📋 Microsoft Entra Documentation Changes

## Kerberos SSO MDM profile configuration

You must configure a Kerberos SSO MDM profile. Use the following settings, ensuring that you replace all references to **contoso.com** and **Contoso** with the proper values for your environment:

| `preferredKDCs` | `<string>kkdcp://login.microsoftonline.com/contoso.com/kerberos</string>` | Replace the **contoso.com** value with the value of one of your tenant domains or your tenant's GUID |

| `Hosts` | `<string>contoso.com</string>` | Replace **contoso.com** with your on-premises domain/forest name |

| `Hosts` | `<string>*.contoso.com</string>` | Replace **contoso.com** with your on-premises domain/forest name. Keep the preceding `*.` characters before your domain/forest name |

ms.date: 05/02/2025

The following table includes each FIDO2 security key model listed in MDS version 156 that's eligible for attestation with Microsoft Entra ID. For each model, the table shows its Authenticator Attestation Globally Unique Identifier (AAGUID) and feature capabilities.

- At least the [Catalog owner](../id-governance/entitlement-management-delegate.md#entitlement-management-roles) role of the catalog where the custom extension will be created.

1. Browse to **Identity governance** > **Entitlement management** > **Catalogs**.

1. Select **Add a custom extension** and add a name and description for the custom extension. When finished, select **Next**.

ms.date: 04/29/2025

This report now includes applications that authenticate *to* or are authenticated *by* other Microsoft Cloud Services applications in your tenant. These applications might appear in this report but when you select the link for an application, the results say "Not found." This message indicates that the application was only instantiated in your tenant, meaning only an instance of it appears in this report to indicate a service-to-service authentication. The application itself doesn't have a service principal in your tenant. We realize that this message might cause confusion and are working to improve the experience.

ms.date: 05/05/2025

Calculated offline. This risk detection type indicates that the user's valid credentials leaked. When cybercriminals compromise valid passwords of legitimate users, they often share these gathered credentials. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. When the Microsoft leaked credentials service acquires user credentials from the dark web, paste sites, or other sources, they're checked against Microsoft Entra users' current valid credentials to find valid matches. For more information about leaked credentials, see the [FAQs](id-protection.yml.#leaked-credentials).

ms.date: 04/28/2025

`[https://hootsuite.com/login](https://hootsuite.com/login?method=sso)`

> We recommend that you use Privileged Identity Management to provide just-in-time access to a user to perform a task that requires elevated permissions. These permissions are provided through the Microsoft Entra Roles, that are tagged as “privileged”, in our documentation here: Microsoft Entra built-in roles. Entitlement Management is better suited for assigning users a bundle of resources, which can include a Microsoft Entra role, necessary to do one’s job. Users assigned to access packages tend to have more longstanding access to resources. While we recommend that you manage high-privileged roles through Privileged Identity Management, you can set up eligibility for those roles through access packages in Entitlement Management.