📋 Microsoft Entra Documentation Changes

Changes for April 23rd 2025

Period: April 22nd 2025, 12:00 AM to April 23rd 2025, 12:00 AM

📚 Historical Report: This report shows documentation changes that occurred during the 24-hour period ending on April 23rd 2025.

📊 Summary

37
Total Commits
0
New Files
17
Modified Files
0
Deleted Files
14
Contributors

📝 Modified Documentation Files

MODIFIED docs/identity/devices/concept-tokens-in-microsoft-entra-id.md
Modified by jenniferf-skc on Apr 22, 2025 7:06 AM
📖 View on learn.microsoft.com
+176 / -345 lines changed
Commit: Finalizing formatting of article
Changes:
Before
After
ms.service: entra-id
ms.subservice: devices
ms.topic: conceptual
ms.date: 03/26/2025
 
ms.author: jfields
author: jenniferf-skc
manager: femila
ms.reviewer:
---
 
# Introduction
Organizations should harden devices against device-based token exfiltration methods using Microsoft Defender for Endpoint and Microsoft Intune. Organizations should also deploy controls to prevent users from accessing malicious or risky destinations on the
internet.
 
## Harden your devices
 
Perform the following configurations and deployments to harden all devices/endpoints as first line of defense against malware-based token theft. Before you get started, ensure that you have enrolled your devices in Intune, and that you have deployed [Microsoft Defender for Endpoint](../defender-endpoint/mde-planning-guide.md).
 
Mobile devices such as iOS and Android can be hardened using [mobile threat defense](../defender-business/mdb-mtd).
ms.service: entra-id
ms.subservice: devices
ms.topic: conceptual
ms.date: 04/21/2025
 
ms.author: jfields
author: jenniferf-skc
manager: femila
ms.reviewer: jbley
---
 
# Introduction
Organizations should harden devices against device-based token exfiltration methods using Microsoft Defender for Endpoint and Microsoft Intune. Organizations should also deploy controls to prevent users from accessing malicious or risky destinations on the
internet.
 
### Harden your devices
 
Perform the following configurations and deployments to harden all devices/endpoints as first line of defense against malware-based token theft. Before you get started, ensure that you have enrolled your devices in Intune, and that you have deployed [Microsoft Defender for Endpoint](../defender-endpoint/mde-planning-guide.md).
 
Mobile devices such as iOS and Android can be hardened using [mobile threat defense](../defender-business/mdb-mtd).
MODIFIED docs/identity/users/groups-dynamic-membership.md
Modified by ShawnJackson on Apr 22, 2025 9:02 AM
📖 View on learn.microsoft.com
+78 / -74 lines changed
Commit: edit pass: microsoft-entra-dynamic-groups
Changes:
Before
After
 
## Considerations for dynamic membership groups
 
When the attributes of a user or a device change, the system evaluates all rules for dynamic membership groups in a directory to see if the change would trigger any group adds or removes. If users or devices satisfy a rule on a group, they're added as members of that group. If they no longer satisfy the rule, they're removed. You can't manually add or remove a member of a dynamic membership group.
 
Also keep these limitations in mind:
 
 
### License requirements
 
The feature of dynamic membership groups requires a Microsoft Entra ID P1 license or an Intune for Education license for each unique user who is a member of one or more dynamic membership groups. You don't have to assign licenses to users for them to be members of dynamic membership groups, but you must have the minimum number of licenses in the Microsoft Entra organization to cover all such users.
 
For example, if you have a total of 1,000 unique users in all dynamic membership groups in your organization, you need at least 1,000 licenses for Microsoft Entra ID P1 to meet the license requirement.
 
 
Microsoft Entra ID provides a rule builder to create and update your important rules more quickly. The rule builder supports the construction of up to five expressions. You can use the rule builder to form a rule with a few simple expressions, but you can't use it to reproduce every rule. If the rule builder doesn't support the rule that you want to create, you can use the text box.
 
> [!IMPORTANT]
> The rule builder is available only for user-based dynamic membership groups. You can create device-based dynamic membership groups only by using the text box.
 
 
## Considerations for dynamic membership groups
 
When the attributes of a user or a device change, the system evaluates all rules for dynamic membership groups in a directory to see if the change would trigger any group additions or removals. If users or devices satisfy a rule on a group, they're added as members of that group. If they no longer satisfy the rule, they're removed. You can't manually add or remove a member of a dynamic membership group.
 
