Microsoft Entra Documentation Changes

MODIFIED docs/identity/authentication/how-to-plan-rdp-phishing-resistant-passwordless-authentication.md

Modified by Michael Epping on May 6, 2025 8:00 AM
📖 View on learn.microsoft.com

+46 / -43 lines changed

Commit: Minor fixes from docs team review

Changes:

Before

After

 
Organizations deploying phishing-resistant passwordless typically have a need for some of their personas to use remote desktop technology to facilitate productivity, security, or administration. The two basic use cases are:
 
1. Initializing and authenticating a remote desktop connection session from a local client to a remote machine using phishing-resistant passwordless credentials
1. Utilizing phishing-resistant passwordless credentials inside of an established remote desktop connection session
 
Review the specific considerations for each use case.
 
# [Passwordless Remote Desktop Connection Session Initiation](#tab/rdp-session-auth)
 
## Remote Desktop Connection Components
 
Windows remote desktop protocol involves three primary components, all of which need to properly support phishing-resistant passwordless credentials for initiating a remote desktop connection session using these credentials. If any of these components isn't able to properly function or lacks support for certain passwordless credentials, then one or both scenarios outlined won't function. This guide focuses on passkey/FIDO2 support and Cert-Based Authentication (CBA) support.
 
:::image type="content" border="true" source="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/RDP Session Auth.gif" alt-text="GIF showing the user experience when using Windows Hello for Business to establish a remote desktop connection session." lightbox="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/RDP Session Auth.gif":::
 
:::image type="content" border="true" source="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/RDP Session Establishment.png" alt-text="Swimlane diagram showing how phishing-resistant passwordless credentials are used when connecting via remote desktop connection" lightbox="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/RDP Session Establishment.png":::
 
Step through the following sections to determine if support for phishing-resistant passwordless is expected across all three components you're utilizing. Repeat this process if you have multiple scenarios that require evaluation.

 
Organizations deploying phishing-resistant passwordless typically have a need for some of their personas to use remote desktop technology to facilitate productivity, security, or administration. The two basic use cases are:
 
- Initializing and authenticating a remote desktop connection session from a local client to a remote machine using phishing-resistant passwordless credentials
- Utilizing phishing-resistant passwordless credentials inside of an established remote desktop connection session
 
Review the specific considerations for each use case.
 
# [Passwordless Remote Desktop Connection Session Initiation](#tab/rdp-session-auth)
 
## Remote Desktop connection components
 
Windows remote desktop protocol involves three primary components, all of which need to properly support phishing-resistant passwordless credentials for initiating a remote desktop connection session using these credentials. If any of these components isn't able to properly function or lacks support for certain passwordless credentials, then one or both scenarios outlined won't function. This guide focuses on passkey/FIDO2 support and Cert-Based Authentication (CBA) support.
 
:::image type="content" border="true" source="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/rdp-session-auth.gif" alt-text="GIF showing the user experience when using Windows Hello for Business to establish a remote desktop connection session." lightbox="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/rdp-session-auth.gif":::
 
:::image type="content" border="true" source="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/rdp-session-establishment.png" alt-text="Swimlane diagram showing how phishing-resistant passwordless credentials are used when connecting via remote desktop connection" lightbox="media/how-to-plan-rdp-phishing-resistant-passwordless-authentication/rdp-session-establishment.png":::
 
Step through the following sections to determine if support for phishing-resistant passwordless is expected across all three components you're utilizing. Repeat this process if you have multiple scenarios that require evaluation.

MODIFIED docs/global-secure-access/how-to-view-enriched-logs.md

Modified by Ken Withee on May 6, 2025 3:49 AM
📖 View on learn.microsoft.com

+2 / -26 lines changed

Commit: Update how-to-view-enriched-logs.md

Changes:

Before

After

 
### Roles and Permissions
 
- A **Global Administrator** or **Security Administrator** role is required to enable the export of Global Secure Access Network Traffic Logs in Diagnostic Settings.
 
