Microsoft Entra Documentation Changes

MODIFIED docs/id-governance/entitlement-management-dynamic-approval.md

Modified by Ortagus Winfrey on Apr 28, 2025 6:26 AM
📖 View on learn.microsoft.com

+29 / -32 lines changed

Commit: changed to how-to

Changes:

Before

After

---
title: Externally determine the approval requirements for an Entitlement management access package
description: A tutorial on determining the approval requirements for an entitlement access package using a custom extension.
author: owinfreyATL
ms.author: owinfrey
ms.service: entra-id-governance
ms.subservice: entitlement-management
ms.topic: tutorial #Required; leave this attribute/value as-is
ms.date: 04/12/2025
 
#CustomerIntent: As a < type of user >, I want < what? > so that < why? > .
 
-->
 
# Tutorial: Externally determine the approval requirements for an Entitlement management access package
 
<!-- 2. Introductory paragraph ----------------------------------------------------------
 
Required: Lead with a light intro that describes, in customer-friendly language, what common scenario the 
customer will accomplish in the Tutorial. Answer the fundamental “why would I want to do this?” question. Keep it short.

---
title: Externally determine the approval requirements for an Entitlement management access package
description: An how-to guide on dynamically determining the approval requirements for an access package externally using a custom extension.
author: owinfreyATL
manager: femila
ms.author: owinfrey
ms.service: entra-id-governance
ms.subservice: entitlement-management
ms.topic: how-to 
ms.date: 04/12/2025
 
#CustomerIntent: As a < type of user >, I want < what? > so that < why? > .
 
-->
 
# Create a custom extension to externally determine the approval requirements for an entitlement management access package.
 
 
 
Scenario: Use custom extensibility and an Azure Logic App to externally determine the approval requirements of an Entitlement Management access package request. 

MODIFIED docs/identity/hybrid/connect/authenticate-application-id.md

Modified by owinoakelo on Apr 28, 2025 6:41 PM
📖 View on learn.microsoft.com

+30 / -18 lines changed

Commit: Update authenticate-application-id.md

Changes:

Before

After

 
# Authenticate to Microsoft Entra ID using Application Identity 
 
Entra Connect uses the [Microsoft Entra Connector account](entra/identity/hybrid/connect/reference-connect-accounts-permissions#accounts-used-for-microsoft-entra-connect.md) to authenticate and sync identities from Active Directorty to Entra ID. This account uses username and password to authenticate requests. To enhance the security of the service, we are rolling out an application identity that uses Oauth 2.0 client credential flow with certificate credentials. In this new method, Entra or Administrator will create a single tenant 3rd party application in Entra ID and use one of the relevant certificate management options below for the credentials.
 
Microsoft Entra Connect provides 3 options for application/certificate management: 
 
 :::image type="content" source="media/authenticate-application-id/auth-1.png" alt-text="Diagram of authentication with application id." lightbox="media/authenticate-application-id/auth-1.png":::
 
Microsoft recommendeds the Entra Connect certificate management option as we manage the keys and automatically rotate the certificate on expiry. This is the default option in Entra Connect Sync versions equal to or higher than 2.4.252.0. Note that we use the maintenance task to check if the certificate is due for rotation and automatically rotate the certificate, so if the scheduler is suspended or maintenance task is disabled, auto rotation will not happen even though the certificate is managed by Entra Connect sync
 
The Microsoft Entra Managed is set up during initial installation or upgrade process on the Entra Connect Connect Wizard as shown below
 
*Installation Wizard Image*
 
This can also be set up during a second pass on the wizard as shown below
 
*Second pass Wizard image*

 
# Authenticate to Microsoft Entra ID using Application Identity 
 
Entra Connect uses the [Microsoft Entra Connector account](reference-connect-accounts-permissions#accounts-used-for-microsoft-entra-connect.md) to authenticate and sync identities from Active Directorty to Entra ID. This account uses username and password to authenticate requests. To enhance the security of the service, we are rolling out an application identity that uses Oauth 2.0 client credential flow with certificate credentials. In this new method, Entra or Administrator will create a single tenant 3rd party application in Entra ID and use one of the relevant certificate management options below for the credentials.
 
Microsoft Entra Connect provides 3 options for application/certificate management: 
 
 :::image type="content" source="media/authenticate-application-id/auth-1.png" alt-text="Diagram of authentication with application id." lightbox="media/authenticate-application-id/auth-1.png":::
 
Microsoft recommendeds the Entra Connect certificate management option as we manage the keys and automatically rotate the certificate on expiry. This is the default option in Entra Connect Sync versions equal to or higher than 2.4.252.0. 
 