Also keep these limitations in mind:
 
 
### License requirements
 
The feature of dynamic membership groups requires a Microsoft Entra ID P1 license or an Intune for Education license for each unique user who's a member of one or more dynamic membership groups. You don't have to assign licenses to users for them to be members of dynamic membership groups. But you must have the minimum number of licenses in the Microsoft Entra organization to cover all such users.
 
For example, if you have a total of 1,000 unique users in all dynamic membership groups in your organization, you need at least 1,000 licenses for Microsoft Entra ID P1 to meet the license requirement.
 
 
Microsoft Entra ID provides a rule builder to create and update your important rules more quickly. The rule builder supports the construction of up to five expressions. You can use the rule builder to form a rule with a few simple expressions, but you can't use it to reproduce every rule. If the rule builder doesn't support the rule that you want to create, you can use the text box.
 
:::image type="content" source="./media/groups-dynamic-membership/update-dynamic-group-rule.png" alt-text="Screenshot that shows the rule builder, with the action for adding an expression highlighted.":::
 
For step-by-step instructions, see [Create or update a dynamic membership group](groups-create-rule.md).
MODIFIED docs/identity/users/groups-change-type.md
Modified by ShawnJackson on Apr 22, 2025 9:02 AM
📖 View on learn.microsoft.com
+47 / -42 lines changed
Commit: edit pass: microsoft-entra-dynamic-groups
Changes:
Before
After
---
title: Change static groups to dynamic membership groups
description: Learn how to convert existing groups from static to dynamic membership groups using either the portal or PowerShell cmdlets.
 
author: barclayn
manager: femila
 
# Change static groups to dynamic membership groups in Microsoft Entra ID
 
You can change a group's membership from static to dynamic (or vice-versa) In Microsoft Entra ID, part of Microsoft Entra. Microsoft Entra ID keeps the same group name and ID in the system, so all existing references to the group are still valid. If you create a new group instead, you would need to update those references. Creating dynamic membership groups eliminates management overhead adding and removing users. This article tells you how to convert existing groups from static to dynamic membership groups using either the portal or PowerShell cmdlets. In Microsoft Entra, a single tenant can have a maximum of 15,000 dynamic membership groups.
 
> [!WARNING]
> When changing an existing static group to a dynamic group, all existing members are removed from the group, and then the membership rule is processed to add new members. If the group is used to control access to apps or resources, the original members might lose access until the membership rule is fully processed.
>
> We recommend that you test the new membership rule beforehand to make sure that the new membership in the group is as expected. If you encounter errors during your test, see [Resolve group license problems](licensing-groups-resolve-problems.md).
 
## Change the membership type for a group
 
The following steps can be performed using an account that has at least the Groups Administrator role assigned.
 
---
title: Change Static Groups to Dynamic Membership Groups
description: Learn how to convert existing membership groups from static to dynamic by using either the Azure portal or PowerShell cmdlets.
 
author: barclayn
manager: femila
 
# Change static groups to dynamic membership groups in Microsoft Entra ID
 
You can change a group's membership from static to dynamic (or vice versa) in Microsoft Entra ID. Microsoft Entra ID keeps the same group name and ID in the system, so all existing references to the group are still valid. If you create a new group instead, you need to update those references.
 
Creating dynamic membership groups eliminates the management overhead of adding and removing users. This article shows you how to convert existing membership groups from static to dynamic, by using either the Azure portal or PowerShell cmdlets. In Microsoft Entra, a single tenant can have a maximum of 15,000 dynamic membership groups.
 
> [!WARNING]
> When you change an existing static group to a dynamic group, all existing members are removed from the group. The membership rule is then processed to add new members. If the group is used to control access to apps or resources, the original members might lose access until the membership rule is fully processed.
>
> We recommend that you test the new membership rule beforehand to make sure that the new membership in the group is as expected. If you encounter errors during your test, see [Resolve group license problems](/entra/fundamentals/licensing-groups-resolve-problems).
 
## Prerequisites
 
MODIFIED docs/identity-platform/identifier-uri-restrictions.md
Modified by Ari Crowe on Apr 22, 2025 9:08 AM
📖 View on learn.microsoft.com
+45 / -28 lines changed
Commit: Adding identifier URI restrictions article
Changes:
Before
After
 
# Restrictions on identifier URIs of Microsoft Entra applications
 
When creating or updating a Microsoft Entra application, if you attempt to add an `identifier URI` (also referred to as `App ID URI`) that doesn't comply with the default formats of `api://{appId}` or `api://{tenantId}/{appId}`, you may receive an error like:
 
**The newly added URI {URI} must comply with the format 'api://{appId}' or 'api://{tenantId}/{appId}' as per the default app management policy of your organization. If the requestedAccessTokenVersion is set to 2, this restriction may not apply. See https://aka.ms/identifier-uri-addition-error for more information on this error.**
 
You're receiving this error because your organization has an [app management policy](https://learn.microsoft.com/graph/api/resources/applicationauthenticationmethodpolicy?view=graph-rest-beta) that blocks the addition of insecure identifier URIs. Microsoft may have enabled this policy in your organization to improve its security.
 