### Configurations
 
- **Microsoft Profile** - Ensure the Microsoft traffic profile is enabled. Microsoft traffic forwarding profile is required to capture traffic directed to Microsoft 365 services, which is fundamental for log enrichment. 
- **Microsoft 365 Common and Office Online Traffic Policy** - Required for log enrichment. Ensure it's enabled. 
- **Tenant sending data** - Confirms that traffic, as configured in forwarding profiles, is accurately tunneled to the Global Secure Access service.
- **Diagnostic Settings Configuration** - Set up Microsoft Entra diagnostic settings to channel the logs to a designated endpoint, like a Log Analytics workspace or Sentinel workspace. The requirements for each endpoint differ and are outlined in the Configure Diagnostic settings section of this article.
- **Export the OfficeActivity log table** - The OfficeActivity table must be exported to the same LogAnalytics or Microsoft Sentinel workspace as the GSA traffic logs, or another third-party SIEM or Log system.
> [!NOTE]
> MS365 audit logs have undergone a feature change. Instead of creating a separate new stream of logs, you can now leverage the two existing log tables &mdash; Microsoft  365 OfficeActivity and Global Secure Access NetworkAccessTraffic tables &mdash; then combine the data using a Unique Token Id. 
 
### Enable log data
 
To enable the Enriched Microsoft 365 logs:
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator).

 
### Roles and Permissions
 
- A **Security Administrator** role is required to export Global Secure Access Network Traffic Logs in Diagnostic Settings.
 
### Configurations
 
- **Microsoft Profile** - Ensure the Microsoft traffic profile is enabled. Microsoft traffic forwarding profile is required to capture traffic directed to Microsoft 365 services, which is fundamental for log enrichment. 
- **Microsoft 365 Common and Office Online Traffic Policy** - Required for log enrichment. Ensure it's enabled.
- **Tenant sending data** - Confirms that traffic, as configured in forwarding profiles, is accurately tunneled to the Global Secure Access service.
- **Diagnostic Settings Configuration** - Set up Microsoft Entra diagnostic settings to channel the logs to a designated endpoint, like a Log Analytics workspace or Sentinel workspace. The requirements for each endpoint differ and are outlined in the Configure Diagnostic settings section of this article.
- **Export the OfficeActivity log table** - The OfficeActivity table must be exported to the same LogAnalytics or Microsoft Sentinel workspace as the GSA traffic logs, or another third-party SIEM or Log system.
> [!NOTE]
> MS365 audit logs have undergone a feature change. Instead of creating a separate new stream of logs, you can now leverage the two existing log tables &mdash; Microsoft  365 OfficeActivity and Global Secure Access NetworkAccessTraffic tables &mdash; then combine the data using a Unique Token Id. 
 
### Configure Diagnostic settings
 
To view the enriched Microsoft 365 logs, you must export or stream the logs to an endpoint, such as a Log Analytics workspace or a SIEM tool. The endpoint must be configured before you can configure Diagnostic settings.
 
 

MODIFIED docs/identity/enterprise-apps/whats-new-docs.md

Modified by omondiatieno on May 6, 2025 6:33 PM
📖 View on learn.microsoft.com

+17 / -7 lines changed

Commit: whatsnew updates for May

Changes:

Before

After

---
title: "What's new in Microsoft Entra application management"
description: "This article shows the new and updated documentation for the Microsoft Entra application management."
ms.date: 04/02/2025
ms.service: entra-id
ms.subservice: enterprise-apps
ms.topic: whats-new
 
Welcome to what's new in Microsoft Entra application management documentation. This article lists new docs and those articles that had significant updates in the last three months. To learn what's new with the application management service, see [What's new in Microsoft Entra ID](~/fundamentals/whats-new.md).
 
## March 2025
 
### Updated articles
- [Add an OpenID Connect-based single sign-on application](add-application-portal-setup-oidc-sso.md)
- [Configure enterprise application properties](add-application-portal-configure.md)
- [Tutorial: Manage certificates for federated single sign-on](tutorial-manage-certificates-for-federated-single-sign-on.md)
 
 
## January 2025
 

---
title: "What's new in Microsoft Entra application management"
description: "This article shows the new and updated documentation for the Microsoft Entra application management."
ms.date: 05/06/2025
ms.service: entra-id
ms.subservice: enterprise-apps
ms.topic: whats-new
 
Welcome to what's new in Microsoft Entra application management documentation. This article lists new docs and those articles that had significant updates in the last three months. To learn what's new with the application management service, see [What's new in Microsoft Entra ID](~/fundamentals/whats-new.md).
 
