📋 Microsoft Entra Documentation Changes

In entitlement management, approvers for access package requests can either be directly assigned, or determined dynamically. While entitlement management natively supports dynamic approval options such as the requestor's manager, second-level manager, sponsor from a connected organization, or the requestor, these options don't cover all scenarios. With [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview), you're able to determine approval requirements for access packages through an external system. With this external call, you're able to determine approval requirements based on each of the [ApprovalStage properties](/graph/api/resources/approvalstage?view=graph-rest-beta#properties). This article walks you through making a custom extension, its underlying Azure Logic App, setting its system assigned identity and role in the catalog, editing the logic app action and body so that it performs business logic, and testing to see if it runs successfully.

- At least the [Azure built-in role](/azure/role-based-access-control/built-in-roles) of [Logic App Contributor](/azure/role-based-access-control/built-in-roles/integration#logic-app-contributor) on the Logic App itself or on the resource group, subscription, or management group that the logic app is in.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Catalog owner](../id-governance/entitlement-management-delegate.md#entitlement-management-roles) of the catalog where the custom extension will be located.

ms.date: 12/16/2024

- [FaceCheck](using-facecheck.md) introducing the Face Check Addon as an incremental update to the Face Check public preview. Face Check is a premium feature within Microsoft Entra Verified ID free to use during the public preview period ending on Aug 12.

The first API was for creating an issuance or presentation request. The second API was for retrieving a request and the last two APIs was for a wallet completing issuance or presentation. The API endpoints to use since preview are:

In this set up, the customer administrator manages the application that is used by Entra Connect Sync to authenticate to Entra, the application permissions and certificate credential used by the application. The administrator [registers a Microsoft Entra app and creates a service principal.](../../../identity-platform/howto-create-service-principal-portal.md)

 

The application and service principal need to be created in Entra using MSGraph with the certificate credential and the AdminWebService and SSPR (if necessary) permissions

- Customer registers an application with Entra and creates service principal.

[Register a Microsoft Entra app and create a service principal.](../../../identity-platform/howto-create-service-principal-portal.md) . Note the application Id as it will be necessary in the next section.

In My Access, Microsoft Entra ID Governance users can see a curated list of suggested access packages in My Access. This capability allows users to quickly view the most relevant access packages for them based off their peers' access packages and previous requests without scrolling through all their available access packages.

The suggested access packages list is created by finding people related to the user (manager, direct reports, organization, team members) and recommending access packages based on what the users’ peers have. The user is also suggested access packages that they previously owned.

## Enable users to see their suggested access packages in My Access

1. Browse to **ID Governance** > **Entitlement management** > **Settings**.

1. Select **Edit**.

 

1. On the edit page under Opt-in Preview Features, select **Show suggested access packages in My Access**.

:::image type="content" source="media/entitlement-management-suggested-access-packages/opt-in-features-selection.png" alt-text="Screenshot of opt-in to suggested access package feature." lightbox="media/entitlement-management-suggested-access-packages/opt-in-features-selection.png":::

 

## January 2025

 

### New articles

 

- [Use Azure Front Door as a reverse proxy in production environment for a single-page app that uses native authentication (preview)](how-to-native-authentication-cors-solution-production-environment.md)

- [Set up a reverse proxy for a single-page app that calls native authentication API by using Azure Function App (preview)](how-to-native-authentication-cors-solution-test-environment.md)

- [Quickstart: Sign in users in a sample React single-page application by using native authentication (preview)](quickstart-native-authentication-single-page-app-react-sign-in.md)

- [Tutorial: Reset password in a React single-page app by using native authentication (preview)](tutorial-native-authentication-single-page-app-react-reset-password.md)

- [Tutorial: Set up CORS proxy server to manage CORS headers for native authentication (preview)](tutorial-native-authentication-single-page-app-react-set-up-local-cors.md)

- [Tutorial: Sign in users into a React single-page app by using native authentication (preview)](tutorial-native-authentication-single-page-app-react-sign-in.md)

ms.date: 12/13/2024

Verified ID supported the DID:ION method in preview until December 2023, after which it was discontinued.

### How do I move to did:web from did:ion?

#### Export existing did:ion credential definitions

## Assigning users to Salesforce

Before configuring and enabling the provisioning service, you need to decide which users or groups in Microsoft Entra ID need access to your Salesforce app. You can assign these users to your Salesforce app by following the instructions in [Assign a user or group to an enterprise app](~/identity/enterprise-apps/assign-user-or-group-access-portal.md)

* It's recommended that a single Microsoft Entra user is assigned to Salesforce to test the provisioning configuration. More users and/or groups may be assigned later.

* When assigning a user to Salesforce, you must select a valid user role. The "Default Access" role doesn't work for provisioning

ms.date: 04/01/2025

- [Configure external collaboration settings for B2B in Microsoft Entra External ID](external-collaboration-settings-configure.md) - Global Administrator role update

 

## December 2024

 

ms.date: 02/13/2025

In this tutorial, we cover common questions and information related to certificates that Microsoft Entra ID creates to establish federated single sign-on (SSO) to your software as a service (SaaS) applications. Add applications from the Microsoft Entra application gallery or by using a non-gallery application template. Configure the application by using the federated SSO option.

This tutorial is relevant only to apps that are configured to use Microsoft Entra SSO through Security Assertion Markup Language (SAML).