The next sections will provide guidance depending on your role in your organization. You can also jump to [learn more about this policy](#more-details-on-this-policy).
 
## Guidance for administrators
 
Read this section if you're an administrator and you or someone else in your organization received this error.
 
You're likely receiving this error because Microsoft enabled this policy on your behalf to improve the security of your organization. Microsoft has provided a script you can use to disable the policy, or to grant exemptions to it. Microsoft doesn't recommend disabling the policy, since it improves your organization’s security. Instead, we recommend enabling the change, and using exemptions to exempt any disrupted processes in your organization. You can grant exemptions to a specific Microsoft Entra application, to yourself, to another user in your organization, or to any service or process your organization uses.
 
- [Learn how to grant exemptions](https://aka.ms/identifier-uri-protection-grant-exemptions)
- [Learn how to disable the change](https://aka.ms/disable-identifier-uri-protection) (**Not Recommended**)
 
 
# Restrictions on identifier URIs of Microsoft Entra applications
 
The [`identifierUri`](#what-are-identifier-uris) - also referred to as `Application ID URI` - property of an Entra application is a required configuration for resource (API) applications. Ensuring the property is configured securely is critical to the application's security.
 
## Secure patterns
 
[!INCLUDE [active-directory-identifierUri](~/includes/entra-identifier-uri-patterns.md)]
 
## Enforcing secure patterns with policy
 
Microsoft has introduced a security setting that protects against insecure configuration of identifier URIs (also called 'App ID URIs') on Microsoft Entra applications. This security setting ensures that newly added URIs on v1 applications comply with the [secure patterns](#secure-patterns) outlined above.
 
### Policy behavior
 
When this setting is enabled, the secure patterns are strictly enforced. Todo - insert error message
 
Doesn't apply to v2 or SAML apps
 
Existing identifier URIs already configured on the Entra app won't be affected, and all apps will continue to function as normal. This will only affect new updates to Entra app configurations.
MODIFIED docs/global-secure-access/troubleshoot-global-secure-access-mobile-client-advanced-diagnostics.md
Modified by jayrusso on Apr 22, 2025 9:24 AM
📖 View on learn.microsoft.com
+41 / -28 lines changed
Commit: Apr 21 finalized article, added images, and updated the TOC
Changes:
Before
After
---
title: "Troubleshoot the Global Secure Access Mobile Client: Advanced Diagnostics"
description: Troubleshoot the Global Secure Access mobile client using the advanced diagnostics utility.
ms.service: global-secure-access
ms.topic: troubleshooting
ms.date: 03/31/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: femila
ms.reviewer: cagautham
 
 
 
# Customer intent: I want to troubleshoot the Global Secure Access mobile client using the Advanced diagnostics utility.
---
# Troubleshoot the Global Secure Access mobile client: Advanced diagnostics
This document provides troubleshooting guidance for the Global Secure Access mobile client for both Android and iOS. It explores each option in the Advanced diagnostics utility.
 
## Introduction
The Global Secure Access client runs in the background and routes relevant network traffic to Global Secure Access. It doesn't require user interaction. The advanced diagnostics tool makes the client's behavior visible to the administrator and helps with troubleshooting.
---
title: "Troubleshoot the Global Secure Access Mobile Client: Advanced Diagnostics"
description: Discover how to use advanced diagnostics to resolve issues with the Global Secure Access mobile client for Android and iOS.
ms.service: global-secure-access
ms.topic: troubleshooting
ms.date: 04/21/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: femila
ms.reviewer: cagautham
ai-usage: ai-assisted
 
 
# Customer intent: I want to troubleshoot the Global Secure Access mobile client using the Advanced diagnostics utility.
---
# Troubleshoot the Global Secure Access mobile client: Advanced diagnostics
This article explains how to troubleshoot the Global Secure Access mobile client for Android and iOS using the advanced diagnostics utility.
 