## April 2025
 
### New articles
 
- [Tutorial: Enforce secret and certificate standards using application management policies](tutorial-enforce-secret-standards.md)
 
### Updated articles
 
Reviewed the following articles for technical accuracy and clarity:
 

MODIFIED docs/id-governance/access-reviews-faqs.md

Modified by Ortagus Winfrey on May 6, 2025 10:50 PM
📖 View on learn.microsoft.com

+10 / -10 lines changed

Commit: updates

Changes:

Before

After

ms.custom: template-tutorial
---
 
# Access Reviews - FAQs
 
In this article, you find questions to commonly asked questions about [access reviews](access-reviews-overview.md). Check back to this page frequently as changes happen often, and answers are continually being added.
 
 
### How can admins view upcoming reviews in a recurring series?
 
There are several scenarios where the system is unable to apply review outcomes, especially for denied users. Reviewing members of a synced on-premises Windows Server AD group: If the group is synced from on-premises Windows Server AD, the group can't be managed in Microsoft Entra ID and therefore membership can't be changed.
 
- Reviewing a resource (role, group, or application) with nested groups assigned: For users who have membership through a nested group, we won't remove their membership from the nested group and therefore they retain access to the resource being reviewed.
- User not found / other errors can also result in an apply result not being supported.
- Reviewing the members of mail enabled group: The group can't be managed in Microsoft Entra ID, so membership can't be changed.
- Reviewing an Application that uses group assignment won't remove the members of those groups, so they retain the existing access from the group relationship for the application assignment.  
 
### Why don’t new group owners appear as reviewers during an ongoing group access review?
 
When a group or team access review starts, only the group owners at the time the review begins are assigned as reviewers.

ms.custom: template-tutorial
---
 
# Access reviews - FAQs
 
In this article, you find questions to commonly asked questions about [access reviews](access-reviews-overview.md). Check back to this page frequently as changes happen often, and answers are continually being added.
 
 
### How can admins view upcoming reviews in a recurring series?
 
There are several scenarios where the system is unable to apply review outcomes, especially for denied users:
 
 
- **Reviewing members of a synced on-premises Windows Server Active Directory group**: If the group is synced from on-premises Windows Server Active Directory, the group can't be managed in Microsoft Entra ID and therefore membership can't be changed.
-**Reviewing a resource (role, group, or application) with nested groups assigned**: For users who have membership through a nested group, we won't remove their membership from the nested group, and therefore they retain access to the resource being reviewed.
- **User not found**: A user not being found, or other similar errors, can also result in an apply result not being completed.
- **Reviewing the members of mail enabled group**: The group can't be managed in Microsoft Entra ID, so membership can't be changed.
- **The Application uses group assignment**: Reviewing an Application that uses group assignment won't remove the members of those groups, so they retain the existing access from the group relationship for the application assignment.  
 
### Why don’t new group owners appear as reviewers during an ongoing group access review?

MODIFIED docs/identity/conditional-access/concept-authentication-flows.md

Modified by John Flores on May 6, 2025 4:55 AM
📖 View on learn.microsoft.com

+10 / -9 lines changed

Commit: [Conditional Access] Auth flows freshness pass

Changes:

Before

After

ms.service: entra-id
ms.subservice: conditional-access
ms.topic: conceptual
ms.date: 02/27/2024
ms.author: joflore
author: MicrosoftGuyJFlo
manager: femila
---
# Conditional Access: Authentication flows
 
Microsoft Entra ID supports a wide variety of authentication and authorization flows to provide a seamless experience across all application and device types. Some of these authentication flows, are higher risk than others. To provide more control over your security posture, we’re adding the ability to control certain authentication flows to Conditional Access. This control starts with the ability to explicitly target [device code flow](../../identity-platform/v2-oauth2-device-code.md).
 
## Device code flow
 
Device code flow is used when signing into devices that might lack local input devices like shared devices or digital signage. Device code flow is a high-risk authentication flow that might be used as part of a phishing attack or to access corporate resources on unmanaged devices. You can configure the device code flow control along with other controls in your Conditional Access policies. For example, if device code flow is used for android based conference room devices, you might choose to block device code flow everywhere except for android devices in a specific network location. 
 
You should only allow device code flow where necessary. Microsoft recommends blocking device code flow wherever possible.
 
## Authentication transfer
 

ms.service: entra-id
ms.subservice: conditional-access
ms.topic: conceptual
ms.date: 05/05/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: femila
---
# Conditional Access: Authentication flows
 
Microsoft Entra ID supports various authentication and authorization flows to provide a seamless experience across all application and device types. Some authentication flows are higher risk than others. To give you more control over your security posture, Conditional Access lets you control certain authentication flows. This control begins with explicitly targeting [device code flow](../../identity-platform/v2-oauth2-device-code.md).
 