> [!NOTE]
> We use the maintenance task to check if the certificate is due for rotation and automatically rotate the certificate, so if the scheduler is suspended or maintenance task is disabled, auto rotation will not happen even though the certificate is managed by Entra Connect Sync.
 
The Microsoft Entra Connect Sync managed application and credential is automatically set up during initial installation as shown below
 
*Installation Wizard Completion Image*
 
In the case of manual upgrade, the administrator must  explicitly opt in to application identity as shown below

MODIFIED docs/fundamentals/configure-security.md

Modified by rolyon on Apr 28, 2025 7:55 AM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Move to app management

Changes:

Before

After

 
[!INCLUDE [23183](../includes/secure-recommendations/23183.md)]
 
## External collaboration
 
### Guests can't invite other guests
 
[!INCLUDE [21851](../includes/secure-recommendations/21851.md)]
 
### Admin consent workflow is enabled
 
[!INCLUDE [21809](../includes/secure-recommendations/21809.md)]
 
## Monitoring
 
### Diagnostic settings are configured for all Microsoft Entra logs

 
[!INCLUDE [23183](../includes/secure-recommendations/23183.md)]
 
### Admin consent workflow is enabled
 
[!INCLUDE [21809](../includes/secure-recommendations/21809.md)]
 
## External collaboration
 
### Guests can't invite other guests
 
[!INCLUDE [21851](../includes/secure-recommendations/21851.md)]
 
## Monitoring
 
### Diagnostic settings are configured for all Microsoft Entra logs

MODIFIED docs/identity-platform/v2-protocols.md

Modified by Henry Mbugua on Apr 28, 2025 9:38 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: SEO testing

Changes:

Before

After

---
title: OAuth 2.0 and OpenID Connect protocols 
description: Learn about OIDC authentication and OAuth 2.0 in the Microsoft identity platform. Understand authentication flows and OIDC endpoints for secure user authentication. 
author: henrymbuguakiarie
manager: CelesteDG
ms.author: henrymbugua
ms.custom: has-adal-ref
ms.date: 01/27/2025
ms.reviewer: nickludwig
ms.service: identity-platform
 
 
Four parties are generally involved in an OAuth 2.0 and OpenID Connect authentication and authorization exchange. These exchanges are often called *authentication flows* or *auth flows*.
 
![Diagram showing the OAuth 2.0 roles](./media/v2-flows/protocols-roles.svg)
 
* **Authorization server** - The Microsoft identity platform is the authorization server. Also called an *identity provider* or *IdP*, it securely handles the end-user's information, their access, and the trust relationships between the parties in the auth flow. The authorization server issues the security tokens your apps and APIs use for granting, denying, or revoking access to resources (authorization) after the user has signed in (authenticated).
 

---
title: OAuth 2.0 and OpenID Connect protocols 
description: Learn about OAuth 2.0 and OpenID Connect in Microsoft identity platform. Explore authentication flows, endpoints, and secure user authentication.
author: henrymbuguakiarie
manager: CelesteDG
ms.author: henrymbugua
ms.custom: has-adal-ref
ms.date: 04/28/2025
ms.reviewer: nickludwig
ms.service: identity-platform
 
 
Four parties are generally involved in an OAuth 2.0 and OpenID Connect authentication and authorization exchange. These exchanges are often called *authentication flows* or *auth flows*.
 
![Screenshot of a diagram showing the roles in OAuth 2.0, including authorization server, client, resource owner, and resource server](./media/v2-flows/protocols-roles.svg)
 
* **Authorization server** - The Microsoft identity platform is the authorization server. Also called an *identity provider* or *IdP*, it securely handles the end-user's information, their access, and the trust relationships between the parties in the auth flow. The authorization server issues the security tokens your apps and APIs use for granting, denying, or revoking access to resources (authorization) after the user has signed in (authenticated).
 

