Microsoft Entra Documentation Changes

MODIFIED docs/identity/app-proxy/conceptual-deployment-plan.md

Modified by Ken Withee on May 3, 2025 2:25 AM
📖 View on learn.microsoft.com

+78 / -79 lines changed

Commit: Updates for clarity, tone, spelling, consistency, and grammar.

Changes:

Before

After

---
title: Plan a Microsoft Entra application proxy Deployment
description: An end-to-end guide for planning the deployment of application proxy within your organization
 
author: kenwith
 
# Plan a Microsoft Entra application proxy deployment
 
Microsoft Entra application proxy is a secure and cost-effective remote access solution for on-premises applications. It provides an immediate transition path for “Cloud First” organizations to manage access to legacy on-premises applications that aren’t yet capable of using modern protocols. For additional introductory information, see [What is application proxy](overview-what-is-app-proxy.md).
 
Application proxy is recommended for giving remote users access to internal resources. Application proxy replaces the need for a VPN or reverse proxy for these remote access use cases. It is not intended for users who are on the corporate network. These users who use application proxy for intranet access may experience undesirable performance issues.
 
This article includes the resources you need to plan, operate, and manage Microsoft Entra application proxy.
 
## Plan your implementation
 
The following section provides a broad view of the key planning elements that will set you up for an efficient deployment experience.
 
### Prerequisites

---
title: Plan a Microsoft Entra application proxy deployment
description: An end-to-end guide for planning the deployment of application proxy within your organization
 
author: kenwith
 
# Plan a Microsoft Entra application proxy deployment
 
Microsoft Entra application proxy is a secure and cost-effective remote access solution for on-premises applications. It provides an immediate transition path for "Cloud First" organizations to manage access to legacy on-premises applications that aren’t yet capable of using modern protocols. For more introductory information, see [What is application proxy](overview-what-is-app-proxy.md).
 
Application proxy is recommended for giving remote users access to internal resources. Application proxy replaces the need for a VPN or reverse proxy for these remote access use cases. It isn't intended for users who are on the corporate network. These users who use application proxy for intranet access might experience undesirable performance issues.
 
This article includes the resources you need to plan, operate, and manage Microsoft Entra application proxy.
 
## Plan your implementation
 
The following section provides a broad view of the key planning elements that set you up for an efficient deployment experience.
 
### Prerequisites

MODIFIED docs/identity/app-proxy/overview-what-is-app-proxy.md

Modified by Ken Withee on May 3, 2025 3:14 AM
📖 View on learn.microsoft.com

+39 / -40 lines changed

Commit: Updates for clarity, consistency, tone, and spelling.

Changes:

Before

After

- **Cost-effective**. On-premises solutions typically require you to setup and maintain demilitarized zones (DMZs), edge servers, or other complex infrastructures. Application proxy runs in the cloud, which makes it easy to use. To use application proxy, you don't need to change the network infrastructure or install more appliances in your on-premises environment.
 
> [!TIP]
> If you already have Microsoft Entra ID, you can leverage it as one control plane to allow seamless and secure access to your on-premises applications.
 
While not comprehensive, the list below illustrates examples of using application proxy in a hybrid coexistence scenario:
 
* Publish on-premises web apps externally in a simplified way without a DMZ
* Support single sign-on (SSO) across devices, resources, and apps in the cloud and on-premises
* Support multifactor authentication for apps in the cloud and on-premises
* Quickly leverage cloud features with the security of the Microsoft Cloud
* Centralize user account management
* Centralize control of identity and security
* Automatically add or remove user access to applications based on group membership
 
Previously, your control plane for protecting internal resources from attackers while facilitating access by remote users was all in the DMZ or perimeter network. But the VPN and reverse proxy solutions deployed in the DMZ used by external clients to access corporate resources aren't suited to the cloud world. They typically suffer from the following drawbacks:
 
* Hardware costs
* Maintaining security (patching, monitoring ports, and so on)
* Authenticating users at the edge

- **Cost-effective**. On-premises solutions typically require you to setup and maintain demilitarized zones (DMZs), edge servers, or other complex infrastructures. Application proxy runs in the cloud, which makes it easy to use. To use application proxy, you don't need to change the network infrastructure or install more appliances in your on-premises environment.
 
> [!TIP]
> If you already have Microsoft Entra ID, you can use it as one control plane to allow seamless and secure access to your on-premises applications.
 