When you add a new application from the gallery and configure a SAML-based sign-on (by selecting **Single sign-on** > **SAML** from the application overview page), Microsoft Entra ID generates a self-signed certificate for the application that is valid for three years. To download the active certificate as a security certificate (**.cer**) file, return to that page (**SAML-based sign-on**) and select a download link in the **SAML Certificates** heading. You can choose between the raw (binary) certificate or the Base 64 (base 64-encoded text) certificate. For gallery applications, this section might also show a link to download the certificate as federation metadata XML (an **.xml** file), depending on the requirement of the application.

> New Micrsoft Entra Connect Sync Versions will only be available via the Microsoft Entra Admin center

> Following up on our earlier [What’s New](../../../fundamentals/whats-new.md#general-availability---download-microsoft-entra-connect-sync-on-the-microsoft-entra-admin-center) communication, new versions of Microsoft Entra Connect Sync are only available on the [Microsoft Entra Connect blade](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/%7E/GetStarted) within Microsoft Entra Admin center and will no longer be released to the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=47594).

> The MSOnline PowerShell [retirement](https://aka.ms/msonlineretirement) will start impacting the Microsoft Entra Connect Sync wizard in April 2025. You must upgrade your Connect Sync version **by 30 April 2025** to maintain Connect Sync wizard capabilities such as schema refresh, configuration of staging mode, and user-sign in changes. The minimum supported versions are [2.4.18.0](reference-connect-version-history.md#24180) for commercial cloud and [2.4.21.0](reference-connect-version-history.md#24210) for non-commercial clouds, or any newer version. No action is required if your Microsoft Entra Connect Sync server is within the recommended version range. [Learn More](harden-update-ad-fs-pingfederate.md)

04/30/2025: Released for download via the Microsoft Entra Admin center.

| Log / Report | Roles | Licenses |

|--|--|--|

| Audit logs | [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator) | All editions of Microsoft Entra ID |

| Sign-in logs | [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator) | All editions of Microsoft Entra ID |

| Sign-up logs (preview) | [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator)<br>[Global Reader](../identity/role-based-access-control/permissions-reference.md#global-reader)<br> | Microsoft Entra External ID |

| Provisioning logs | [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Application Administrator](../identity/role-based-access-control/permissions-reference.md#application-administrator)<br>[Cloud App Administrator](../identity/role-based-access-control/permissions-reference.md#cloud-application-administrator) | Microsoft Entra ID P1 or P2 |

| Custom security attribute audit logs* | [Attribute Log Administrator](../identity/role-based-access-control/permissions-reference.md#attribute-log-administrator)<br>[Attribute Log Reader](../identity/role-based-access-control/permissions-reference.md#attribute-log-reader) | All editions of Microsoft Entra ID |

| Health | [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Helpdesk Administrator](../identity/role-based-access-control/permissions-reference.md#helpdesk-administrator) | Microsoft Entra ID P1 or P2 |

| Microsoft Entra ID Protection** | [Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator)<br>[Security Operator](../identity/role-based-access-control/permissions-reference.md#security-operator)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Global Reader](../identity/role-based-access-control/permissions-reference.md#global-reader)<br> | Microsoft Entra ID Free<br>Microsoft 365 Apps<br>Microsoft Entra ID P1 or P2 |

| Microsoft Graph activity logs | [Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator)<br>Permissions to access data in the corresponding log destination | Microsoft Entra ID P1 or P2 |

| Usage and insights | [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader)<br>[Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader)<br>[Security Administrator](../identity/role-based-access-control/permissions-reference.md#security-administrator) | Microsoft Entra ID P1 or P2 |

 

*Viewing the custom security attributes in the audit logs or creating diagnostic settings for custom security attributes requires one of the Attribute Log roles. You also need the appropriate role to view the standard audit logs.

 

**The level of access and capabilities for Microsoft Entra ID Protection varies with the role and license. For more information, see the [license requirements for ID Protection](~/id-protection/overview-identity-protection.md#license-requirements).

It's widely recognized by the IT industry that IT administrators use Secure Shell (SSH) as a critical service to enable security while managing configuration, deployment, and maintenance of servers and applications in an organization's infrastructure. SSH is a secure way to access and manage devices over an unsecured network. SSH encryption protocols, ensure the integrity and confidentiality of administrative tasks and remote system interactions, which are pivotal to maintain operational efficiency and reduce potential security risks.

In this guide learn to configure and establish an SSH connection using Microsoft Entra Private Access for enhanced security. Organizations use Private Access to modernize user access to private apps and resources.

* **GSA private connector** with network connectivity to the resource

In this section find links to guidance to install and configure the Microsoft Global Secure Access [client](concept-clients.md) on user devices.

- The agent is configured to run every 24 hours based on when it's initially configured. Toggling the trigger to off under the settings page of the agent and back on at a specific time reconfigures the agent to run at that time.

1. Selecting a suggestion provides you with more detail to back up the suggestion, along with the ability to review the changes in the policy viewer or in JSON format.

| AADSTS50107 |The requested federation realm object '{name}' does not exist. Application error - the login request was malformed and could not be matched with an existing authentication endpoint or instance. |

| AADSTS50141 | Protected key is not intended for the authenticated user. |

| AADSTS50148 | The code_verifier does not match the code_challenge supplied in the authorization request for PKCE. Contact the application owner to correct their use of the PKCE parameters. |

ms.date: 04/16/2025

> For information troubleshooting health check failures, see [Troubleshoot the Global Secure Access client diagnostics - Health check](troubleshoot-global-secure-access-client-diagnostics-health-check).

> For information troubleshooting health check failures, see [Troubleshoot the Global Secure Access client diagnostics - Health check](troubleshoot-global-secure-access-client-diagnostics-health-check).