Microsoft Entra Documentation Changes

MODIFIED docs/id-governance/access-reviews-faqs.md

Modified by Ortagus Winfrey on May 4, 2025 12:36 AM
📖 View on learn.microsoft.com

+12 / -12 lines changed

Commit: First acrolinx fix

Changes:

Before

After

 
### Do access reviews reflect real-time changes to users or access during the review period?
 
No. Access reviews capture a snapshot of access at the start of each review instance. Any changes made to user assignments, group membership, or reviewer configuration after the review begins will not be reflected in that instance.
These updates will instead be captured in the next instance of the review (if it's a recurring review). At the start of each recurrence, the system re-evaluates and retrieves the latest information about users, resources, and reviewers.
 
### I completed an access review but don’t see any changes yet. Why?
 
When a reviewer completes an access review, it means they’ve submitted their decisions. However, changes to access won’t be applied until the review reaches its scheduled end date.
 
If the review is set to **auto-apply**, the system will apply the decisions shortly after the end date. **If auto-apply is not enabled**, an administrator must manually apply the results. You can confirm whether auto-apply is enabled in the review’s configuration settings.
 
> [!NOTE]
> Even if a reviewer completes their review early (e.g., on day 1 of a 10-day review), access changes still won’t take effect until the end of the review period.
 
### What happens if reviewers miss the review deadline?
 
If reviewers don’t take action by the review end date, system will automatically apply the admin configured default decision (e.g., approve, deny, or take recommendations) for users who weren’t reviewed.
 
### How can admins view upcoming reviews in a recurring series?

 
### Do access reviews reflect real-time changes to users or access during the review period?
 
No. Access reviews capture a snapshot of access at the start of each review instance. Any changes made to user assignments, group membership, or reviewer configuration after the review begins won't be reflected in that instance.
These updates will instead be captured in the next instance of the review if it's a recurring review. At the start of each recurrence, the system reevaluates and retrieves the latest information about users, resources, and reviewers.
 
### I completed an access review but don’t see any changes yet. Why?
 
When a reviewer completes an access review, it means they submit their decisions. However, changes to access are not applied until the review reaches its scheduled end date.
 
If the review is set to **auto-apply**, the system applies the decisions shortly after the end date. **If auto-apply is not enabled**, an administrator must manually apply the results. You can confirm whether auto-apply is enabled in the review’s configuration settings.
 
> [!NOTE]
> Even if a reviewer completes their review early, for example on day 1 of a 10-day review, access changes still won’t take effect until the end of the review period.
 
### What happens if reviewers miss the review deadline?
 
If reviewers don’t take action by the review end date, system will automatically apply the admin configured default decision (for example, approve, deny, or take recommendations) for users who weren’t reviewed.
 
### How can admins view upcoming reviews in a recurring series?

MODIFIED docs/external-id/customers/reference-training-videos.md

Modified by Yoel Horvitz on May 4, 2025 5:29 PM
📖 View on learn.microsoft.com

+17 / -5 lines changed

Commit: Update reference-training-videos.md

Changes:

Before

After

 
ms.subservice: external
ms.topic: concept-article
ms.date: 12/12/2024
ms.author: mimart
ms.custom: it-pro
 
The video explains step-up authentication and tenant configuration. In step-up authentication, users sign in with minimal authentication steps, like a username and password, or a social identity. However, upon risky actions, like high-value transactions or accessing sensitive data, the application requires more verification.
 
> [!VIDEO https://www.youtube.com/embed/869Opl4TQT0?si=pNYU5zrrpP1r9PTz]
### Extending authentication flows with your own business logic
 
This video explains the concept of a custom claims provider, which enables you to define attributes from external systems via a REST API you create. These attributes then get added to the security token returned to your application.
 
> [!VIDEO https://www.youtube.com/embed/1tPA7B9ztz0?si=0VXQJmDfnSUv_jAz]
The second part shows how to [configure Microsoft Entra ID custom claims provider](https://youtu.be/fxQGVIwX8_4?si=vwcYT7wn7OzL6MzK) with the token issuance start event type, which triggers just before a security token is issued.  This event allows you to call a REST API to add claims to the token that's returned to your application.
 
### Edit user's profile
 
 

 
ms.subservice: external
ms.topic: concept-article
ms.date: 05/02/2025
ms.author: mimart
ms.custom: it-pro
 
The video explains step-up authentication and tenant configuration. In step-up authentication, users sign in with minimal authentication steps, like a username and password, or a social identity. However, upon risky actions, like high-value transactions or accessing sensitive data, the application requires more verification.
 