While not comprehensive, the list illustrates examples of using application proxy in a hybrid coexistence scenario:
 
* Publish on-premises web apps externally in a simplified way without a DMZ
* Support single sign-on (SSO) across devices, resources, and apps in the cloud and on-premises
* Support multifactor authentication for apps in the cloud and on-premises
* Quickly use cloud features with the security of the Microsoft Cloud
* Centralize user account management
* Centralize control of identity and security
* Automatically add or remove user access to applications based on group membership
 
Previously, your control plane for protecting internal resources from attackers while facilitating access by remote users was all in the DMZ or perimeter network. But the VPN and reverse proxy solutions deployed in the DMZ used by external clients to access corporate resources aren't suited to the cloud world. They typically suffer from the following drawbacks:
 
* Increase hardware costs
* Maintain security (patching, monitoring ports, and so on)
* Authenticate users at the edge

MODIFIED docs/identity/app-proxy/application-proxy-wildcard.md

Modified by Ken Withee on May 3, 2025 1:39 AM
📖 View on learn.microsoft.com

+25 / -25 lines changed

Commit: Updates for clarity, tone, and consistency.

Changes:

Before

After

 
# Wildcard applications in the Microsoft Entra application proxy
 
In Microsoft Entra ID, configuring a large number of on-premises applications can quickly become unmanageable and introduces unnecessary risks for configuration errors if many of them require the same settings. With [Microsoft Entra application proxy](overview-what-is-app-proxy.md), you can address this issue by using wildcard application publishing to publish and manage many applications at once. This is a solution that allows you to:
 
- Simplify your administrative overhead
- Reduce the number of potential configuration errors
- Enable your users to securely access more resources
 
This article provides you with the information you need to configure wildcard application publishing in your environment.
 
You can create a wildcard (*) application if you have a group of applications with the same configuration. Potential candidates for a wildcard application are applications sharing the following settings:
 
- The group of users having access to them
- The SSO method
- The access protocol (http, https)
 
You can publish applications with wildcards if both, the internal and external URLs are in the following format:
 
## Prerequisites

 
# Wildcard applications in the Microsoft Entra application proxy
 
In Microsoft Entra ID, configuring a large number of on-premises applications can quickly become unmanageable and introduces unnecessary risks for configuration errors if many of them require the same settings. With [Microsoft Entra application proxy](overview-what-is-app-proxy.md), you can address this issue by using wildcard application publishing to publish and manage many applications at once. The solution provides:
 
- Simplified administrative overhead
- Reduced number of potential configuration errors
- Secure access more resources
 
This article provides you with the information you need to configure wildcard application publishing in your environment.
 
You can create a wildcard (*) application if you have a group of applications with the same configuration. Potential candidates for a wildcard application are applications sharing the following settings:
 
- The group of users having access to them
- The single sign-on (SSO) method
- The access protocol (http, https)
 
You can publish applications with wildcards if both, the internal and external URLs are in the following format:
 
## Prerequisites

MODIFIED docs/id-governance/access-reviews-faqs.md

Modified by Ortagus Winfrey on May 3, 2025 7:31 AM
📖 View on learn.microsoft.com

+25 / -21 lines changed

Commit: Updates

Changes:

Before

After

 
## Frequently asked questions
 
### Can I create custom workflows for guests?
 
Yes, custom workflows can be configured for members or guests in your tenant. Workflows can run for all types of external guests, external members, internal guests, and internal members.
 
### Why do I see "Lifecycle Management" instead of "Lifecycle Workflows"?
 
For a small portion of our customers, Lifecycle Workflows could still be listed under the former name Lifecycle Management in the audit logs and enterprise applications.
 
### Do I need to map employeeHireDate in provisioning apps like WorkDay?
 
Yes, key user properties like employeeHireDate are supported for user provisioning from HR apps like WorkDay. To use these properties in Lifecycle workflows, you need to map them in the provisioning process to ensure the values are set. The following screenshot is an example of the mapping: 
 
![Screenshot showing an example of how mapping is done in a Lifecycle Workflow.](./media/workflows-faqs/workflows-mapping.png)
 
For more information on syncing employee attributes in Lifecycle Workflows, see: [How to synchronize attributes for Lifecycle workflows](how-to-lifecycle-workflow-sync-attributes.md)
 
### How do I see more details and parameters of tasks and the attributes that are being updated?

 
## Frequently asked questions
 
### Can I stop a recurring access review series at any time?
 
While there's no direct "**Stop**" button for a series, you can edit the series to set an earlier end date. This prevents new review instances from being generated after that date.
 
### Do access reviews reflect real-time changes to users or access during the review period?
 
No. Access reviews capture a snapshot of access at the start of each review instance. Any changes made to user assignments, group membership, or reviewer configuration after the review begins will not be reflected in that instance.
These updates will instead be captured in the next instance of the review (if it's a recurring review). At the start of each recurrence, the system re-evaluates and retrieves the latest information about users, resources, and reviewers.
 
### I completed an access review but don’t see any changes yet. Why?
 
When a reviewer completes an access review, it means they’ve submitted their decisions. However, changes to access won’t be applied until the review reaches its scheduled end date.
 
If the review is set to **auto-apply**, the system will apply the decisions shortly after the end date. **If auto-apply is not enabled**, an administrator must manually apply the results. You can confirm whether auto-apply is enabled in the review’s configuration settings.
 