## Introduction
The Global Secure Access client runs in the background and routes relevant network traffic to Global Secure Access. It doesn't require user interaction. The advanced diagnostics tool makes the client's behavior visible to the administrator and helps with troubleshooting.
MODIFIED docs/identity/users/groups-dynamic-rule-more-efficient.md
Modified by ShawnJackson on Apr 22, 2025 9:02 AM
📖 View on learn.microsoft.com
+25 / -20 lines changed
Commit: edit pass: microsoft-entra-dynamic-groups
Changes:
Before
After
---
title: Create simpler and faster rules for dynamic membership groups
description: How to optimize your membership rules to automatically populate groups.
 
author: barclayn
manager: femila
 
# Create simpler, more efficient rules for dynamic membership groups in Microsoft Entra ID
 
The Microsoft Entra ID engineering team, part of Microsoft Entra, receives reports of incidents related to dynamic membership groups and the processing time for their membership rules. The information that is reported is presented in this article. This article also discusses the most common methods by which Microsoft helps customers to simplify their rules for dynamic membership groups. Simpler and more efficient rules result in better dynamic group processing times.
 
When writing membership rules for dynamic membership groups, follow the steps in this article to ensure that you create these rules as efficiently as possible.
 
## Minimize use of MATCH
 
Minimize the usage of the `match` operator in rules as much as possible. Instead, explore if it's possible to use the `startswith` or `-eq` operators. Considering using other properties that allow you to write rules to select the users you want to be in the group without using the `-match` operator. For example, if you want a rule for the group for all users whose city is Lagos, then instead of using rules like:
 
- `user.city -match "ago"`
- `user.city -match ".*?ago.*"`
 
---
title: Create Simpler and Faster Rules for Dynamic Membership Groups
description: Learn how to optimize your membership rules to automatically populate groups.
 
author: barclayn
manager: femila
 
# Create simpler, more efficient rules for dynamic membership groups in Microsoft Entra ID
 
This article also discusses the most common methods that you can use to simplify your rules for dynamic membership groups. Rules that are simpler and more efficient result in better processing times for dynamic groups.
 
When you're writing membership rules for dynamic membership groups, follow the tips in this article to ensure that you create these rules as efficiently as possible.
 
## Minimize use of the -match operator
 
Minimize your use of the `-match` operator in rules as much as possible. Instead, explore if it's possible to use the `-startswith` or `-eq` operator. Consider using other properties that allow you to write rules to select the users for a group without using the `-match` operator.
 
For example, if you want a rule for the group that contains all users whose city is Lagos, don't use a rule like this one:
 
- `user.city -match "ago"`
MODIFIED docs/identity/users/groups-dynamic-rule-validation.md
Modified by ShawnJackson on Apr 22, 2025 9:02 AM
📖 View on learn.microsoft.com
+23 / -20 lines changed
Commit: edit pass: microsoft-entra-dynamic-groups
Changes:
Before
After
---
title: Validate rules for dynamic membership groups membership (Preview)
description: How to test members against a rule for a dynamic membership groups in Microsoft Entra ID.
 
author: barclayn
manager: femila
ms.custom: it-pro
---
 
# Validate rules for dynamic membership groups in Microsoft Entra ID (Preview)
 
Microsoft Entra ID provides the means to validate rules for dynamic membership groups (in public preview). On the **Validate rules** tab, you can validate that rule against sample group members to confirm the rule is working as expected. When you create or update rules for dynamic membership groups, you want to know whether a user or a device is a member of the group. This knowledge helps you evaluate whether a user or device meets the rule criteria and help you troubleshoot when membership isn't expected.
 
## Prerequisites
 
To evaluate the rule for dynamic membership groups, the administrator must be at least a Groups Administrator.
 
> [!TIP]
> Assigning one of required roles via indirect dynamic membership groups is not yet supported.
 
---
title: Validate Rules for Dynamic Membership Groups (Preview)
description: Learn how to test members against a rule for a dynamic membership groups in Microsoft Entra ID.
 
author: barclayn
manager: femila
ms.custom: it-pro
---
 
# Validate rules for dynamic membership groups in Microsoft Entra ID (preview)
 
Microsoft Entra ID provides the means to validate rules for dynamic membership groups (in preview). On the **Validate rules** tab, you can validate a rule against sample group members to confirm that the rule is working as expected.
 
When you create or update rules for dynamic membership groups, you want to know whether a user or a device is a member of the group. This knowledge helps you evaluate whether a user or device meets the rule criteria. It also helps you troubleshoot when membership isn't expected.
 
## Prerequisites
 
To evaluate the rule for dynamic membership groups, the administrator must be at least a [Groups Administrator](~/identity/role-based-access-control/permissions-reference.md#groups-administrator).
 
