📋 Microsoft Entra Documentation Changes

> [!NOTE]

> We use the maintenance task to check if the certificate is due for rotation and automatically rotate the certificate, so if the scheduler is suspended or maintenance task is disabled, auto rotation will not happen even though the certificate is managed by Entra Connect Sync.

 

description: This article tracks the changes in each released version of the Global Secure Access client for Windows.

ms.service: global-secure-access

ms.topic: reference

ms.author: jayrusso

author: HULKsmashGithub

manager: femila

 

---

# Global Secure Access client for Windows release notes

 

## Download the latest version

The current version of the Global Secure Access client is available to download from the Microsoft Entra admin center.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).

1. Browse to **Global Secure Access** > **Connect** > **Client download**.

1. Select **Download Client**.

 

## Version 2.14.80

 

Administrators can create policies that target specific network locations as a signal along with other conditions in their decision making process. They can include or exclude these network locations as part of their policy configuration. These network locations might include public IPv4 or IPv6 network information, countries/regions, unknown areas that don't map to specific countries/regions, or [Global Secure Access' compliant network](../../global-secure-access/how-to-compliant-network.md).

 

 

> [!NOTE]

 

 

- Requiring multifactor authentication for users accessing a service when they're off the corporate network.

- Blocking access from specific countries your organization never operates from.

A user's location is found using their public IP address or the GPS coordinates provided by the Microsoft Authenticator app. Conditional Access policies apply to all locations by default.

 

> [!TIP]

>

 

| AADSTS50088 | Limit on telecom MFA calls reached. Please try again in a few minutes. |

| AADSTS50089 | Authentication failed due to flow token expired. Expected - auth codes, refresh tokens, and sessions expire over time or are revoked by the user or an admin. The app will request a new login from the user. |

| AADSTS50097 | DeviceAuthenticationRequired - Device authentication is required. |

| AADSTS50099 | PKeyAuthInvalidJwtUnauthorized - The JWT signature is invalid. |

| AADSTS50105 | EntitlementGrantsNotFound - The signed in user isn't assigned to a role for the signed in app. Assign the user to the app. To learn more, see the troubleshooting article for error [AADSTS50105](/troubleshoot/azure/active-directory/error-code-aadsts50105-user-not-assigned-role). |

| AADSTS501241 | Mandatory Input '{paramName}' missing from transformation ID '{transformId}'. This error is returned while Microsoft Entra ID is trying to build a SAML response to the application. NameID claim or NameIdentifier is mandatory in SAML response and if Microsoft Entra ID failed to get source attribute for NameID claim, it returns this error. As a resolution, ensure that you add claim rules. To add claim rules, sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator), and then browse to **Entra ID** > **Enterprise apps**. Select your application, select **Single Sign-On** and then in **User Attributes & Claims** enter the Unique User Identifier (Name ID). |

| AADSTS50125 | PasswordResetRegistrationRequiredInterrupt - Sign-in was interrupted because of a password reset or password registration entry. |

| AADSTS50126 | InvalidUserNameOrPassword - Error validating credentials due to invalid username or password. The user didn't enter the right credentials. Expect to see some number of these errors in your logs due to users making mistakes. |

| AADSTS50127 | BrokerAppNotInstalled - User needs to install a broker app to gain access to this content. |

| AADSTS50128 | Invalid domain name - No tenant-identifying information found in either the request or implied by any provided credentials. |

| AADSTS50129 | DeviceIsNotWorkplaceJoined - Workplace join is required to register the device. |

| AADSTS50131 | ConditionalAccessFailed - Indicates various Conditional Access errors such as bad Windows device state, request blocked due to suspicious activity, access policy, or security policy decisions. |

| AADSTS50132 | SsoArtifactInvalidOrExpired - The session isn't valid due to password expiration or recent password change. |

| AADSTS50133 | SsoArtifactRevoked - The session isn't valid due to password expiration or recent password change. |

| AADSTS50134 | DeviceFlowAuthorizeWrongDatacenter - Wrong data center. To authorize a request that was initiated by an app in the OAuth 2.0 device flow, the authorizing party must be in the same data center where the original request resides. |

| AADSTS50135 | PasswordChangeCompromisedPassword - Password change is required due to account risk. |

| AADSTS50136 | RedirectMsaSessionToApp - Single MSA session detected. |

Once updated, you can go to the edited policy, and confirm the change by selecting **Approval stage details**:

:::image type="content" source="media/entitlement-management-dynamic-approval/access-package-approval-stage-details.png" alt-text="Screenshot of edited approval stage details.":::

 

 

With the Azure logic app created, you must edit the logic app so that it can communicate with Microsoft Entra. To edit the logic app, you'd do the following steps:

 

 

1. Sign in to the Azure portal and go to the subscription, resource group, or logic app itself with the [Azure built-in role](/azure/role-based-access-control/built-in-roles) of at least [Logic App Contributor](/azure/role-based-access-control/built-in-roles/integration#logic-app-contributor).

 

1. On the logic app created, go to **Development Tools** > **Logic app designer**.

 

1. On the designer screen, remove everything under the **manual** trigger, and select the **Add an action** button.

:::image type="content" source="media/entitlement-management-dynamic-approval/logic-app-add-action.png" alt-text="Screenshot of adding action in logic app designer.":::

 

## Related content

 

manager: femila

ms.service: entra-id

ms.topic: include

ms.author: barclayn

ms.custom: include file,licensing

---

 

[!INCLUDE [Microsoft Entra ID P2 license](~/includes/entra-p2-license.md)]

 

---

title: 'Tutorial - multifactor authentication for B2B'

description: In this tutorial, learn how to require multifactor authentication when you use Microsoft Entra B2B to collaborate with external users and partner organizations.

ms.service: entra-external-id

ms.topic: tutorial

 

ms.author: cmulligan

author: csmulligan

 

1. You can optionally add further details to the user under the **Properties** and **Assignments** tabs.

1. Select **Review + invite** to automatically send the invitation to the guest user. A **Successfully invited user** message appears.