> [!NOTE]

MODIFIED docs/identity/app-proxy/how-to-configure-sso-with-kcd.md

Modified by Ken Withee on May 3, 2025 2:52 AM
📖 View on learn.microsoft.com

+22 / -23 lines changed

Commit: Updates for consistency and clarity.

Changes:

Before

After

You can enable single sign-on to your applications using integrated Windows authentication (IWA) by giving private network connectors permission in Active Directory to impersonate users. The connectors use this permission to send and receive tokens on their behalf.
 
## How single sign-on with KCD works
This diagram explains the flow when a user attempts to access an on-premises application that uses IWA.
 
![Microsoft Entra authentication flow diagram](./media/application-proxy-configure-single-sign-on-with-kcd/authdiagram.png)
 
* Your apps, like SharePoint Web apps, are set to use integrated Windows authentication. For more information, see [Enable Support for Kerberos Authentication](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759186(v=ws.11)), or for SharePoint see [Plan for Kerberos authentication in SharePoint 2013](/SharePoint/security-for-sharepoint-server/kerberos-authentication-planning).
* All your apps have [Service Principal Names](/windows/win32/ad/service-principal-names).
* The server running the Connector and the server running the app are domain joined and part of the same domain or trusting domains. For more information on domain join, see [Join a Computer to a Domain](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dd807102(v=ws.11)).
* The server running the Connector has access to read the TokenGroupsGlobalAndUniversal attribute for users. This default setting might have been impacted by security hardening the environment. Adding the Connector servers to the "Windows Authorization Access Group" will normally do this.
 
### Configure Active Directory
The Active Directory configuration varies, depending on whether your private network connector and the application server are in the same domain or not.
3. Right-click and select **Properties** > **Delegation**.
4. Select **Trust this computer for delegation to specified services only**. 
5. Select **Use any authentication protocol**.
6. Under **Services to which this account can present delegated credentials** add the value for the SPN identity of the application server. This enables the private network connector to impersonate users in AD against the applications defined in the list.
 
   ![Connector-SVR Properties window screenshot](./media/application-proxy-configure-single-sign-on-with-kcd/properties.jpg)

You can enable single sign-on to your applications using integrated Windows authentication (IWA) by giving private network connectors permission in Active Directory to impersonate users. The connectors use this permission to send and receive tokens on their behalf.
 
## How single sign-on with KCD works
The diagram explains the flow when a user attempts to access an on-premises application that uses IWA.
 
![Microsoft Entra authentication flow diagram](./media/application-proxy-configure-single-sign-on-with-kcd/authdiagram.png)
 
* Your apps, like SharePoint Web apps, are set to use integrated Windows authentication. For more information, see [Enable Support for Kerberos Authentication](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759186(v=ws.11)), or for SharePoint see [Plan for Kerberos authentication in SharePoint 2013](/SharePoint/security-for-sharepoint-server/kerberos-authentication-planning).
* All your apps have [Service Principal Names](/windows/win32/ad/service-principal-names).
* The server running the Connector and the server running the app are domain joined and part of the same domain or trusting domains. For more information on domain join, see [Join a Computer to a Domain](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dd807102(v=ws.11)).
* Ensure the Connector server can read the `TokenGroupsGlobalAndUniversal` attribute for users. Security hardening might restrict this access. Enable the connector servers by adding them to the *Windows Authorization Access* group.
 
### Configure Active Directory
The Active Directory configuration varies, depending on whether your private network connector and the application server are in the same domain or not.
3. Right-click and select **Properties** > **Delegation**.
4. Select **Trust this computer for delegation to specified services only**. 
5. Select **Use any authentication protocol**.
6. Under **Services to which this account can present delegated credentials** add the value for the SPN identity of the application server. The setting enables the private network connector to impersonate users in AD against the applications defined in the list.
 
   ![Connector-SVR Properties window screenshot](./media/application-proxy-configure-single-sign-on-with-kcd/properties.jpg)

MODIFIED docs/id-protection/concept-identity-protection-risks.md

Modified by shlipsey3 on May 3, 2025 9:40 AM
📖 View on learn.microsoft.com

+0 / -40 lines changed

Commit: idp-faqs-050225

Changes:

Before

After

 
## Common questions 
 
### What if incorrect credentials were used to attempt to sign-in? 
 
ID Protection generates risk detections only when the correct credentials are used. If incorrect credentials are used on a sign-in, it doesn't represent risk of credential compromise. 
 
### Is password hash synchronization required? 
 
Risk detections like leaked credentials require the presence of password hashes for detection to occur. For more information about password hash synchronization, see the article, [Implement password hash synchronization with Microsoft Entra Connect Sync](../identity/hybrid/connect/how-to-connect-password-hash-synchronization.md). 
 
