📋 Microsoft Entra Documentation Changes

description: A how-to guide on dynamically determining the approval requirements for an access package externally using a custom extension.

In entitlement management, approvers for requests for access packages can either be directly assigned, or determined dynamically based on attributes. While entitlement management natively supports dynamic approval options such as the requestor's manager, second-level manager, sponsor from a connected organization, or the requestor, these options don't cover all scenarios. With [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview), you're able to determine approvals for access packages through an external system. This allows a look up to find up to date information across different attributes when a request for an access package is made.

> - Create a Conditional Access policy that requires MFA for access to a cloud app in your environment. In this tutorial, we’ll use the Azure Resource Manager app to illustrate the process.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](/entra/identity/role-based-access-control/permissions-reference#user-administrator).

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator).

Microsoft Entra Connect provides three options for application/certificate management:

Microsoft Entra Connect manages the application and certificate including creation, rotation, and deletion of the certificate. The certificate is stored in the Current User store. For optimal protection of the certificate’s private key, it's recommended that the machine employs a Trusted Platform Module (TPM) solution to establish a hardware-based security boundary. When a TPM is available, key service operations are performed within a dedicated hardware environment. In contrast, if a TPM can't be used, Entra Connect defaults to storing the certificate in the default Microsoft Software Key Storage Provider and marks the private key as nonexportable for additional protection. However, without the hardware isolation provided by a TPM, the private key is secured solely by software safeguards and doesn't achieve the same level of protection. For more information on TPM, see [Trusted Platform Module Technology Overview](/windows/security/hardware-security/tpm/trusted-platform-module-overview).

Microsoft recommends the Entra Connect certificate management option as we manage the keys and automatically rotate the certificate on expiry. This behavior is the default option in Entra Connect Sync versions equal to or higher than 2.4.252.0.

title: Add a platform to your app registration

description: Learn how to add a platform to your app in Microsoft Entra to securely handle authentication tokens and enhance your application's security.

ms.date: 04/28/2025

# Add a platform to your app registration

Microsoft identity platform supports authentication for various modern application types such as web applications, Single-page applications (SPA) and mobile and desktop apps. Once you register your app on the Microsoft Entra admin center, you need to specify the app type by configuring the app platform along with additional authentication settings specific to each platform.

ms.date: 04/29/2025

> * Token protection now supports the Windows App, extending protection to Windows 365 and Azure Virtual Desktop.

- Windows App version 2.0.379.0 or newer

> Make a copy of the current policy settings before you update them. This will allow you to revert back to the original settings if needed. You can do this by copying the current policy settings to a file or by taking a screenshot of the settings. You won't be able to find the original settings after you update them if you have not saved them.

* The `restrictionType` parameter allows you to set the type of restriction you want to apply. In this case, you're restricting `passwordAddition`, `customPasswordAddition`, and `symmetricKeyAddition`. These settings will limit the creation of client secrets, custom passwords and symmetric keys.

* The `state` parameter allows you to enable or disable the restriction. If set to `enabled`, the restriction will be applied. If set to `disabled`, the restriction won't be applied.

* The `maxLifetime` parameter allows you to set the maximum lifetime of the secret. For `passwordCredentials` you have set the value to `null`. Setting the value to `null` means that the maximum lifetime isn't restricted. This is because you're disabling the creation of client secrets and symmetric keys entirely. If you want to set a maximum lifetime for client secrets, you can set this value to a duration in ISO 8601 format. You'll find an example of this in the next section. For more information on duration formatting, see [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601#Durations).

* The `restrictForAppsCreatedAfterDateTime` parameter allows you to set a date from which the policy will take effect for new applications. Any applications created before this date will be unaffected by the policy. In this case, you're applying restrictions for applications created after February 20th 2025. Please ensure you update this date to suit your needs. If you want to set different restrictions for applications created before or after a certain date you can set multiple policies with different `restrictForAppsCreatedAfterDateTime` values.

* `keyCredentials`: Allows you to set parameters for certificates. In this case, you're restricting the lifetime of application certificates to 180 days.

ms.date: 04/29/2025

[!INCLUDE [Active Directory P2 license](../includes/entra-p2-license.md)] The following table describes the key capabilities of Microsoft Entra ID Protection and the licensing requirements for each capability. Refer to the Microsoft Entra plans and pricing page for pricing details.

To view the **Risky workload identities** report and the **Workload identity detections** tab in the **Risk detections** report, you need Workload Identities Premium licensing. For more information, see [Securing workload identities](concept-workload-identity-risk.md).