> [!TIP]
MODIFIED docs/identity/hybrid/connect/authenticate-application-id.md
Modified by owinoakelo on Apr 22, 2025 11:30 PM
📖 View on learn.microsoft.com
+11 / -10 lines changed
Commit: Update authenticate-application-id.md
Changes:
Before
After
---
 
# Authenticate to Microsoft Entra ID using Application Identity
 
Microsoft Entra Connect provides 2 options for certificate management:
 
- Use BYOC:
> [!NOTE]
> The certificate thumbprint needs to be provided when registering the application.
 
``` powershell
Add-EntraApplicationRegistration –UserPrincipalName <AdminUserPrincipalName> -CertificateThumbprint <certificateThumbprint>
```
Replace &lt;AdminUserPrincipalName&gt; with the AdminUserPrincipalName and &lt;certificateThumbprint&gt; with the CertificateThumbPrint
 
4. Link Entra Application with Microsoft Entra Connect Sync using Administrator credentials.
 
- Use BYOC:
---
 
# Authenticate to Microsoft Entra ID using Application Identity
Entra Connect uses the [Microsoft Entra Connector account](entra/identity/hybrid/connect/reference-connect-accounts-permissions#accounts-used-for-microsoft-entra-connect.md) to authenticate and sync identities from Active Directorty to Entra ID. This account uses username and password to authenticate requests. To enhance the security of the service, we are rolling out an application identity that uses Oauth 2.0 client credential flow with certificate credentials. In this new method, Entra will create a single tenant 3rd party application in Entra ID and use one of the two certificate management options below for the credentials.
 
Microsoft Entra Connect provides 2 options for certificate management:
 
- Use BYOC:
> [!NOTE]
> The certificate SHA256Hash needs to be provided when registering the application.
 
``` powershell
Add-EntraApplicationRegistration –UserPrincipalName <AdminUserPrincipalName> -CertificateSHA256Hash <CertificateSHA256Hash>
```
Replace &lt;AdminUserPrincipalName&gt; with the AdminUserPrincipalName and &lt;CertificateSHA256Hash&gt; with the CertificateSHA256Hash
 
4. Link Entra Application with Microsoft Entra Connect Sync using Administrator credentials.
 
- Use BYOC:
MODIFIED docs/identity/users/groups-troubleshooting.md
Modified by ShawnJackson on Apr 22, 2025 9:52 AM
📖 View on learn.microsoft.com
+8 / -9 lines changed
Commit: fixing validation error
Changes:
Before
After
2. If it returns `EnableGroupCreation : True`, then nonadmin users can create groups. To disable this feature:
 
```powershell
Install-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
$params = @{
TemplateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
Values = @(
@{
Name = "EnableGroupCreation"
Value = "false"
}
)
}
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
New-MgBetaDirectorySetting -BodyParameter $params
```
 
**I received a max groups allowed error when trying to create a Dynamic Group in PowerShell**
2. If it returns `EnableGroupCreation : True`, then nonadmin users can create groups. To disable this feature:
 
```powershell
Install-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
$params = @{
TemplateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
Values = @(
@{
Name = "EnableGroupCreation"
Value = "false"
}
)
}
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
New-MgBetaDirectorySetting -BodyParameter $params
```
 
**I received a max groups allowed error when trying to create a Dynamic Group in PowerShell**
 
MODIFIED docs/id-governance/entitlement-management-access-package-auto-assignment-policy.md
Modified by ShawnJackson on Apr 22, 2025 9:29 AM
📖 View on learn.microsoft.com
+8 / -8 lines changed
Commit: fixing bookmarks
Changes:
Before
After
 
## Before you begin
 
You need to have attributes populated on the users who will be in scope for being assigned access. The attributes you can use in the rules criteria of an access package assignment policy are those attributes listed in [supported properties](../identity/users/groups-dynamic-membership.md#supported-properties), along with [extension attributes and custom extension properties](../identity/users/groups-dynamic-membership.md#extension-properties-and-custom-extension-properties). These attributes can be brought into Microsoft Entra ID by [patching](../identity/app-provisioning/user-provisioning-sync-attributes-for-mapping.md#create-an-extension-attribute-for-cloud-only-users-using-microsoft-graph) the [user](/graph/api/resources/user), an HR system such as [SuccessFactors](../identity/app-provisioning/sap-successfactors-integration-reference.md), [Microsoft Entra Connect cloud sync](../identity/hybrid/cloud-sync/how-to-attribute-mapping.md) or [Microsoft Entra Connect Sync](../identity/hybrid/connect/how-to-connect-sync-feature-directory-extensions.md). The rules can include up to 15,000 users per policy.
 