### Why are risk detections generated for disabled accounts? 
 
User accounts in a disabled state can be re-enabled. If the credentials of a disabled account are compromised, and the account gets re-enabled, bad actors might use those credentials to gain access. ID Protection generates risk detections for suspicious activities against these disabled accounts to alert customers about potential account compromise. If an account is no longer in use and won't be re-enabled, customers should consider deleting it to prevent compromise. No risk detections are generated for deleted accounts. 
 
### I tried to sort the Risk detections report using the *Detection time* column, but it's not working
 
Sorting by *Detection time* in the Risk detections report might not always give the correct result because of a known technical constraint. To sort by *Detection time*, select **Download** to export the data as a CSV file and sort accordingly.
 
### Common leaked credentials questions

 
## Common questions 
 
### Locations

MODIFIED docs/identity/app-proxy/how-to-configure-custom-domain.md

Modified by Ken Withee on May 3, 2025 2:39 AM
📖 View on learn.microsoft.com

+9 / -9 lines changed

Commit: Updates for consistency and clarity.

Changes:

Before

After

 
- You can control your branding and create the URLs you want. A custom domain can help build your users' confidence, because users see and use a familiar name instead of *`msappproxy.net`*.
 
- Some configurations only work with custom domains. For example, you need custom domains for apps that use Security Assertion Markup Language (SAML). SAML is used when you’re using Active Directory Federation Services (AD FS) but are unable to use WS-Federation. For more information, see [Work with claims-aware apps in application proxy](application-proxy-configure-for-claims-aware-applications.md). 
 
If you're not able to make the internal and external URLs match, it's not as important to use custom domains. But you can still take advantage of the other benefits. 
 
## DNS configuration options
 
There are several options for setting up your DNS configuration, depending on your requirements:
 
### Same internal and external URL, different internal and external behavior 
 
If you don't want your internal users to be directed through the application proxy, you can set up a *split-brain DNS*. A split DNS infrastructure directs name resolution based on host location. Internal hosts are directed to an internal domain name server, and external hosts to an external domain name server.
 
## Set up and use custom domains
 
To configure an on-premises app to use a custom domain, you need a verified Microsoft Entra custom domain, a PFX certificate for the custom domain, and an on-premises app to configure.

 
- You can control your branding and create the URLs you want. A custom domain can help build your users' confidence, because users see and use a familiar name instead of *`msappproxy.net`*.
 
- Some configurations only work with custom domains. For example, you need custom domains for apps that use Security Assertion Markup Language (SAML). SAML is used when you’re using Active Directory Federation Services (ADFS) but are unable to use WS-Federation. For more information, see [Work with claims-aware apps in application proxy](application-proxy-configure-for-claims-aware-applications.md). 
 
If you're not able to make the internal and external URLs match, it's not as important to use custom domains. But you can still take advantage of the other benefits. 
 
## DNS configuration options
 
There are several options for setting up your Domain Name System (DNS) configuration, depending on your requirements:
 
### Same internal and external URL, but different behavior 
 
If you don't want your internal users to be directed through the application proxy, you can set up a *split-brain DNS*. A split DNS infrastructure directs name resolution based on host location. Internal hosts are directed to an internal domain name server, and external hosts to an external domain name server.
 
## Set up and use custom domains
 
To configure an on-premises app to use a custom domain, you need a verified Microsoft Entra custom domain, a Personal Information eXchange (PFX) certificate for the custom domain, and an on-premises app to configure.

MODIFIED docs/identity/app-proxy/application-proxy-troubleshoot.md

Modified by Ken Withee on May 3, 2025 1:09 AM
📖 View on learn.microsoft.com

+8 / -8 lines changed

Commit: Updates to tone and clarity.

Changes:

Before

After

 
The first thing to check is the connector. To learn how to debug a private network connector, see [Debug private network connector issues](application-proxy-debug-connectors.md). If you still have issues connecting to your application, return to this article to troubleshoot the application.  
 
If an error occurs when a user accesses a published application or when you publish an application, check the following options to see if Microsoft Entra application proxy is working correctly:
 
* Open the Windows Services console. Verify that the **Microsoft Entra private network connector** service is enabled and running. Look at the application proxy service properties page.
 
For example, if you publish the path `https://yourapp/app`, but the application refers to images that are located in `https://yourapp/media`, the images don't appear in the application.
 
Make sure that you publish the application by using the highest-level path you need to include all referenced content and files. In this example, that level is `http://yourapp/`.
 