MODIFIED docs/identity/hybrid/connect/admin-audit-logging.md

Modified by owinoakelo on Apr 28, 2025 7:29 PM
📖 View on learn.microsoft.com

+5 / -0 lines changed

Commit: Update admin-audit-logging.md

Changes:

Before

After

|2519|Reinitialize Entra ID Connector account password| Shows that the AD Sync service account password was reset|
|2520|Install ADFS Server| Shows the selected server|
|2521|Set ADFS Service Account| Specifies if group-managed or domain user. Includes administrator username|
 
 ## Next steps

|2519|Reinitialize Entra ID Connector account password| Shows that the AD Sync service account password was reset|
|2520|Install ADFS Server| Shows the selected server|
|2521|Set ADFS Service Account| Specifies if group-managed or domain user. Includes administrator username|
|2522|ConfigureEntraApplicationAuthentication|Specifies that configuring application authentication to Microsoft Entra ID was attempted. It provides the status of the operation along with relevant details like application (Client) Id.|
|2523|RotateEntraApplicationCertificate|Speifies that rotation of the application certificate that is used for authentication to Microsoft Entra ID was attempted along with the status of the operation.|
|2524|DeleteEntraConnectorAccount|Specifies that deletion of the Microsoft Entra ID synchronization account was attempted. It provides the status of the operation along with the name of the account.|
|2525|DeleteEntraApplication|Specifies that deletion of the Entra Connect Sync application used for synchronizing with Microsoft Entra ID was attempted. It provides the application(Client) Id along with the status of the operation.|
|2526|DeleteApplicationCertificate|Specifies that deletion of the Entra Connect Sync application certificate was attempted. It provides the application (Client) Id and the Certificate Id along with the status of the operation.|
 
 
 ## Next steps

MODIFIED docs/global-secure-access/concept-private-name-resolution.md

Modified by Teresa Yao on Apr 28, 2025 3:49 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update concept-private-name-resolution.md

Changes:

Before

After

 
1. User requests a DNS query for `app.contoso.com`. If not cached locally, the DNS query is sent to the DNS proxy at the GSA edge. 
1. DNS proxy either responds from its cache or forwards the query to the Connector Group defined in Quick Access.  
1. Connector local resolvers resolve the DNS query and return it back to the DNS proxy. 
1. DNS proxy responds back to the client with the internal IP. The client stores the internal IP address and returns a synthetic IP to the application.
 
## Single-label domain (SLD) resolution
 
The Private DNS provides name resolution for SLD without a domain suffix. An NRPT entry is created to send GSA suffix `globalsecureaccess.local.` to DNS proxy when Private DNS is configured. The client machine will attempt to resolve the SLD by appending the locally configured search suffixes. If none of the search suffixes are resolved, the GSA client appends the `<appid>.globalsecureaccess.local.` suffix to the SLD and sends the DNS request to the DNS proxy. DNS proxy strips away the search suffix before sending the DNS query to the connector. The connector then uses its local search suffixes to resolve the SLD query. Resolved IP address for the resource is returned to the DNS proxy and passed along to the client.
 
> [!NOTE]  
> For some applications such as Kerberos authentication, it is important to have the correct SPN. GSA synthetic suffix may break Kerberos flow, so it's recommended to use FQDN for applications that require Kerberos authentication.

 
1. User requests a DNS query for `app.contoso.com`. If not cached locally, the DNS query is sent to the DNS proxy at the GSA edge. 
1. DNS proxy either responds from its cache or forwards the query to the Connector Group defined in Quick Access.  
1.The connector server sends the DNS query to the DNS servers configured at operating system level. 
1. DNS proxy responds back to the client with the internal IP. The client stores the internal IP address and returns a synthetic IP to the application.
 
## Single-label domain (SLD) resolution
 
The Private DNS provides name resolution for SLD without a domain suffix. An NRPT entry is created to send GSA suffix `globalsecureaccess.local.` to DNS proxy when Private DNS is configured.  The client machine appends the `<appid>.globalsecureaccess.local.` suffix to the SLD and sends the DNS request to the DNS proxy. DNS proxy strips away the search suffix before sending the DNS query to the connector. The connector then uses its local search suffixes to resolve the SLD query. Resolved IP address for the resource is returned to the DNS proxy and passed along to the client.
 
> [!NOTE]  
> For some applications such as Kerberos authentication, it is important to have the correct SPN. GSA synthetic suffix may break Kerberos flow, so it's recommended to use FQDN for applications that require Kerberos authentication.

MODIFIED docs/includes/secure-recommendations/21809.md

Modified by rolyon on Apr 28, 2025 8:13 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update remediation description

Changes:

Before

After

 
**Remediation action**
 
For admin consent requests, set the **Users can request admin consent to apps they are unable to consent to** setting to **Yes**.
 