## License requirements
 
$apid = "00001111-aaaa-2222-bbbb-3333cccc4444"
 
$pparams = @{
DisplayName = "Sales department users"
Description = "All users from sales department"
AllowedTargetScope = "specificDirectoryUsers"
SpecificAllowedTargets = @( @{
"@odata.type" = "#microsoft.graph.attributeRuleMembers"
description = "All users from sales department"
membershipRule = '(user.department -eq "Sales")'
} )
AutomaticRequestSettings = @{
RequestAccessForAllowedTargets = $true
 
## Before you begin
 
You need to have attributes populated on the users who will be in scope for being assigned access. The attributes you can use in the rules criteria of an access package assignment policy are those attributes listed in [supported properties](../identity/users/groups-dynamic-membership.md#supported-properties), along with [extension attributes and custom extension properties](../identity/users/groups-dynamic-membership.md#extension-attributes-and-custom-extension-properties). These attributes can be brought into Microsoft Entra ID by [patching](../identity/app-provisioning/user-provisioning-sync-attributes-for-mapping.md#create-an-extension-attribute-for-cloud-only-users-using-microsoft-graph) the [user](/graph/api/resources/user), an HR system such as [SuccessFactors](../identity/app-provisioning/sap-successfactors-integration-reference.md), [Microsoft Entra Connect cloud sync](../identity/hybrid/cloud-sync/how-to-attribute-mapping.md) or [Microsoft Entra Connect Sync](../identity/hybrid/connect/how-to-connect-sync-feature-directory-extensions.md). The rules can include up to 15,000 users per policy.
 
## License requirements
 
$apid = "00001111-aaaa-2222-bbbb-3333cccc4444"
 
$pparams = @{
DisplayName = "Sales department users"
Description = "All users from sales department"
AllowedTargetScope = "specificDirectoryUsers"
SpecificAllowedTargets = @( @{
"@odata.type" = "#microsoft.graph.attributeRuleMembers"
description = "All users from sales department"
membershipRule = '(user.department -eq "Sales")'
} )
AutomaticRequestSettings = @{
RequestAccessForAllowedTargets = $true
MODIFIED docs/identity/conditional-access/what-if-tool.md
Modified by John Flores on Apr 22, 2025 3:44 AM
📖 View on learn.microsoft.com
+9 / -7 lines changed
Commit: applying feedback from pm
Changes:
Before
After
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: conceptual
ms.date: 04/09/2025
 
ms.author: joflore
author: MicrosoftGuyJFlo
---
# Troubleshoot Conditional Access Policies with the What If Tool
 
The **Conditional Access What If policy tool** helps you understand the result of [Conditional Access](overview.md) policies in your environment. Instead of manually testing your policies with multiple sign-ins, this tool helps you simulate a sign-in for a user or service principal. The simulation estimates how your policies affect this sign-in and generates a report.
 
The **What If** tool lets you quickly determine the policies that apply to a specific user or single-tenant service principal. Use this information to troubleshoot issues and understand which policies apply to specific sign-in conditions.
 
## How it works
 
In the improved Conditional Access What If tool powered by the What If Evaluation API, first configure the conditions of the sign-in scenario you want to simulate. These settings might include:
 
- The user or single tenant service principal you want to test.
- The cloud apps, user action they would attempt to perform, or sensitive data protected by authentication context they would attempt to access.
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: conceptual
ms.date: 04/21/2025
 
ms.author: joflore
author: MicrosoftGuyJFlo
---
# Troubleshoot Conditional Access Policies with the What If Tool
 
The **Conditional Access What If policy tool** helps you understand the result of [Conditional Access](overview.md) policies in your environment. It can be useful when simulating uncommon scenarios, enabling you to design more comprehensive security policies. Instead of manually testing your policies with multiple sign-ins, this tool helps you simulate a sign-in for a user or service principal. The simulation estimates how your policies affect this sign-in and generates a report.
 
The **What If** tool and [APIs](/graph/api/conditionalaccessroot-evaluate) let you quickly determine the policies that apply to a specific user or single-tenant service principal. Use this information to troubleshoot issues, understand which policies apply to specific sign-in conditions, and test complex sign-in scenarios.
 