Verify that the missing resources caused the issue:
 
| Error | Explanation and steps to take |
| ----- | ----------------- |
| `The website cannot display the page.` | A user sees this error when they try to access an Integrated Windows Authentication (IWA) app you published. The defined SPN for this application is incorrect. <br><br> For IWA apps, make sure that the SPN that's configured for this application is correct. |
| `The website cannot display the page.` | A user sees this error when they try to access an Outlook Web Application (OWA) app you published. The issue results from: <br><br>- The defined SPN for this application is incorrect. Make sure that the SPN that's configured for this application is correct.<br><br>- The user who tried to access the application is using a Microsoft account instead of their corporate account to sign in, or the user is a guest user. Make sure the user signs in by using a corporate account that matches the domain of the published application. Microsoft Account users and guests can't access IWA applications.<br><br>- The user who tried to access the application isn't properly defined for this application in the on-premises configuration. Make sure that this user has the required on-premises permissions to access this back-end application. |
| `This corporate app can’t be accessed. You are not authorized to access this application. Authorization failed. Make sure to assign the user with access to this application.` | A user sees this error when they try to access an app you published if they use a Microsoft account instead of their corporate account to sign in, or the user is a guest user. <br><br>Microsoft Account users and guests can't access IWA applications. Make sure the user signs in by using a corporate account that matches the domain of the published application.<br><br>You must assign the user for this application. On the **Application** tab, under **Users and Groups**, assign this user or user group to this application.|

 
The first thing to check is the connector. To learn how to debug a private network connector, see [Debug private network connector issues](application-proxy-debug-connectors.md). If you still have issues connecting to your application, return to this article to troubleshoot the application.  
 
If a user encounters an error while accessing or publishing an application, use these steps to verify that Microsoft Entra application proxy is functioning properly:
 
* Open the Windows Services console. Verify that the **Microsoft Entra private network connector** service is enabled and running. Look at the application proxy service properties page.
 
For example, if you publish the path `https://yourapp/app`, but the application refers to images that are located in `https://yourapp/media`, the images don't appear in the application.
 
Make sure that you publish the application by using the highest-level path you need to include all referenced content and files. In the example, that level is `http://yourapp/`.
 
Verify that the missing resources caused the issue:
 
| Error | Explanation and steps to take |
| ----- | ----------------- |
| `The website cannot display the page.` | A user sees the error when they try to access an Integrated Windows Authentication (IWA) app you published. The defined SPN for the application is incorrect. <br><br> Make sure the SPN for the application is correct. |
| `The website cannot display the page.` | A user sees the error when they try to access an Outlook Web Application (OWA) app you published. The issue results from: <br><br>- The defined SPN for the application is incorrect. Make sure the SPN for the application is correct.<br><br>- The user who tried to access the application is using a Microsoft account instead of their corporate account to sign in, or the user is a guest user. Make sure the user signs in by using a corporate account that matches the domain of the published application. Microsoft Account users and guests can't access IWA applications.<br><br>- The user who tried to access the application isn't properly defined for the application in the on-premises configuration. Make sure that the user has the required on-premises permissions to access the back-end application. |
| `This corporate app can’t be accessed. You are not authorized to access the application. Authorization failed. Make sure to assign the user with access to the application.` | This error occurs when a user tries to access an app using a Microsoft account or as a guest user. Microsoft Account users and guests can't access IWA applications. Ensure the user signs in with a corporate account matching the app's domain.<br><br>To fix the issue, go to the **Application** tab, under **Users and Groups**, and assign the user or group to the app. |

MODIFIED docs/identity/authentication/concept-authentication-qr-code.md

Modified by Justinha on May 3, 2025 7:28 AM
📖 View on learn.microsoft.com

+13 / -1 lines changed

Commit: added kinown issue

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 03/26/2025
 
ms.author: justinha
author: aanjusingh
- Custom tenant endpoint for sign in 
- Configurable PIN protection policies that define account lockout threshold, duration, or PIN complexity
 
## Related content
 
- [How to enable the QR code authentication method in Microsoft Entra ID (Preview)](how-to-authentication-qr-code.md)

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 05/02/2025
 
ms.author: justinha
author: aanjusingh
- Custom tenant endpoint for sign in 
- Configurable PIN protection policies that define account lockout threshold, duration, or PIN complexity
 
## Known issue
 
If you enable QR code authentication for a user, they need to sign-in with an existing authentication method before they can sign in with a QR code for the first time, or they see an **Incorrect QR code** error. 
 
For example:
 
- You enable QR code authentication for a user.
- The user needs to sign in with their password or another sign-in method.
- For subsequent sign-ins, they can sign in with a QR code.
 

MODIFIED docs/identity/app-proxy/how-to-configure-sso.md

Modified by Ken Withee on May 3, 2025 2:55 AM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Updates for clarity and tone.

Changes:

Before

After

1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses application proxy. If you need to change directories, select **Switch directory** and choose a directory that uses application proxy.
1. Browse to **Entra ID** > **Enterprise apps** > **Application proxy**.
 
 Look for the “Pre Authentication” field, and make sure that is set. 
 
For more information on the Pre-Authentication methods, see step 4 of the [app publishing document](application-proxy-add-on-premises-application.md).
 
