📋 Microsoft Entra Documentation Changes

ms.service: entra-id

ms.subservice: devices

ms.topic: conceptual

 

ms.author: jfields

author: jenniferf-skc

- [Microsoft Entra Internet Access for Microsoft services](../../global-secure-access/overview-what-is-global-secure-access.md#licensing-overview)

- [Microsoft Entra ID Protection](../../id-protection/overview-identity-protection.md#license-requirements)

- [Token Protection](../conditional-access/concept-token-protection.md#requirements)

- [Microsoft Defender for Endpoint XDR](/defender-xdr/prerequisites#licensing-requirements)

 

## Defense-in-depth strategy against token theft

 

Preventing a successful token theft incident from occurring in the first place is the most effective way to protect your organization. Organizations should harden devices against device-based token exfiltration methods using Microsoft Defender for Endpoint and Microsoft Intune. Organizations should also deploy controls to prevent users from accessing malicious or risky destinations on the internet.

 

 

Perform the following configurations and deployments to harden all devices/endpoints as frontline of defense against malware-based token theft. Before you get started, ensure that your devices are enrolled with Intune, and that [Microsoft Defender for Endpoint](/defender-endpoint/mde-planning-guide) is deployed.

 

---

 

## September 2024

 

### Public preview - New Conditional Access Template Requiring Device Compliance

 

Organizations can also integrate NPS with Microsoft Entra multifactor authentication to enhance security and provide a high level of compliance. This helps ensure that users establish two-step verification to sign in to the Remote Desktop Gateway. For users to be granted access, they must provide their username/password combination along with information that the user has in their control. This information must be trusted and not easily duplicated, such as a cell phone number, landline number, application on a mobile device, and so on. RDG currently supports phone call and **Approve**/**Deny** push notifications from Microsoft authenticator app methods for 2FA. For more information about supported authentication methods, see the section [Determine which authentication methods your users can use](howto-mfa-nps-extension.md#determine-which-authentication-methods-your-users-can-use).

 

 

Prior to the availability of the NPS extension for Azure, customers who wished to implement two-step verification for integrated NPS and Microsoft Entra multifactor authentication environments had to configure and maintain a separate MFA Server in the on-premises environment as documented in [Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS](howto-mfaserver-nps-rdg.md).

 

1. Browse to **Identity** > **Overview**.

 


The hybrid reporting agent, used to send a MIM Service event log to Microsoft Entra to surface in password reset and self-service group management reports, is deprecated. The recommended replacement is to use Azure Arc to send the event logs to Azure Monitor. For more information, see: [Microsoft Identity Manager 2016 reporting with Azure Monitor](/microsoft-identity-manager/mim-azure-monitor-reporting).

 

---

ms.subservice: external

ms.topic: how-to

ms.author: mimart

ms.reviewer: kengaderdus

ms.custom: it-pro, seo-july-2024

 

1. Select **Create** to create the user flow.

 

## Next steps

 

- [Add your application to the user flow](how-to-user-flow-add-application.md)

The **Conditional Access** tab of the event details shows you which policy triggered the MFA prompt.

 

[](media/howto-mfa-reporting/sign-in-report.png#lightbox)

If available, the authentication is shown, such as text message, Microsoft Authenticator app notification, or phone call.

 

The **Authentication Details** tab provides the following information, for each authentication attempt:

