GlobalSecureAccessClient.exe`
- `C:\Program Files\Global Secure Access Client\PolicyService\GlobalSecureAccessPolicyRetrieverService.exe`
- `C:\Program Files\Global Secure Access Client\LogsCollector\LogsCollector.exe`
- `C:\Program Files\Global Secure Access Client\AuthenticationRunner\GlobalSecureAccessAuthenticationRunner.exe`
- `C:\Program Files\Global Secure Access Client\AdvancedDiagnostics\GlobalSecureAccessClientAdvancedDiagnostics.exe`
 
To exclude these processes from Microsoft Defender for Endpoint, see [Configure custom exclusions for Microsoft Defender Antivirus](/defender-endpoint/configure-exclusions-microsoft-defender-antivirus).
 

MODIFIED docs/identity/devices/concept-tokens-in-microsoft-entra-id.md

Modified by jenniferf-skc on Apr 19, 2025 2:47 AM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Refining content

Changes:

Before

After

 
|Control | Windows 10/11 | macOS | Linux|
|------|------|------|------|
| [Enable Microsoft Defender Antivirus always-on protection](/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus) for real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. | X | [[X](mailto:[email protected])](mailto:[email protected])     | [[X](mailto:[email protected])](mailto:[email protected])     |
| [[[Enable Microsoft Defender Antivirus cloud protection](https://learn.microsoft.com/en-us/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus) to help protect against malware on your endpoints and across your network.](mailto:[email protected])](mailto:[email protected])                                                                       | [[X](mailto:[email protected])](mailto:[email protected])             | [[X](mailto:[email protected])](mailto:[email protected])     | [[X](mailto:[email protected])](mailto:[email protected])     |
| [[[Enable network protection in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/network-protection) to protect devices from certain Internet-based events by preventing connections to malicious or suspicious sites.](mailto:[email protected])](mailto:[email protected])                                                          | [[X](mailto:[email protected])](mailto:[email protected])             | [[X](mailto:[email protected])](mailto:[email protected])     | [[X](mailto:[email protected])](mailto:[email protected])     |
| [[[Enable tamper protection in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) to protect certain security settings, such as virus and threat protection, from being disabled or changed.](mailto:[email protected])](mailto:[email protected])                         | [[X](mailto:[email protected])](mailto:[email protected])             | [[X](mailto:[email protected])](mailto:[email protected])     | [[-](mailto:[email protected])](mailto:[email protected])     |
| [[[Create a device compliance policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) that requires the machine risk level to be designated by Microsoft Defender for Endpoint as “low” or “clear” to be compliant.](mailto:[email protected])](mailto:[email protected])                                            | [[X](mailto:[email protected])](mailto:[email protected])             | [[X](mailto:[email protected])](mailto:[email protected])     | [[-](mailto:[email protected])](mailto:[email protected])     |
 
[[Even with device hardening policies in place, organizations must

 
|Control | Windows 10/11 | macOS | Linux|
|------|------|------|------|
| [Enable Microsoft Defender Antivirus always-on protection](../defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus) for real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. | X | X  | X  |
| [Enable Microsoft Defender Antivirus cloud protection](../defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus) to help protect against malware on your endpoints and across your network.  | X | X | X |
| [Enable network protection in Microsoft Defender for Endpoint](../defender-endpoint/network-protection) to protect devices from certain Internet-based events by preventing connections to malicious or suspicious sites. | X | X | X |
| [Enable tamper protection in Microsoft Defender for Endpoint](../defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) to protect certain security settings, such as virus and threat protection, from being disabled or changed.](mailto:[email protected])](mailto:[email protected])                         | [[X](mailto:[email protected])](mailto:[email protected])             | [[X](mailto:[email protected])](mailto:[email protected])     | [[-](mailto:[email protected])](mailto:[email protected])     |
| [[[Create a device compliance policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) that requires the machine risk level to be designated by Microsoft Defender for Endpoint as “low” or “clear” to be compliant.](mailto:[email protected])](mailto:[email protected])                                            | [[X](mailto:[email protected])](mailto:[email protected])             | [[X](mailto:[email protected])](mailto:[email protected])     | [[-](mailto:[email protected])](mailto:[email protected])     |
 
[[Even with device hardening policies in place, organizations must

MODIFIED docs/identity/authentication/concept-mandatory-multifactor-authentication.md

Modified by Justinha on Apr 19, 2025 5:54 AM
📖 View on learn.microsoft.com

+5 / -1 lines changed

Commit: added links and Important note at top of conceptual topic

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 04/15/2025
ms.author: justinha
author: najshahid
manager: femila
 
That's why, starting in 2024, we'll enforce mandatory MFA for all Azure sign-in attempts. For more background about this requirement, see our [blog post](https://aka.ms/azuremfablogpost). This topic covers which applications and accounts are affected, how enforcement gets rolled out to tenants, and other common questions and answers.
 