-   **Header-based sign-on:** Header-based sign-on is used to provide single sign-on capabilities using HTTP headers. To learn more, see [Header-based single sign-on](application-proxy-configure-single-sign-on-with-headers.md).
 
-   **SAML single sign-on:** With SAML single sign-on, Microsoft Entra authenticates to the application by using the user's Microsoft Entra account. Microsoft Entra ID communicates the sign-on information to the application through a connection protocol. With SAML-based single sign-on, you can map users to specific application roles based on rules you define in your SAML claims. For information about setting up SAML single sign-on, see [SAML for single sign-on with application proxy](conceptual-sso-apps.md).
 
Each of these options can be found by going to your application in **Enterprise Applications**, and opening the **single sign-on** page on the left menu. If your application was created in the old portal, you may not see all these options.
 
On this page, you also see one more Sign-On option: Linked Sign-On. Application proxy supports this option. However, this option doesn't add single sign-on to the application. That said the application may already have single sign-on implemented using another service such as Active Directory Federation Services. 
 
This option allows an admin to create a link to an application that users first land on when accessing the application. For example, an application that is configured to authenticate users using Active Directory Federation Services 2.0 can use the “Linked Sign-On” option to create a link to it on the My Apps page.
 
## Next steps
- [Password vaulting for single sign-on with application proxy](application-proxy-configure-single-sign-on-password-vaulting.md)

1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses application proxy. If you need to change directories, select **Switch directory** and choose a directory that uses application proxy.
1. Browse to **Entra ID** > **Enterprise apps** > **Application proxy**.
 
 Look for the `Pre Authentication` field, and make sure that is set. 
 
For more information on the Pre-Authentication methods, see step 4 of the [app publishing document](application-proxy-add-on-premises-application.md).
 
-   **Header-based sign-on:** Header-based sign-on is used to provide single sign-on capabilities using HTTP headers. To learn more, see [Header-based single sign-on](application-proxy-configure-single-sign-on-with-headers.md).
 
-   **SAML single sign-on:** With Security Assertion Markup Language (SAML) single sign-on, Microsoft Entra authenticates to the application by using the user's Microsoft Entra account. Microsoft Entra ID communicates the sign-on information to the application through a connection protocol. With SAML-based single sign-on, you can map users to specific application roles based on rules you define in your SAML claims. For information about setting up SAML single sign-on, see [SAML for single sign-on with application proxy](conceptual-sso-apps.md).
 
Each of these options can be found by going to your application in **Enterprise Applications**, and opening the **single sign-on** page on the left menu. If your application was created in the old portal, you might not see all these options.
 
On this page, you also see one more Sign-On option: Linked Sign-On. Application proxy supports this option. However, this option doesn't add single sign-on to the application. That said the application might already have single sign-on implemented using another service such as Active Directory Federation Services. 
 
This option allows an admin to create a link to an application that users first land on when accessing the application. For example, an application that is configured to authenticate users using Active Directory Federation Services 2.0 can use the **Linked Sign-On** option to create a link to it on the My Apps page.
 
## Next steps
- [Password vaulting for single sign-on with application proxy](application-proxy-configure-single-sign-on-password-vaulting.md)

MODIFIED docs/identity/app-proxy/application-proxy-secure-api-access.md

Modified by Ken Withee on May 3, 2025 12:58 AM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Updates for clarity and tone and consistency.

Changes:

Before

After

Business logic often lives in a private Application Programming Interface (API). The API runs on premises or in a private cloud. Your native Android, iOS, Mac, or Windows apps need to interact with the API endpoints to use data or provide user interaction. Microsoft Entra application proxy and the [Microsoft Authentication Library (MSAL)](~/identity-platform/reference-v2-libraries.md) let your native apps securely access your private cloud APIs. Microsoft Entra application proxy is a faster and more secure solution than opening firewall ports and controlling authentication and authorization at the app layer.
 
> [!TIP]
> On premises is a legacy term dating back to the time when physical servers were located on the premises of the corporate office. Now days, many self hosted workloads run on a virtual machine in a datacenter. The term on premises and private cloud are used interchangeably.
 
This article walks you through setting up a Microsoft Entra application proxy solution for hosting a web API service that native apps can access.
 
   ![Select and assign user](./media/application-proxy-secure-api-access/7-select-admin-user.png)
 
1. Back on the **Add Assignment** page, select **Assign**.
 
> [!NOTE]
> APIs that use integrated Windows authentication might require [additional steps](./how-to-configure-sso-with-kcd.md).
 
## Register the native app and grant access to the API
 
1. Paste the SecretAPI **Home Page URL** in the `<add key="todo:TodoListBaseAddress" value="" />` field. You can find and copy this value (a URL) from the SecretAPI **Branding & properties** page, in the left navigation under **Manage**.
 