 

### Microsoft Defender

> New Micrsoft Entra Connect Sync Versions will only be available via the Microsoft Entra Admin center

> Following up on our earlier [What’s New](../../../fundamentals/whats-new.md#general-availability---download-microsoft-entra-connect-sync-on-the-microsoft-entra-admin-center) communication, new versions of Microsoft Entra Connect Sync are only available on the [Microsoft Entra Connect blade](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/%7E/GetStarted) within Microsoft Entra Admin center and will no longer be released to the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=47594).

>Auto upgrade will run from the release date until 15 April 2025. If your environment isn't upgraded by then, it means the auto upgrade attempt failed and you need to perform a [manual upgrade](how-to-upgrade-previous-version.md). You can check the [Application event logs](how-to-connect-install-automatic-upgrade.md#troubleshooting) for reasons for the failure of the auto upgrade.

- the same user is represented across different forests, and

 

description: Configure user consent settings in Microsoft Entra ID to control when and how users grant permissions to your organization's data. Secure your environment with step‑by‑step guidance.

ms.date: 04/30/2025

In this article, you learn how to configure user consent settings in Microsoft Entra ID to control when and how users grant permissions to applications. This guidance helps IT admins reduce security risks by restricting or disabling user consent.

> - Multi-Geo doesn't support the Domain Name System (DNS) experience.

> - Mulit-Geo doesn't support Japan region selection through Entra admin center.

## Enable multi-Geo capability for Japan region

To select Japan as **country/region** for the connector group, use Microsoft Graph APIs. Connector group UI expereince through Entra Portal does not support Japan region yet. Instructions are listed below:

- Open Microsoft [Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer) and login with the tenant account.

- Create [Connector Group](https://learn.microsoft.com/graph/api/connectorgroup-post?view=graph-rest-beta&tabs=http) using Graph API. Use 'region' property to assign the region to 'japan'. E.g., Run the POST request below with region set to "japan" to create a connector group assigned to Japan.

 

### Example HTTP Request

```http

POST https://graph.microsoft.com/beta/onPremisesPublishingProfiles/applicationProxy/connectorGroups

Content-type: application/json

 

{

"name": "<Connector Group Name>"

"region: "japan"

}

ms.date: 04/28/2025

1. Browse to **Applications** > **App registrations** and select the app registration for which you want to enable public client and native authentication flows.

1. Under **Manage**, select **Authentication**.

1. Under **Advanced settings**, allow public client flows:

1. For **Enable the following mobile and desktop flows** select **Yes**.

1. For **Enable native authentication**, select **Yes**.

1. Select **Save** button.

description: 'Plan your single sign‑on deployment in Microsoft Entra ID. Streamline role assignments, certificate management, and licensing to ensure uninterrupted access.'

ms.date: 04/30/2025

This article provides information that you can use to plan your single sign-on (SSO) deployment in Microsoft Entra ID. When you plan your SSO deployment with your applications in Microsoft Entra ID, you need to consider the following questions:

ms.date: 04/29/2025

ms.reviewer: jercon

:::image type="content" source="media/secure-external-access/6-governance-lifecycle.png" alt-text="A diagram of the external user governance cycle.":::

:::image type="content" source="media/secure-external-access/6-access-package-expiration.png" alt-text="Screenshot of options and entries for Expiration.":::

ms.date: 04/29/2025

ai-usage: ai-assisted

- Bug fix: Canonical name (CNAME) records resolve as A records to fix a Kerberos browser authentication issue.

- Bug fix: adds support for operating system names with non-ASCII characters, relevant for some non-English Windows versions.

ms.date: 04/30/2025

> These values aren't real. Update these values with the actual Identifier, Reply URL and Sign on URL. These values are also pregenerated for you on the "Setup SAML SSO" page within your Organization settings in HashiCorp Cloud Platform (HCP). For more information, SAML documentation is provided on [HashiCorp's Developer site](https://developer.hashicorp.com/hcp/docs/hcp/iam/sso/setup/saml). Contact [HashiCorp Cloud Platform (HCP) Client support team](mailto:[email protected]) for any questions about this process. You can also refer to the patterns shown in the **Basic SAML Configuration** section.

To configure single sign-on on the **HashiCorp Cloud Platform (HCP)** side, you need to add a verification record TXT to your domain host, add the downloaded **Certificate (Base64)** and **Login URL** copied from Azure portal to your HashiCorp Cloud Platform (HCP) Organization "Setup SAML SSO" page. Please refer to the SAML documentation that's provided on [HashiCorp's Developer site](https://developer.hashicorp.com/hcp/docs/hcp/iam/sso/setup/saml). Contact [HashiCorp Cloud Platform (HCP) Client support team](mailto:[email protected]) for any questions about this process.