- [Enable the admin consent workflow](/entra/identity/enterprise-apps/configure-admin-consent-workflow#enable-the-admin-consent-workflow)
- Use the [Update adminConsentRequestPolicy](/graph/api/adminconsentrequestpolicy-update) API to set the `isEnabled` property

 
**Remediation action**
 
For admin consent requests, set the **Users can request admin consent to apps they are unable to consent to** setting to **Yes**. Specify other settings, such as who can review requests.
 
- [Enable the admin consent workflow](/entra/identity/enterprise-apps/configure-admin-consent-workflow#enable-the-admin-consent-workflow)
- Or use the [Update adminConsentRequestPolicy](/graph/api/adminconsentrequestpolicy-update) API to set the `isEnabled` property to true and other settings

MODIFIED docs/fundamentals/whats-new.md

Modified by Ortagus Winfrey on Apr 28, 2025 12:04 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update whats-new.md

Changes:

Before

After

 
## April 2025
 
### Public Preview - [Opt-out] Microsoft Entra ID Governance: access package request suggestions
 
**Type:** New feature    
**Service category:** Entitlement Management    
**Product capability:** Entitlement Management    
 
As communicated [earlier](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra---september-2024/4253153), we're excited to introduce a new feature in My Access: a curated list of *suggested* access packages. This capability will allow users to quickly view the most relevant access packages (based off their peers' access packages and previous requests) without scrolling through a long list. In December you can [enable the preview in the Opt-in Preview Features for Identity Governance](https://entra.microsoft.com/?feature.msaljs=true#view/Microsoft_AAD_ERM/DashboardBlade/~/elmSetting). From January, this setting will be enabled by default.
 
---

 
## April 2025
 
### Public Preview - Microsoft Entra ID Governance: suggested access packages in My Access
 
**Type:** New feature    
**Service category:** Entitlement Management    
**Product capability:** Entitlement Management    
 
In December 2024, we introduced a new feature in My Access: a curated list of suggested access packages. Users view the most relevant access packages, based on their peers' access packages and previous assignments, without scrolling through a long list. By May 2025, suggestions will be enabled by default and we'll introduce a new card in the Entra Admin Center Entitlement Management control configurations for admins to see My Access settings. We recommend admins turn on the peer-based insights for suggested access packages via this setting. For more information, see: [Suggested access packages in My Access (Preview)](../id-governance/entitlement-management-suggested-access-packages.md).
 
---

MODIFIED docs/identity/authentication/howto-mfa-reporting.md

Modified by TBalaji-MSFT on Apr 28, 2025 3:49 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: (AzureCXP) fixes MicrosoftDocs/Entra-docs#424655

Changes:

Before

After

 
The **Authentication Details** tab provides the following information, for each authentication attempt:
 
- A list of authentication policies applied (such as Conditional Access, per-user MFA, Security Defaults)
- The sequence of authentication methods used to sign-in
- Whether or not the authentication attempt was successful
- Detail about why the authentication attempt succeeded or failed

 
The **Authentication Details** tab provides the following information, for each authentication attempt:
 
- A list of authentication policies applied (such as Conditional Access, per-user MFA, Security Defaults) is visible inside the detailed view of each sign-in, under the Conditional Access section
- The sequence of authentication methods used to sign-in
- Whether or not the authentication attempt was successful
- Detail about why the authentication attempt succeeded or failed

MODIFIED docs/external-id/tenant-restrictions-v2.md

Modified by vimrang on Apr 28, 2025 3:48 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update tenant-restrictions-v2.md

Changes:

Before

After

- Allow the use of unenlightened apps, but block them from accessing Microsoft resources using a special WDAC policy, called an “AppIdTagging policy”.   
 
For both options, you must first create an WDAC policy. Then, optionally, convert it to an AppIdTagging policy. Finally, apply it to your devices after testing it on a test machine. 
More info on [Creating your App Control AppId Tagging Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appidtagging/design-create-appid-tagging-policies)
 
> [!NOTE]
> These steps require an up to date Windows device in order to get access to the latest PowerShell commandlets needed to create the policy.  

- Allow the use of unenlightened apps, but block them from accessing Microsoft resources using a special WDAC policy, called an “AppIdTagging policy”.   
 
For both options, you must first create an WDAC policy. Then, optionally, convert it to an AppIdTagging policy. Finally, apply it to your devices after testing it on a test machine. 
More info on [Creating your App Control AppId Tagging Policies](/windows/security/application-security/application-control/app-control-for-business/appidtagging/design-create-appid-tagging-policies)
 
> [!NOTE]
> These steps require an up to date Windows device in order to get access to the latest PowerShell commandlets needed to create the policy.  

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files

🗑️ Deleted Documentation Files