> [!NOTE]

Business logic often lives in a private Application Programming Interface (API). The API runs on premises or in a private cloud. Your native Android, iOS, Mac, or Windows apps need to interact with the API endpoints to use data or provide user interaction. Microsoft Entra application proxy and the [Microsoft Authentication Library (MSAL)](~/identity-platform/reference-v2-libraries.md) let your native apps securely access your private cloud APIs. Microsoft Entra application proxy is a faster and more secure solution than opening firewall ports and controlling authentication and authorization at the app layer.
 
> [!TIP]
> The term "on premises" is a legacy term dating back to the time when physical servers were located on the premises of the corporate office. Now days, many self-hosted workloads run on a virtual machine in a datacenter. The terms on premises and private cloud are used interchangeably.
 
This article walks you through setting up a Microsoft Entra application proxy solution for hosting a web API service that native apps can access.
 
   ![Select and assign user](./media/application-proxy-secure-api-access/7-select-admin-user.png)
 
1. On the **Add Assignment** page, select **Assign**.
 
> [!NOTE]
> APIs that use integrated Windows authentication might require [extra steps](./how-to-configure-sso-with-kcd.md).
 
## Register the native app and grant access to the API
 
1. Paste the SecretAPI **Home Page URL** in the `<add key="todo:TodoListBaseAddress" value="" />` field. You can find and copy this value (a URL) from the SecretAPI **Branding & properties** page, in the left navigation under **Manage**.
 
> [!NOTE]

MODIFIED docs/identity/app-proxy/application-proxy-ping-access-publishing-guide.md

Modified by Ken Withee on May 3, 2025 12:54 AM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Updates to improve quality and clarity.

Changes:

Before

After

   1. **Translate URL in Headers**: Choose **No**.
 
   > [!NOTE]
   > If this is your first application, use port 3000 to start and come back to update this setting if you change your PingAccess configuration. For subsequent applications, the port will need to match the Listener you've configured in PingAccess.
 
1. Select **Add**. The overview page for the new application appears.
 
 
   ![Shows the list of users and groups](./media/application-proxy-configure-single-sign-on-with-ping-access/users-and-groups.png)
 
1. Select a user for application testing, and select **Select**. Make sure this test account has access to the on-premises application.
1. Select **Assign**.
1. From the application sidebar, select **Single sign-on** > **Header-based**.
 
   > [!TIP]
   > If this is your first time using header-based single sign-on, you need to install PingAccess. To make sure your Microsoft Entra subscription is automatically associated with your PingAccess installation, use the link on this single sign-on page to download PingAccess. You can open the download site now, or come back to this page later.
 
   ![Shows header-based sign-on screen and PingAccess](./media/application-proxy-configure-single-sign-on-with-ping-access/sso-header.png)
 
> [!NOTE]

   1. **Translate URL in Headers**: Choose **No**.
 
   > [!NOTE]
   > For the first application, use port 3000 to start and come back to update this setting if you change your PingAccess configuration. For subsequent applications, the port needs to match the Listener configured in PingAccess.
 
1. Select **Add**. The overview page for the new application appears.
 
 
   ![Shows the list of users and groups](./media/application-proxy-configure-single-sign-on-with-ping-access/users-and-groups.png)
 
1. Select a user for application testing, and select **Select**. Make sure the test account has access to the on-premises application.
1. Select **Assign**.
1. From the application sidebar, select **Single sign-on** > **Header-based**.
 
   > [!TIP]
   > Install PingAccess the first time you use header-based single sign-on. To make sure your Microsoft Entra subscription is automatically associated with your PingAccess installation, use the link on the single sign-on page to download PingAccess. You can open the download site now, or come back to this page later.
 
   ![Shows header-based sign-on screen and PingAccess](./media/application-proxy-configure-single-sign-on-with-ping-access/sso-header.png)
 
> [!NOTE]

MODIFIED docs/permissions-management/onboard-enable-tenant.md

Modified by jenniferf-skc on May 3, 2025 2:28 AM
📖 View on learn.microsoft.com

+4 / -3 lines changed

Commit: Changing Browse to instructios for left nav changes

Changes:

Before

After

ms.service: entra-permissions-management
 
ms.topic: how-to
ms.date: 04/01/2025
ms.author: jfields
---
 
## How to enable Permissions Management on your Microsoft Entra tenant
 
1. In your browser:
    1. Browse to the [Microsoft Entra admin center](https://entra.microsoft.com) and sign in to [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) as at least a [Billing Administrator](https://go.microsoft.com/fwlink/?linkid=2248574).
    1. If needed, activate the *Permissions Management Administrator* role in your Microsoft Entra tenant.
    1. In the Azure portal, select **Microsoft Entra Permissions Management**, then select the link to purchase a license or begin a trial.
 
