📋 Microsoft Entra Documentation Changes

title: Understanding Tokens and How to Protect them in Microsoft Entra

# Understanding tokens in Microsoft Entra

- Deploying phishing-resistant credentials

This document summarizes the basics of what tokens are, how tokens are stolen, and provide concrete steps you can take to mitigate the risk of successful attacks in your environment. Due to the complexity and wide variety of tokens in Microsoft Entra, some topics are generalized for simplicity and may not cover all edge cases. However, this guidance covers most scenarios for public clients. Confidential client scenarios aren't in scope.

- [Token Protection](../conditional-access/concept-token-protection.md#licensing-requirements)

- [Microsoft Intune (minimum Plan 1)](~/mem/intune/fundamentals/licenses.md#microsoft-intune-plan-1)

- [Microsoft Defender for Endpoint XDR](~/defender-xdr/prerequisites.md#licensing-requirements)

Perform the following configurations and deployments to harden all devices/endpoints as frontline of defense against malware-based token theft. Before you get started, ensure that your devices are enrolled with Intune, and that [Microsoft Defender for Endpoint](~/defender-endpoint/mde-planning-guide.md) is deployed.

| [Enable Microsoft Defender Antivirus always-on protection](~/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus.md) for real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. | X | X | X |

| [Enable Microsoft Defender Antivirus cloud protection](~/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus.md) to help protect against malware on your endpoints and across your network. | X | X | X |

| [Enable network protection in Microsoft Defender for Endpoint](~/defender-endpoint/network-protection.md) to protect devices from certain Internet-based events by preventing connections to malicious or suspicious sites. | X | X | X |

| [Enable tamper protection in Microsoft Defender for Endpoint](~/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection.md) to protect certain security settings, such as virus and threat protection, from being disabled or changed. | X | X | - |

| `onPremisesSecurityIdentifier` | On-premises security identifier (SID) for users who were synchronized from on-premises to the cloud. | ```user.onPremisesSecurityIdentifier -eq "S-1-1-11-1111111111-1111111111-1111111111-1111111"``` |

> For best results, minimize the use of `Match` or `Contains` as much as possible. The article [Create simpler, more efficient rules for dynamic membership groups](groups-dynamic-rule-more-efficient.md) provides guidance on how to create rules that result in better dynamic group processing times. The [`memberOf`](groups-dynamic-rule-member-of.md) operator is in preview and should be used with caution, because it has some limitations.

In the following example, the expression evaluates to `true` if the value of `user.department` equals any of the values in the list:

Microsoft Entra Connect manages the application and certificate including creation, rotation and deletion of the certificate. The certificate is stored in the Local Machine store. For optimal protection of the certificate’s private key, it is recommended that the machine employs a Trusted Platform Module (TPM) solution to establish a hardware-based security boundary. When a TPM is available, key service operations are performed within a dedicated hardware environment. In contrast, if a TPM cannot be used, Entra Connect defaults to storing the certificate in the Local Machine store and marks the private key as non-exportable for additional protection. However, without the hardware isolation provided by a TPM, the private key is secured solely by software safeguards and does not achieve the same level of protection. For more information on TPM, see [Trusted Platform Module Technology Overview](/windows/security/hardware-security/tpm/trusted-platform-module-overview).

Microsoft recommendeds the Microsoft Entra Connect certificate management option as we manage the keys and automatically roll-over the certificate on expiry.

Microsoft Entra Connect Sync manages the application identity that will be used by Entra Connect Sync to authenticate to Microsoft Entra ID, and you manage the certificate credential used by the application. Your administrator is responsible for creating the certificate, rotation and deletion of unused/expired certificates. The certificate should be stored in the Local Machine store. You are responsible for securing the private key of the certificate and ensuring only Microsoft Azure AD Sync service can access the private key for signing.

The following are additional requirements depending on which certificate management option you select.

 

> * Learn about recommend restrictions for secrets and certificates.

> * Update that policy to enforce restrictions.

* **Limit asymmetric key (certificate) lifetime to 180 days**: Certificates provide a more secure way to authenticate applications than client secrets. However, they can still be compromised if not managed properly. By limiting the lifetime of certificates, you can reduce the risk of long-lived certificates being exploited by attackers. Certificates should be rotated regularly to ensure that they aren't compromised. The recommended maximum lifetime for certificates is 180 days. This means that you should rotate your certificates at least every 180 days. Setting a shorter lifetime for highly sensitive applications can further reduce the risk of compromise.