## Device code flow
 
Device code flow lets you sign into devices that lack local input devices, like shared devices or digital signage. Device code flow is a high-risk authentication method that can be part of a phishing attack or used to access corporate resources on unmanaged devices. Configure device code flow control along with other controls in Conditional Access policies. For example, if device code flow is used for Android-based conference room devices, block device code flow everywhere except for Android devices in a specific network location. 
 
Allow device code flow only where necessary. Microsoft recommends blocking device code flow wherever possible.
 
## Authentication transfer
 

MODIFIED docs/external-id/customers/how-to-add-attributes-to-token.md

Modified by Pratik Jadhav on May 6, 2025 4:55 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: (AzureCXP) fixes MicrosoftDocs/entra-docs#427246

Changes:

Before

After

1. Select **Add**.
1. Select **Save**. Repeat for each custom attribute you want to add.
 
### Update the application manifest to accept mapped claims
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
1. Browse to **Entra ID** > **App registrations**.
1. Select your application in the list to open the application's **Overview** page.
1. In the left menu, under **Manage**, select **Manifest** to open the application manifest.
1. Find the **acceptMappedClaims** key and set its value to **true**.
1. Find the **allowPublicClient** key and set its value to **true**.
1. Select **Save**.
 
## See also
 
- [Create a REST API with a token issuance start event](~/identity-platform/custom-extension-tokenissuancestart-setup.md)
- [Configure a custom claims provider for a token issuance event](~/identity-platform/custom-extension-tokenissuancestart-configuration.md)

1. Select **Add**.
1. Select **Save**. Repeat for each custom attribute you want to add.
 
### Update the application manifest to accept mapped claims in Microsoft Graph App Manifest(New)
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
1. Browse to **Entra ID** > **App registrations**.
1. Select your application in the list to open the application's **Overview** page.
1. In the left menu, under **Manage**, select **Manifest** to open the application manifest.
1. Find the **acceptMappedClaims** key and set its value to **true**.
1. Find the **isFallbackPublicClient** key and set its value to **true**.
1. Select **Save**.
 
## See also
 
- [Create a REST API with a token issuance start event](~/identity-platform/custom-extension-tokenissuancestart-setup.md)
- [Configure a custom claims provider for a token issuance event](~/identity-platform/custom-extension-tokenissuancestart-configuration.md)

MODIFIED docs/identity/authentication/how-to-enable-passkey-fido2.md

Modified by Justinha on May 6, 2025 5:51 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: revised order of guest names

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/02/2025
 
ms.author: justinha
 
### Guest users 
 
Registration of passkey (FIDO2) credentials isn't supported for external or internal guest users, including B2B collaboration users in the resource tenant.
 
### UPN changes

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/05/2025
 
ms.author: justinha
 
### Guest users 
 
Registration of passkey (FIDO2) credentials isn't supported for internal or external guest users, including B2B collaboration users in the resource tenant.
 
### UPN changes

MODIFIED docs/identity/devices/protecting-tokens-microsoft-entra-id.md

Modified by Jeffrey Bley on May 6, 2025 5:33 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update protecting-tokens-microsoft-entra-id.md

Changes:

Before

After

## Token Theft – protect against replay
 
If an adversary is able to successfully steal a token, organizations can enable certain capabilities to automatically reduce the
exposure of, or completely prevent, the stolen token from being replayed, thus defeating the attack. These capabilities include:
 
- Enforcing Token Protection in Conditional Access to secure sign-in sessions
- Enforcing access is only allowed via secure networks
 
For devices which are Entra-joined or Entra-registered, Entra ID generates a multi-application Refresh Token used for application SSO, also known as the [Primary Refresh Token (PRT)](concept-primary-refresh-token.md).
 
Primary Refresh Tokens (PRTs) are secure by design. They're protected with a cryptographically secure tie between the PRT and the device (client secret) to which the PRT is issued. The client secret is securely stored on platform-specific hardware such as Trusted Platform Modules (TPM) for Windows, Keystore System for Android, and Secure Enclave for iOS and macOS. Without the client secret, the PRT token is rendered ineffective and cannot be replayed if stolen.
 