 
## Activate a free trial or paid license 
 

ms.service: entra-permissions-management
 
ms.topic: how-to
ms.date: 05/02/2025
ms.author: jfields
---
 
## How to enable Permissions Management on your Microsoft Entra tenant
 
1. In your browser:
    1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#home) as at least a [Billing Administrator](https://go.microsoft.com/fwlink/?linkid=2254515).
    1. If needed, activate the *Permissions Management Administrator* role in your Microsoft Entra tenant.
    1. Browse to **Entra ID**, then select **Go to Microsoft Entra ID**.
    1. In the Entra ID portal, select **Microsoft Entra Permissions Management**, then select the link to purchase a license or begin a trial.
 
 
## Activate a free trial or paid license 

MODIFIED docs/identity/monitoring-health/reference-sla-performance.md

Modified by shlipsey3 on May 3, 2025 2:12 AM
📖 View on learn.microsoft.com

+4 / -2 lines changed

Commit: sla-update-050225

Changes:

Before

After

ms.service: entra-id
ms.topic: reference
ms.subservice: monitoring-health
ms.date: 12/10/2024
ms.author: sarahlipsey
ms.reviewer: egreenberg14
---
| January   |         | 99.998% | 99.998% | 99.999% | 99.998% |
| February  | 99.999% | 99.999% | 99.999% | 99.999% | 99.998% |
| March     | 99.568% | 99.998% | 99.999% | 99.999% | 99.996% |
| April     | 99.999% | 99.999% | 99.999% | 99.999% |         |
| May       | 99.999% | 99.999% | 99.999% | 99.999% |         |
| June      | 99.999% | 99.999% | 99.999% | 99.999% |         |
| July      | 99.999% | 99.999% | 99.999% | 99.999% |         |
 
<a name='how-is-azure-ad-sla-measured-'></a>
 
## Incident history
 
All incidents that seriously affect Microsoft Entra performance are documented in the [Azure status history](https://azure.status.microsoft/status/history/). Not all events documented in Azure status history are serious enough to cause Microsoft Entra ID to go below its SLA. You can view information about the impact of incidents, and a root cause analysis of what caused the incident and what steps Microsoft took to prevent future incidents.

ms.service: entra-id
ms.topic: reference
ms.subservice: monitoring-health
ms.date: 05/02/2025
ms.author: sarahlipsey
ms.reviewer: egreenberg14
---
| January   |         | 99.998% | 99.998% | 99.999% | 99.998% |
| February  | 99.999% | 99.999% | 99.999% | 99.999% | 99.998% |
| March     | 99.568% | 99.998% | 99.999% | 99.999% | 99.996% |
| April     | 99.999% | 99.999% | 99.999% | 99.999% |   *     |
| May       | 99.999% | 99.999% | 99.999% | 99.999% |         |
| June      | 99.999% | 99.999% | 99.999% | 99.999% |         |
| July      | 99.999% | 99.999% | 99.999% | 99.999% |         |
 
<a name='how-is-azure-ad-sla-measured-'></a>
 
* Starting in April 2025, we updated our SLA performance calculations to provide a more complete view of the user experience with authentication availability. The new calculation includes authentication successes from Microsoft Entra's resilient infrastructure, such as when the backup authentication service succeeds on retry. Prior to April 2025, these successful sign-ins were not included in the SLA calculation. With the addition of this new calculation, the SLA performance percentages will increase.
 
## Incident history

MODIFIED docs/architecture/road-to-the-cloud-migrate.md

Modified by Michael Greene on May 3, 2025 8:31 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update Azure services

Changes:

Before

After

| Management area | On-premises (Active Directory) feature | Equivalent Microsoft Entra feature |
| - | - | -|
| Security policy management| GPO, Microsoft Configuration Manager| [Microsoft 365 Defender for Cloud](https://azure.microsoft.com/services/security-center/) |
| Update management| Microsoft Configuration Manager, Windows Server Update Services| [Azure Automation Update Management](/azure/automation/update-management/overview) |
| Configuration management| GPO, Microsoft Configuration Manager| [Azure Automation State Configuration](/azure/automation/automation-dsc-overview) |
| Monitoring| System Center Operations Manager| [Azure Monitor Log Analytics](/azure/azure-monitor/logs/log-analytics-overview) |
 
Here's more information that you can use for application server management:
 

| Management area | On-premises (Active Directory) feature | Equivalent Microsoft Entra feature |
| - | - | -|
| Security policy management| GPO, Microsoft Configuration Manager| [Microsoft 365 Defender for Cloud](https://azure.microsoft.com/services/security-center/) |
| Update management| Microsoft Configuration Manager, Windows Server Update Services| [Azure Update Manager](/azure/update-manager/overview) |
| Configuration management| GPO, Microsoft Configuration Manager| [Azure Machine Configuration](/azure/governance/machine-configuration/overview) |
| Monitoring| System Center Operations Manager| [Azure Monitor](/azure/azure-monitor/fundamentals/overview) |
 
Here's more information that you can use for application server management:
 

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files