 

## Test the sign-in experience before MFA setup

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using your test user name and password.

---

description: How to resolve issues with Microsoft Entra sign-in when the app returns an error message.

 

author: omondiatieno

ms.subservice: enterprise-apps

 

ms.topic: troubleshooting

ms.author: jomondi

ms.reviewer: ergreenl

ms.collection: M365-identity-device-management

- [Microsoft Entra authentication and authorization error codes](~/identity-platform/reference-error-codes.md)

- [Troubleshooting consent prompt errors](application-sign-in-unexpected-user-consent-error.md)

 

 

- If the app is in the Microsoft Entra gallery, verify that you followed the steps in [How to debug SAML-based single sign-on to applications in Microsoft Entra ID](./debug-saml-sso-issues.md).

- Use a tool like [Fiddler](https://www.telerik.com/fiddler) to capture the SAML request, response, and token.

 

---

title: End-user experiences for applications

 

author: omondiatieno

manager: CelesteDG

ms.subservice: enterprise-apps

 

ms.topic: concept-article

ms.author: jomondi

ms.reviewer: lenalepa

ms.custom: enterprise-apps

- Direct sign-on to federated apps

- Deep links to federated, password-based, or existing apps

 

 

<a name='azure-ad-my-apps'></a>

 

This article helps you keep track of the versions that have released and the changes in those versions.

 

### Breaking Change on Entra Connect Sync

>[!IMPORTANT]

> New Micrsoft Entra Connect Sync Versions will only be available via the Microsoft Entra admin center

>

|[2.4.21.0](#24210)|15 Nov 2025 (12 months after release of 2.4.27.0)|

|[2.4.27.0](#24270)|15 Jan 2026 (12 months after release of 2.4.129.0)|

|[2.4.129.0](#241290)|27 Mar 2026 (12 months after release of 2.4.131.0)|

 

**All other versions are not supported**

 

To read more about autoupgrade, see [Microsoft Entra Connect: Automatic upgrade](how-to-connect-install-automatic-upgrade.md).

 

 

## 2.4.131.0

 

### Release status

ms.service: entra-id

ms.subservice: enterprise-apps

ms.topic: how-to

ms.author: jomondi

ms.collection: M365-identity-device-management

ms.reviewer: ergreenl

 

In this article, you learn how to enable self-service application access using the Microsoft Entra admin center.

 

 

Using this feature, you can:

 

 

- Optionally allow a business approver to set the passwords those users can use to sign in to the application, right from the business approver’s My Apps portal

 

 

## Prerequisites

 

| Role | Can do | Can't do |

| --- | --- | --- |

| [Global Reader](~/identity/role-based-access-control/permissions-reference.md#global-reader) | Read-only access to ID Protection | |

| [User Administrator](~/identity/role-based-access-control/permissions-reference.md#user-administrator) | Reset user passwords | |

 

 

## License requirements

 

[!INCLUDE [Active Directory P2 license](~/includes/entra-p2-license.md)]

 

| --- | --- | --- | --- | --- |

| Risk policies | Sign-in and user risk policies (via ID Protection or Conditional Access) | No | No | Yes |

ms.subservice: enterprise-apps

 

ms.topic: how-to

ms.author: jomondi

ms.reviewer: ergreenl

ms.custom: enterprise-apps

#customer intent: As an admin, I want to understand how to view the activity logs of what permissions are being granted and revoked for applications in my directory so that I can review permissions granted to apps and remediate risks due to overprivileged apps.

---

 

 

 

One way to review permissions granted to your apps is by using activity logs, which record the activities and events that occur in your Microsoft Entra applications. Activity logs help you to monitor the usage and performance of your applications, and to identify any potential issues or risks. By reviewing the activity logs, you can see what permissions your applications have and whether they're complying with your policies and expectations.

 

 

| Scenario | Audit Service | Audit Category | Audit Activity | Audit Actor | Audit log limitations |

| ------------------------------------- | -------------- | --------------------- | ------------------------------------------------- | ------------ | --------------------- |

---

 

author: omondiatieno

manager: CelesteDG

ms.subservice: enterprise-apps

ms.topic: concept-article

 

ms.author: jomondi

ms.reviewer: alamaral

ms.custom: not-enterprise-apps

 

Your applications might use modern or legacy protocols for authentication. When you plan your migration to Microsoft Entra ID, consider migrating the apps that use modern authentication protocols (such as SAML and OpenID Connect) first.

 

 

Apps that use older protocols can be integrated using [Application Proxy](~/identity/app-proxy/overview-what-is-app-proxy.md) or any of our [Secure Hybrid Access (SHA) partners](secure-hybrid-access-integrations.md).

 

|5. Enable [your configuration](#enable-your-configuration)|Once ready, enable the configuration and users/groups will begin synchronizing|

 

## Scope provisioning to specific groups

1. On the **Getting started** configuration screen. Click either **Add scoping filters** next to the **Add scoping filters** icon or on the click **Scoping filters** on the left under **Manage**.

 

:::image type="content" source="media/how-to-configure-entra-to-active-directory/config-2.png" alt-text="Screenshot of the scoping filters sections." lightbox="media/how-to-configure-entra-to-active-directory/config-2.png":::