**Token Protection in Conditional Access**

## Token Theft – protect against replay
 
If an adversary is able to successfully steal a token, organizations can enable certain capabilities to automatically reduce the
exposure of the stolen token from being replayed, thus defeating the attack. These capabilities include:
 
- Enforcing Token Protection in Conditional Access to secure sign-in sessions
- Enforcing access is only allowed via secure networks
 
For devices which are Entra-joined or Entra-registered, Entra ID generates a multi-application Refresh Token used for application SSO, also known as the [Primary Refresh Token (PRT)](concept-primary-refresh-token.md).
 
Primary Refresh Tokens (PRTs) are secure by design. They're protected with a cryptographically secure tie between the PRT and the device (client secret) to which the PRT is issued. On Windows devices, the client secret is securely stored on platform-specific hardware such as Trusted Platform Modules (TPM). Today, non-Windows devices store the secret in software.
 
**Token Protection in Conditional Access**

MODIFIED docs/id-protection/concept-identity-protection-risks.md

Modified by shlipsey3 on May 6, 2025 2:37 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: link-fix

Changes:

Before

After

ms.service: entra-id-protection
 
ms.topic: conceptual
ms.date: 05/02/2025
 
author: shlipsey3
ms.author: sarahlipsey
 
#### Leaked credentials 
 
Calculated offline. This risk detection type indicates that the user's valid credentials leaked. When cybercriminals compromise valid passwords of legitimate users, they often share these gathered credentials. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. When the Microsoft leaked credentials service acquires user credentials from the dark web, paste sites, or other sources, they're checked against Microsoft Entra users' current valid credentials to find valid matches. For more information about leaked credentials, see the [FAQs](id-protection.ym.#leaked-credentials). 
 
[Tips for investigating leaked credentials detections.](howto-identity-protection-investigate-risk.md#investigating-leaked-credentials-detections)

ms.service: entra-id-protection
 
ms.topic: conceptual
ms.date: 05/05/2025
 
author: shlipsey3
ms.author: sarahlipsey
 
#### Leaked credentials 
 
Calculated offline. This risk detection type indicates that the user's valid credentials leaked. When cybercriminals compromise valid passwords of legitimate users, they often share these gathered credentials. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. When the Microsoft leaked credentials service acquires user credentials from the dark web, paste sites, or other sources, they're checked against Microsoft Entra users' current valid credentials to find valid matches. For more information about leaked credentials, see the [FAQs](id-protection.yml.#leaked-credentials). 
 
[Tips for investigating leaked credentials detections.](howto-identity-protection-investigate-risk.md#investigating-leaked-credentials-detections)

MODIFIED docs/identity/hybrid/connect/authenticate-application-id.md

Modified by owinoakelo on May 6, 2025 1:58 AM
📖 View on learn.microsoft.com

+2 / -1 lines changed

Commit: Update authenticate-application-id.md

Changes:

Before

After

# Convert hash to bytes for older PowerShell:
$certHash = ($hashBytes|ForEach-Object ToString X2) -join ''
```
## Microsoft Graph permissions for BYOA
### ADSynchronization.ReadWrite.All
|Category|Application|Delegated|
|-----|-----|-----|
|Description|Allows the app to read, write, and manage identity data synced with on-premises via Microsoft Entra Connect Sync|Allows the app to read, write, and manage identity data synced with on-premises via Microsoft Entra Connect Sync|
|AdminConsentRequired|Yes|Yes|
 
### PasswordWriteback.RefreshClient.All
|Category|Application|Delegated|
|-----|-----|-----|
 

# Convert hash to bytes for older PowerShell:
$certHash = ($hashBytes|ForEach-Object ToString X2) -join ''
```
## Resource permission for BYOA
### ADSynchronization.ReadWrite.All
|Category|Application|Delegated|
|-----|-----|-----|
|Description|Allows the app to read, write, and manage identity data synced with on-premises via Microsoft Entra Connect Sync|Allows the app to read, write, and manage identity data synced with on-premises via Microsoft Entra Connect Sync|
|AdminConsentRequired|Yes|Yes|
 
## Microsoft Graph permissions for BYOA
### PasswordWriteback.RefreshClient.All
|Category|Application|Delegated|
|-----|-----|-----|

MODIFIED docs/identity/conditional-access/managed-policies.md

Modified by Pratik Jadhav on May 6, 2025 5:18 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: (AzureCXP) fixes MicrosoftDocs/entra-docs#426494

Changes:

Before

After

 
## How Microsoft-managed policies work
 
Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Entra ID** > **Conditional Access** > **Policies**.
 