> [!Important]

:::image type="content" source="./media/groups-create-rule/update-dynamic-group-rule.png" alt-text="Screenshot that shows the rule builder, with the action for adding an expression highlighted.":::

 

For examples of syntax, supported properties, operators, and values for a membership rule, see [Manage rules for dynamic membership groups in Microsoft Entra ID](groups-dynamic-membership.md).

> This page now has a **Pause processing** option. Previously, this option was available only through the modification of the `membershipRuleProcessingState` property. Someone who has at least the [Groups Administrator](/entra/identity/role-based-access-control/permissions-reference#groups-administrator) role can manage this setting and can pause and resume dynamic membership group processing. Group owners who don't have the correct roles don't have the necessary rights to edit this setting.

title: Tutorial - Create a forest trust in Microsoft Entra Domain Services (Preview) | Microsoft Learn

ms.date: 02/19/2025

# Tutorial: Create a two-way forest trust in Microsoft Entra Domain Services with an on-premises domain (Preview)

>[!NOTE] If the values from the certificate are too long, you can send the output to a file and copy from there.

> Use Get-EntraUserCertificateUserIdsFromCertificate -Path C:\Downloads\test.pem | Format-List | Out-File -FilePath ".\certificateUserIds.txt"

- **Avoid Match**: Avoid the use of the `Match` operator in rules as much as possible. Instead, use the `StartsWith`, `Equals`, or `EndsWith` operator.

- **Avoid Contains**: Similar to the use of `Match`, avoid the use of the `Contains` operator in rules as much as possible. It can lead to increased processing time.

- **Use fewer OR operators**: Instead, use the `-in` operator to group rules into a single criterion. Grouping rules makes them easier to evaluate.

- **Minimize the use of MemberOf (at this time)**: [`memberOf`](groups-dynamic-rule-member-of.md) is currently in preview. It can introduce more complexity, particularly if a tenant has a large number of groups or frequent updates. Avoid using this operator if possible, because it comes with bugs and limitations. The recommendation is to delete existing `MemberOf` groups in your tenant.

This article also discusses the most common methods that you can use to simplify your rules for dynamic membership groups. Rules that are simpler and more efficient result in better processing times for dynamic groups.

For example, if you want a rule for the group that contains all users whose city is Lagos, don't use a rule like this one:

Ensure that you aren't using redundant criteria in your rule. For example, instead of using a rule like this one:

title: How trusts work for Microsoft Entra Domain Services (Preview) | Microsoft Learn

ms.date: 01/27/2025

# How trust relationships work for forests in Active Directory (Preview)

title: Create a Microsoft Entra Domain Services forest trust using Azure PowerShell (Preview) | Microsoft Learn

ms.date: 01/26/2025

# Create a Microsoft Entra Domain Services forest trust to an on-premises domain using Azure PowerShell (Preview)

The following steps are an example of changing a group from static to dynamic membership groups for a group of users:

1. Select a **Membership type** of **Dynamic User**. In the dialog that explains the changes to the dynamic membership groups, select **Yes** to continue.

Self-service password reset (SSPR) gives users in Microsoft Entra ID the ability to change or reset their password, with no administrator or help desk involvement. If a user's account is locked or they forget their password, they can follow prompts to unblock themselves and get back to work. This ability reduces help-desk calls and loss of productivity when a user can't sign in to their device or an application.

* Customize the help-desk link to provide a web URL address that users can use to get assistance. This option is under **Password Reset** > **Customization** > **Custom helpdesk email or URL**.

By using self-service password reset (SSPR) in Microsoft Entra ID, users can change or reset their password with no administrator or help desk involvement. Typically, users open a web browser on another device to access the [SSPR portal](https://aka.ms/sspr). To improve the experience on computers that run Windows 7, 8, 8.1, 10, and 11, you can enable users to reset their password on the Windows sign-in screen.

If your IT team hasn't enabled the ability to use SSPR from your Windows device or you have problems during sign-in, reach out to your help desk for more assistance.