## How it works
 
The Conditional Access What If tool is powered by the [What If Evaluation API](/graph/api/conditionalaccessroot-evaluate). To use the tool, start by configuring the conditions of the sign-in scenario you want to simulate. The configuration should include:
 
- The user or single tenant service principal you want to test.
- The cloud apps, user action they would attempt to perform, or sensitive data protected by authentication context they would attempt to access.
MODIFIED docs/identity/app-provisioning/provision-custom-security-attributes.md
Modified by jenniferf-skc on Apr 22, 2025 2:00 AM
📖 View on learn.microsoft.com
+6 / -9 lines changed
Commit: Removing preview text in preparation for GA
Changes:
Before
After
---
title: Provision custom security attributes from HR sources (preview)
description: Learn how to provision custom security attributes from HR sources.
author: jenniferf-skc
manager: femila
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: troubleshooting
ms.date: 03/04/2025
ms.author: jfields
ms.reviewer: chmutali
---
 
# Provision custom security attributes from HR sources (preview)
 
Custom security attribute provisioning enables customers to set custom security attributes automatically using Microsoft Entra inbound provisioning capabilities. With this public preview, you can source values for custom security attributes from authoritative sources, such as those from HR systems. Custom security attribute provisioning supports the following sources: Workday, SAP SuccessFactors, and other integrated HR systems that use API-driven provisioning. The provisioning target is your Microsoft Entra ID tenant.
 
:::image type="content" source="media/provision-custom-security-attributes/about-custom-security-attributes.png" alt-text="Diagram of custom security attributes architecture.":::
 
> [!NOTE]
---
title: Provision custom security attributes from HR sources
description: Learn how to provision custom security attributes from HR sources.
author: jenniferf-skc
manager: femila
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: troubleshooting
ms.date: 04/30/2025
ms.author: jfields
ms.reviewer: chmutali
---
 
# Provision custom security attributes from HR sources
 
Custom security attribute provisioning enables customers to set custom security attributes automatically using Microsoft Entra inbound provisioning capabilities. With this public feature, you can source values for custom security attributes from authoritative sources, such as those from HR systems. Custom security attribute provisioning supports the following sources: Workday, SAP SuccessFactors, and other integrated HR systems that use API-driven provisioning. The provisioning target is your Microsoft Entra ID tenant.
 
:::image type="content" source="media/provision-custom-security-attributes/about-custom-security-attributes.png" alt-text="Diagram of custom security attributes architecture.":::
 
## Custom security attributes
MODIFIED docs/identity/authentication/concept-certificate-based-authentication-certificateuserids.md
Modified by James Barnett on Apr 22, 2025 3:53 AM
📖 View on learn.microsoft.com
+6 / -6 lines changed
Commit: Update concept-certificate-based-authentication-certificateuserids.md
Changes:
Before
After
## How to find the correct CertificateUserIds values for a user from the end user certificate using PowerShell module
 
Certificate UserIds follow a certain pattern for its values as per the UserName binding configurations on the tenant.
The following powershell command helps an admin to retrieve the exact values for Certificate UserIds attribute for a user from a end user certificate.
Admin can also get the current values in Certificate UserIds attribute for an user for a given username binding and
set the value of the Certificate UserIds attribute.
 
More information at [Microsoft Entra PowerShell Installation](/powershell/entra-powershell/installation) and [Microsoft Graph PowerShell](/powershell/microsoftgraph/installation).
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
```
 
1. Install Microsoft Entra powershell module (Minimum required version is 1.0.6)
```powershell
Install-Module -Name Microsoft.Entra
```
```
This example sets the certificate user IDs for the specified user using a certificate object, mapping the RFC822Name and SKI fields. You can use Get-EntraUserCBAAuthorizationInfo command to view updated details.
 
## Update certificateUserIds using Entra Portal
## How to find the correct CertificateUserIds values for a user from the end user certificate using PowerShell module
 
Certificate UserIds follow a certain pattern for its values as per the UserName binding configurations on the tenant.
The following PowerShell command helps an admin to retrieve the exact values for Certificate UserIds attribute for a user from an end user certificate.
Admin can also get the current values in Certificate UserIds attribute for a user for a given username binding and
set the value of the Certificate UserIds attribute.
 
More information at [Microsoft Entra PowerShell Installation](/powershell/entra-powershell/installation) and [Microsoft Graph PowerShell](/powershell/microsoftgraph/installation).
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
```
 
1. Install Microsoft Entra PowerShell module (Minimum required version is 1.0.6)
```powershell
Install-Module -Name Microsoft.Entra
```
```
This example sets the certificate user IDs for the specified user using a certificate object, mapping the RFC822Name and SKI fields. You can use Get-EntraUserCBAAuthorizationInfo command to view updated details.
 