> [!VIDEO https://www.youtube.com/embed/869Opl4TQT0?si=pNYU5zrrpP1r9PTz]
 
### Custom authentication extension overview
 
This introductory video outlines the key features and advantages of Microsoft Entra custom authentication extensions. It explains how to integrate your own claims provider, perform input validation during the sign-up process, and customize verification emails.
 
> [!VIDEO https://www.youtube.com/embed/ZU90avf0Qyc?si=N-kzaOC7KgeZmpKk]
 
### Get started with custom authentication extension
 
This video provides detailed instructions on configuring Microsoft Entra custom authentication extensions and offers best practices and valuable tips for optimal implementation.

MODIFIED docs/identity-platform/custom-extension-overview.md

Modified by Yoel Horvitz on May 4, 2025 7:11 PM
📖 View on learn.microsoft.com

+9 / -0 lines changed

Commit: Update custom-extension-overview.md

Changes:

Before

After

 
[!VIDEO https://www.youtube.com/embed/ZU90avf0Qyc?si=N-kzaOC7KgeZmpKk]
 
## Custom authentication extensions sign-in flow
 
The following diagram depicts the sign-in flow integrated with a custom authentication extension.
 
The token issuance start event, **OnTokenIssuanceStart** is triggered when a token is about to be issued to an application. It is an event type set up within a custom claims provider. The custom claims provider is a custom authentication extension that calls a REST API to fetch claims from external systems. A custom claims provider maps claims from external systems into tokens and can be assigned to one or many applications in your directory.
 
For details, see [custom claims providers](custom-claims-provider-overview.md).
 
### Attribute collection start

 
[!VIDEO https://www.youtube.com/embed/ZU90avf0Qyc?si=N-kzaOC7KgeZmpKk]
 
This video provides detailed instructions on configuring Microsoft Entra custom authentication extensions and offers best practices and valuable tips for optimal implementation.
 
> [!VIDEO https://www.youtube.com/embed/EamkX9aFTYw?si=k0ziK2thbJ6V4BtZ]
 
## Custom authentication extensions sign-in flow
 
The following diagram depicts the sign-in flow integrated with a custom authentication extension.
 
The token issuance start event, **OnTokenIssuanceStart** is triggered when a token is about to be issued to an application. It is an event type set up within a custom claims provider. The custom claims provider is a custom authentication extension that calls a REST API to fetch claims from external systems. A custom claims provider maps claims from external systems into tokens and can be assigned to one or many applications in your directory.
 
This video outlines the procedure of mapping claims from external systems into security tokens using Microsoft Entra custom claims provider.
 
> [!VIDEO https://www.youtube.com/embed/_CD3shvqpx4?si=cYvAO8CyXuI9YPiS]
 
For details, see [custom claims providers](custom-claims-provider-overview.md).

MODIFIED docs/identity-platform/custom-extension-tokenissuancestart-setup.md

Modified by Yoel Horvitz on May 4, 2025 7:18 PM
📖 View on learn.microsoft.com

+6 / -1 lines changed

Commit: Update custom-extension-tokenissuancestart-setup.md

Changes:

Before

After

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 03/14/2024
ms.reviewer: stsoneff
ms.service: identity-platform
ms.topic: how-to
 
This article describes how to create a REST API with a [token issuance start event](custom-claims-provider-overview.md#token-issuance-start-event-listener) using Azure Functions in the Azure portal. You create an Azure Function app and an HTTP trigger function which can return extra claims for your token. 
 
## Prerequisites
 
- A basic understanding of the concepts covered in [Custom authentication extensions overview](custom-extension-overview.md).

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 05/04/2025
ms.reviewer: stsoneff
ms.service: identity-platform
ms.topic: how-to
 
This article describes how to create a REST API with a [token issuance start event](custom-claims-provider-overview.md#token-issuance-start-event-listener) using Azure Functions in the Azure portal. You create an Azure Function app and an HTTP trigger function which can return extra claims for your token. 
 
 
This video outlines the procedure of mapping claims from external systems into security tokens using Microsoft Entra custom claims provider.
 
> [!VIDEO https://www.youtube.com/embed/_CD3shvqpx4?si=cYvAO8CyXuI9YPiS]
 
## Prerequisites
 
- A basic understanding of the concepts covered in [Custom authentication extensions overview](custom-extension-overview.md).

MODIFIED docs/identity-platform/custom-extension-tokenissuancestart-configuration.md

Modified by Yoel Horvitz on May 4, 2025 7:19 PM
📖 View on learn.microsoft.com

+5 / -1 lines changed

Commit: Update custom-extension-tokenissuancestart-configuration.md

Changes:

Before

After

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 04/10/2024
ms.reviewer: stsoneff
ms.service: identity-platform
ms.topic: how-to
 
This article describes how to configure a custom claims provider for a [token issuance start event](custom-claims-provider-overview.md#token-issuance-start-event-listener). Using an existing Azure Functions REST API, you'll register a custom authentication extension and add attributes that you expect it to parse from your REST API. To test the custom authentication extension, you'll register a sample OpenID Connect application to get a token and view the claims.
 