There's no change for users if your organization already enforces MFA for them, or if they sign in with stronger methods like passwordless or passkey (FIDO2). To verify that MFA is enabled, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md). 
 
## Scope of enforcement 
 
Review the following topics to learn more about how to configure and deploy MFA:
 
- [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md)
- [Tutorial: Secure user sign-in events with Microsoft Entra multifactor authentication](~/identity/authentication/tutorial-enable-azure-mfa.md)
- [Secure sign-in events with Microsoft Entra multifactor](~/identity/authentication/tutorial-enable-azure-mfa.md)
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 04/18/2025
ms.author: justinha
author: najshahid
manager: femila
 
That's why, starting in 2024, we'll enforce mandatory MFA for all Azure sign-in attempts. For more background about this requirement, see our [blog post](https://aka.ms/azuremfablogpost). This topic covers which applications and accounts are affected, how enforcement gets rolled out to tenants, and other common questions and answers.
 
> [!Important]
> If a user can't sign in to Azure and other admin portals because of mandatory MFA enforcement, you can run a script to help them sign in. For more information, see [How to sign in users who are locked out by mandatory MFA](how-to-unlock-users-for-mandatory-multifactor-authentication).
 
There's no change for users if your organization already enforces MFA for them, or if they sign in with stronger methods like passwordless or passkey (FIDO2). To verify that MFA is enabled, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md). 
 
## Scope of enforcement 
 
Review the following topics to learn more about how to configure and deploy MFA:
 
- [How to sign in users who are locked out by mandatory MFA](how-to-unlock-users-for-mandatory-multifactor-authentication)

MODIFIED docs/identity/authentication/howto-sspr-customization.md

Modified by paulth1 on Apr 19, 2025 5:53 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: edit pass: sspr-articles

Changes:

Before

After

 
The graphics that you choose appear in the following circumstances:
 
* After a user enters their username
* If the user accesses the customized URL:
   * By passing the `whr` parameter to the password reset page, like `https://login.microsoftonline.com/?whr=contoso.com`
   * By passing the `username` parameter to the password reset page, like `https://login.microsoftonline.com/[email protected]`
 
SSPR honors browser language settings. When there's a customization for browser language, the page appears in the browser language customization. Otherwise, it falls to the default locale customization.
 

 
The graphics that you choose appear in the following circumstances:
 
* After a user enters their username.
* If the user accesses the customized URL:
   * By passing the `whr` parameter to the password reset page, like `https://login.microsoftonline.com/?whr=contoso.com`.
   * By passing the `username` parameter to the password reset page, like `https://login.microsoftonline.com/[email protected]`.
 
SSPR honors browser language settings. When there's a customization for browser language, the page appears in the browser language customization. Otherwise, it falls to the default locale customization.
 

MODIFIED docs/identity/authentication/how-to-mandatory-multifactor-authentication.md

Modified by Justinha on Apr 19, 2025 8:36 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: edits from PMs

Changes:

Before

After

---
# How to verify that users are set up for mandatory MFA
 
This topic covers steps to verify that users in your organization are set up to meet Azure's mandatory MFA requirements. For more information about which applications and accounts are affected and how the rollout works, see [Planning for mandatory multifactor authentication for Azure and other admin portals](concept-mandatory-multifactor-authentication.md).
 
## Verify MFA for a personal account
 
 
Review the following topics to learn more about MFA:
 
- [How to sign in users who are locked out by mandatory MFA](how-to-unlock-users-for-mandatory-multifactor-authentication.md)
- [Planning for mandatory multifactor authentication for Azure and other admin portals](concept-mandatory-multifactor-authentication.md)
- [Tutorial: Secure user sign-in events with Microsoft Entra multifactor authentication](~/identity/authentication/tutorial-enable-azure-mfa.md)
- [Secure sign-in events with Microsoft Entra multifactor](~/identity/authentication/tutorial-enable-azure-mfa.md)

---
# How to verify that users are set up for mandatory MFA
 
This topic covers steps to verify that users in your organization are set up to meet Azure's mandatory MFA requirements. For more information about which applications and accounts are affected and how the rollout works, see [Planning for mandatory multifactor authentication for Azure and other admin portals](concept-mandatory-multifactor-authentication.md). 
 
## Verify MFA for a personal account
 
 
Review the following topics to learn more about MFA:
 
- [How to postpone enforcement for a tenant where users are unable to sign in after rollout of mandatory multifactor authentication (MFA) requirement for the the Azure portal, Microsoft Entra admin center, or Microsoft Intune admin center](how-to-unlock-users-for-mandatory-multifactor-authentication.md)
- [Planning for mandatory multifactor authentication for Azure and other admin portals](concept-mandatory-multifactor-authentication.md)
- [Tutorial: Secure user sign-in events with Microsoft Entra multifactor authentication](~/identity/authentication/tutorial-enable-azure-mfa.md)
- [Secure sign-in events with Microsoft Entra multifactor](~/identity/authentication/tutorial-enable-azure-mfa.md)

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files

🗑️ Deleted Documentation Files