## Update certificateUserIds using Microsoft Entra admin center
MODIFIED docs/identity/hybrid/cloud-sync/how-to-prerequisites.md
Modified by Nuno Alexandre on Apr 22, 2025 12:12 PM
📖 View on learn.microsoft.com
+5 / -1 lines changed
Commit: Learn Editor: Update how-to-prerequisites.md
Changes:
Before
After
- Domain Administrator or Enterprise Administrator credentials to create the Microsoft Entra Connect cloud sync gMSA (group managed service account) to run the agent service.
- A Hybrid Identity Administrator account for your Microsoft Entra tenant that isn't a guest user.
- An on-premises server for the provisioning agent with Windows 2016 or later. This server should be a tier 0 server based on the [Active Directory administrative tier model](/security/privileged-access-workstations/privileged-access-access-model). Installing the agent on a domain controller is supported. For more information, see [Harden your Microsoft Entra provisioning agent server](#harden-your-microsoft-entra-provisioning-agent-server)
- Required for AD Schema attribute - msDS-ExternalDirectoryObjectId
- High availability refers to the Microsoft Entra Cloud Sync's ability to operate continuously without failure for a long time. By having multiple active agents installed and running, Microsoft Entra Cloud Sync can continue to function even if one agent should fail. Microsoft recommends having 3 active agents installed for high availability.
- On-premises firewall configurations.
 
 
 
 
 
- Domain Administrator or Enterprise Administrator credentials to create the Microsoft Entra Connect cloud sync gMSA (group managed service account) to run the agent service.
- A Hybrid Identity Administrator account for your Microsoft Entra tenant that isn't a guest user.
- An on-premises server for the provisioning agent with Windows 2016 or later. This server should be a tier 0 server based on the [Active Directory administrative tier model](/security/privileged-access-workstations/privileged-access-access-model). Installing the agent on a domain controller is supported. For more information, see [Harden your Microsoft Entra provisioning agent server](#harden-your-microsoft-entra-provisioning-agent-server)
 
- Required for AD Schema attribute - msDS-ExternalDirectoryObjectId
- The Windows Credential Manager service (VaultSvc) cannot be disabled as that prevents the provisioning agent from installing.
 
- High availability refers to the Microsoft Entra Cloud Sync's ability to operate continuously without failure for a long time. By having multiple active agents installed and running, Microsoft Entra Cloud Sync can continue to function even if one agent should fail. Microsoft recommends having 3 active agents installed for high availability.
- On-premises firewall configurations.
 
MODIFIED docs/identity/enterprise-apps/view-applications-portal.md
Modified by Allison Amaral (MSFT) on Apr 22, 2025 10:46 AM
📖 View on learn.microsoft.com
+5 / -1 lines changed
Commit: Update view-applications-portal.md
Changes:
Before
After
- **Enterprise Applications** shows non-Microsoft applications.
- **Microsoft Applications** shows Microsoft applications.
- **Managed Identities** shows applications that are used to authenticate to services that support Microsoft Entra authentication.
- **All Applications** shows both non-Microsoft and Microsoft applications.
1. Under **Application ID starts with**, enter the first few digits of the application ID if you know the application ID.
1. After choosing the options you want, select **Apply**.
1. Select **Add filters** to add more options for filtering the search results. The other options include:
- **Application Visibility**
- **Created on**
- **Assignment required**
- **Is app Proxy**
- **Owner**
1. To remove any of the filter options already added, select the **X** icon next to the filter option.
 
 
 
 
 
 
- **Enterprise Applications** shows non-Microsoft applications.
- **Microsoft Applications** shows Microsoft applications.
- **Managed Identities** shows applications that are used to authenticate to services that support Microsoft Entra authentication.
- **Agent IDs (Preview)** shows AI agent identities that are used by AI agents to to authenticate to services that support Microsoft Entra authentication.
- **All Applications** shows both non-Microsoft and Microsoft applications.
1. Under **Application ID starts with**, enter the first few digits of the application ID if you know the application ID.
1. After choosing the options you want, select **Apply**.
1. Select **Add filters** to add more options for filtering the search results. The other options include:
- **Application Status**
- **Application Visibility**
- **Created on**
- **Assignment required**
- **Is App Proxy**
- **Owner**
- **Identifier URI (Entity ID)**
- **Homepage URL**
1. To remove any of the filter options already added, select the **X** icon next to the filter option.
 
 

🤖 This historical report was generated by the Entra Docs Monitor

🔗 Visit Repository

📅 ← Back to All Reports