## Prerequisites
 
- An Azure subscription with the ability to create Azure Functions. If you don't have an existing Azure account, sign up for a [free trial](https://azure.microsoft.com/free/dotnet/) or use your [Visual Studio Subscription](https://visualstudio.microsoft.com/subscriptions/) benefits when you [create an account](https://account.windowsazure.com/Home/Index).

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 05/04/2025
ms.reviewer: stsoneff
ms.service: identity-platform
ms.topic: how-to
 
This article describes how to configure a custom claims provider for a [token issuance start event](custom-claims-provider-overview.md#token-issuance-start-event-listener). Using an existing Azure Functions REST API, you'll register a custom authentication extension and add attributes that you expect it to parse from your REST API. To test the custom authentication extension, you'll register a sample OpenID Connect application to get a token and view the claims.
 
This video outlines the procedure of mapping claims from external systems into security tokens using Microsoft Entra custom claims provider.
 
> [!VIDEO https://www.youtube.com/embed/_CD3shvqpx4?si=cYvAO8CyXuI9YPiS]
 
## Prerequisites
 
- An Azure subscription with the ability to create Azure Functions. If you don't have an existing Azure account, sign up for a [free trial](https://azure.microsoft.com/free/dotnet/) or use your [Visual Studio Subscription](https://visualstudio.microsoft.com/subscriptions/) benefits when you [create an account](https://account.windowsazure.com/Home/Index).

MODIFIED docs/identity-platform/custom-claims-provider-overview.md

Modified by Yoel Horvitz on May 4, 2025 7:03 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update custom-claims-provider-overview.md

Changes:

Before

After

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 04/10/2023
ms.reviewer: JasSuri
ms.service: identity-platform
 
 
The following video provides an excellent overview of the Microsoft Entra custom authentication extensions and custom claims providers:
 
> [!VIDEO https://www.youtube.com/embed/1tPA7B9ztz0]
 
Use a custom claims provider for the following scenarios:
 
## See also
 
- [Create a REST API with a token issuance start event](custom-extension-tokenissuancestart-setup.md)
- [Custom claims provider reference](custom-claims-provider-reference.md) article.

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 05/04/2025
ms.reviewer: JasSuri
ms.service: identity-platform
 
 
The following video provides an excellent overview of the Microsoft Entra custom authentication extensions and custom claims providers:
 
> [!VIDEO https://www.youtube.com/embed/ZU90avf0Qyc?si=Z8Z3gR9fzZFzb5Bq]
 
Use a custom claims provider for the following scenarios:
 
## See also
 
- [Create a REST API with a token issuance start event](custom-extension-tokenissuancestart-setup.md)
- [Custom claims provider reference](custom-claims-provider-reference.md) article.

MODIFIED docs/workload-id/workload-identity-federation-config-app-trust-managed-identity.md

Modified by Gladwin Johnson on May 4, 2025 7:59 AM
📖 View on learn.microsoft.com

+4 / -2 lines changed

Commit: Update to docs for MSAL sample

Changes:

Before

After

 
internal class Program
{
  // This example demonstrates how to access an Azure blob storage account by utilizing the manage identity credential.
  static void Main(string[] args)
  {
    string storageAccountName = "YOUR_STORAGE_ACCOUNT_NAME";
 
``` csharp
using Microsoft.Identity.Client;
using Azure.Storage.Blobs;
using Azure.Core;
 
internal class Program
{
        AuthenticationResult result = await app.AcquireTokenForClient(scopes).ExecuteAsync().ConfigureAwait(false);
 
        TokenCredential tokenCredential = new AccessTokenCredential(result.AccessToken);
        var client = new BlobContainerClient(
            new Uri($"https://{storageAccountName}.blob.core.windows.net/{containerName}"),

 
internal class Program
{
  // This example demonstrates how to access an Azure blob storage account by utilizing the managed identity credential.
  static void Main(string[] args)
  {
    string storageAccountName = "YOUR_STORAGE_ACCOUNT_NAME";
 
``` csharp
using Microsoft.Identity.Client;
using Microsoft.Identity.Client.AppConfig;
using Azure.Storage.Blobs;
using Azure.Core;
using Azure.Storage.Blobs.Models;
 
internal class Program
{
        AuthenticationResult result = await app.AcquireTokenForClient(scopes).ExecuteAsync().ConfigureAwait(false);
 
        TokenCredential tokenCredential = new AccessTokenCredential(result.AccessToken);

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files