You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.

 
## How Microsoft-managed policies work
 
Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Protection** > **Conditional Access** > **Policies**.
 
You can edit the state of a policy and what identities the policy should exclude. Exclude your [break-glass or emergency access accounts](../role-based-access-control/security-emergency-access.md) from managed policies just like other Conditional Access policies. Consider duplicating these policies if you need to make more changes than what's allowed in the Microsoft-managed policies.

MODIFIED docs/identity/saas-apps/hootsuite-tutorial.md

Modified by dimeji-omikunle-hs on May 6, 2025 8:06 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update hootsuite-tutorial.md

Changes:

Before

After

1. Perform the following step, if you wish to configure the application in **SP** initiated mode:
 
    In the **Sign-on URL** text box, type the URL:
    `https://hootsuite.com/login`
 
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section,  find **Certificate (Base64)** and select **Download** to download the certificate and save it on your computer.

1. Perform the following step, if you wish to configure the application in **SP** initiated mode:
 
    In the **Sign-on URL** text box, type the URL:
    `[https://hootsuite.com/login](https://hootsuite.com/login?method=sso)`
 
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section,  find **Certificate (Base64)** and select **Download** to download the certificate and save it on your computer.

MODIFIED docs/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication.md

Modified by Michael Epping on May 6, 2025 8:00 AM
📖 View on learn.microsoft.com

+2 / -0 lines changed

Commit: Minor fixes from docs team review

Changes:

Before

After

[Deploy a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-deploy-phishing-resistant-passwordless-authentication.md)
 
[Considerations for specific personas in a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-plan-persona-phishing-resistant-passwordless-authentication.md)

[Deploy a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-deploy-phishing-resistant-passwordless-authentication.md)
 
[Considerations for specific personas in a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-plan-persona-phishing-resistant-passwordless-authentication.md)
 
[Considerations for Remote Desktop Connections in a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-plan-rdp-phishing-resistant-passwordless-authentication.md)

MODIFIED docs/identity/monitoring-health/howto-analyze-provisioning-logs.md

Modified by Ken Withee on May 6, 2025 7:14 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update howto-analyze-provisioning-logs.md

Changes:

Before

After

## Related content
 
- [Check the status of user provisioning](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md)
- [Problem configuring user provisioning to a Microsoft Entra Gallery application](../app-provisioning/application-provisioning-config-problem.md)
- [Graph API for provisioning logs](/graph/api/resources/provisioningobjectsummary)

## Related content
 
- [Check the status of user provisioning](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md)
- [Problem configuring user provisioning to a Microsoft Entra Gallery application](../app-provisioning/troubleshoot.md)
- [Graph API for provisioning logs](/graph/api/resources/provisioningobjectsummary)

MODIFIED docs/identity/app-provisioning/whats-new-docs.md

Modified by Ken Withee on May 6, 2025 7:13 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update whats-new-docs.md

Changes:

Before

After

- [Skip deletion of user accounts that go out of scope in Azure Active Directory](skip-out-of-scope-deletions.md)
- [No users are being provisioned](application-provisioning-config-problem-no-users-provisioned.md)
- [Known issues and resolutions with SCIM 2.0 protocol compliance of the Azure AD User Provisioning service](application-provisioning-config-problem-scim-compatibility.md)
- [Problem configuring user provisioning to an Azure AD Gallery application](application-provisioning-config-problem.md)
- [Understand how provisioning integrates with Azure Monitor logs](application-provisioning-log-analytics.md)
- [Application provisioning in quarantine status](application-provisioning-quarantine-status.md)
- [Check the status of user provisioning](application-provisioning-when-will-provisioning-finish-specific-user.md)

- [Skip deletion of user accounts that go out of scope in Azure Active Directory](skip-out-of-scope-deletions.md)
- [No users are being provisioned](application-provisioning-config-problem-no-users-provisioned.md)
- [Known issues and resolutions with SCIM 2.0 protocol compliance of the Azure AD User Provisioning service](application-provisioning-config-problem-scim-compatibility.md)
- [Problem configuring user provisioning to an Azure AD Gallery application](troubleshoot.md)
- [Understand how provisioning integrates with Azure Monitor logs](application-provisioning-log-analytics.md)
- [Application provisioning in quarantine status](application-provisioning-quarantine-status.md)
- [Check the status of user provisioning](application-provisioning-when-will-provisioning-finish-specific-user.md)

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files