Get-MgUser -All | Select-Object @{N='UserPrincipalName';E={$_.UserPrincipalName}},@{N='MFA Status';E={if ($_.StrongAuthenticationRequirements.State){$_.StrongAuthenticationRequirements.State} else {"Disabled"}}},@{N='MFA Methods';E={$_.StrongAuthenticationMethods.methodtype}} | Export-Csv -Path c:\MFA_Report.csv -NoTypeInformation

```

 

## Additional MFA reports

1. Browse to **Identity** > **Settings**.

 


### Network requirements

 

The NPS server must be able to communicate with the following URLs over TCP port 443:

Additionally, connectivity to the following URLs is required to complete the [setup of the adapter using the provided PowerShell script](#run-the-powershell-script):

 

* `https://onegetcdn.azureedge.net`

* `https://graph.microsoft.com`

* `https://provisioningapi.microsoftonline.com`

* `https://www.powershellgallery.com`

* `https://aadcdn.msftauthimages.net`

 

The following table describes the ports and protocols required for the NPS extension. TCP 443 (inbound and outbound) is the only port needed from the NPS Extension server to Entra ID. The RADIUS ports are needed between the access point and the NPS Extension server.

 

1. In a different web browser window, log in to your Sprinklr company site as an administrator.

 

 


 

 


 

 

1. Log in to your Sprinklr company site as an administrator.

 

 


 

 

1. Click **Review + create**, then **Create**.

3. Create a table under the new workspace.

1. Select the workspace name you created.

1. Select log file from the virtual machine (VM) location (`C:\logs\connector_logs.log`).

1. Set delimiter as **New Line**.

1. Add Collection Path Type – windows & Path as `C:\logs\connector_logs.log`.

1. Go to the [Azure portal](https://portal.azure.com/).

1. In the search bar, type **Microsoft Entra ID**, then select it.

2. Add a New Guest User:

1. Click on **+ New user**, then select **Invite external user**.

1. Enter the external user's email address and fill in the required information.

1. Click **Invite** to send an invitation to the external user.

 

## Verify processing of the bulk request payload

 

1. Under all applications, use the search filter text box to find and open your API-driven provisioning application.

1. Open the Provisioning blade. The landing page displays the status of the last run.

 

[](media/inbound-provisioning-api-curl-tutorial/access-provisioning-logs.png#lightbox)

 

 

Once you update your application management policy, you can confirm that it's applied by reading the default application management policy again as [shown earlier](#read-your-tenant-application-management-policy). The response should show the updated policy with the restrictions you applied.

 

 

## Related content

 

 

### Verify processing from Microsoft Entra admin center

1. Log in to [Microsoft Entra admin center](https://entra.microsoft.com) with at least [Application Administrator](https://go.microsoft.com/fwlink/?linkid=2247823) login credentials.

1. Under all applications, use the search filter text box to find and open your API-driven provisioning application.

1. Open the Provisioning blade. The landing page displays the status of the last run.

 

[](media/inbound-provisioning-api-curl-tutorial/access-provisioning-logs.png#lightbox)

1. Select any record in the provisioning logs to view additional processing details.

 

In the left browser, drill down to **config** > **authsettingsV2**.

 

 

```json

"identityProviders": {

az rest --method GET --url '/subscriptions/{SUBSCRIPTION_ID}/resourceGroups/{RESOURCE_GROUP}/providers/Microsoft.Web/sites/{WEBAPP_NAME}/config/authsettingsv2/list?api-version=2020-06-01' > authsettings.json

```

 

 

```json

"identityProviders": {

## Download the PowerShell script

 

1. Access the GitHub repository [`entra-id-inbound-provisioning`](https://github.com/AzureAD/entra-id-inbound-provisioning).

1. Navigate to the folder **PowerShell/CSV2SCIM**. It has the following directory structure:

- src

- CSV2SCIM.ps1 (main script)

$ClientCertificate = New-SelfSignedCertificate -Subject 'CN=CSV2SCIM' -KeyExportPolicy 'NonExportable' -CertStoreLocation Cert:\CurrentUser\My

$ThumbPrint = $ClientCertificate.ThumbPrint

```

1. To associate this certificate with a valid service principal, log in to your Microsoft Entra admin center as Application Administrator.

1. Open [the service principal you configured](inbound-provisioning-api-grant-access.md#configure-a-service-principal) under **App Registrations**.

1. Copy the **Object ID** from the **Overview** blade. Use the value to replace the string `<AppObjectId>`. Copy the **Application (client) Id**. We will use it later and it is referenced as `<AppClientId>`.

 

1. Select the **Workspace** at the top left corner.

 

 


 

 

1. Select the **Workspace** at the top left corner.

 

 

1. Give the Email address and select **Invite**.