Microsoft Entra Documentation Changes

MODIFIED docs/identity/saas-apps/darwinbox-hr-integration-tutorial.md

Modified by jenniferf-skc on May 8, 2025 6:34 AM
📖 View on learn.microsoft.com

+13 / -10 lines changed

Commit: Fixing broken links and images

Changes:

Before

After

## Install connectors in Darwinbox Studio
Open Darwinbox studio and navigate to Connector Library. Search for and install the “Microsoft” and “Microsoft Entra” connectors: 
 
:::image type="content" border="true" source="/media/darwinbox-hr-integration-tutorial/darwinbox-studio.png" alt-text="Screenshot of Darwinbox Studio.":::
 
## Create single-tenant app registration
Next, create a single-tenant app registration and provide the credentials to Darwinbox so they can perform actions like creating the provisioning job and sending user data to your Entra tenant.
Go to the Entra portal, select **App Registrations**, and then select **New registration**. Create a single-tenant app as shown below:
< image: Register an application >
 
Add the following three Microsoft Graph application permissions to let Darwinbox create the provisioning job, send user data, and review the provisioning logs:
 
:::image type="content" border="true" source="/media/darwinbox-hr-integration-tutorial/entra-id-darwinbox-register.png" alt-text="Screenshot of Microsoft Entra ID registering with Darwinbox.":::
 
Create a client secret and provide the credentials to Darwinbox as specified in their guide.
 
 
To sync custom attributes from Darwinbox to Entra, update the attribute mapping for the provisioning job in the Entra portal. 
 
:::image type="content" border="true" source="/media/darwinbox-hr-integration-tutorial/entra-id-attribute-mapping.png" alt-text="Screenshot of Microsoft Entra ID mapping page.":::

## Install connectors in Darwinbox Studio
Open Darwinbox studio and navigate to Connector Library. Search for and install the “Microsoft” and “Microsoft Entra” connectors: 
 
:::image type="content" border="true" source="./media/darwinbox-hr-integration-tutorial/darwinbox-studio.png" alt-text="Screenshot of Darwinbox Studio.":::
 
## Create single-tenant app registration
Next, create a single-tenant app registration and provide the credentials to Darwinbox so they can perform actions like creating the provisioning job and sending user data to your Entra tenant.
Go to the Entra portal, select **App Registrations**, and then select **New registration**. Create a single-tenant app as shown below:
 
:::image type="content" border="true" source="./media/darwinbox-hr-integration-tutorial/entra-id-darwinbox-register.png" alt-text="Screenshot of Microsoft Entra ID Register an application page.":::
 
Add the following three Microsoft Graph application permissions to let Darwinbox create the provisioning job, send user data, and review the provisioning logs:
 
:::image type="content" border="true" source="./media/darwinbox-hr-integration-tutorial/entra-id-darwinbox-register.png" alt-text="Screenshot of Microsoft Entra ID registering with Darwinbox.":::
 
Create a client secret and provide the credentials to Darwinbox as specified in their guide.
 
To sync custom attributes from Darwinbox to Entra, update the attribute mapping for the provisioning job in the Entra portal.

MODIFIED docs/id-governance/custom-entitlement-report-with-adx-and-entra-id.md

Modified by Mark Wahl on May 8, 2025 11:12 AM
📖 View on learn.microsoft.com

+10 / -6 lines changed

Commit: update get ARA

Changes:

Before

After

        $createdDateTime = $_.CreatedDateTime -replace "\\/Date\((\d+)\)\\/", '$1' 
        # Convert the milliseconds timestamp to a readable date format if necessary 
        $result += [PSCustomObject]@{ 
          AppRoleId      = $_.AppRoleId 
          CreatedDateTime   = $createdDateTime 
          PrincipalDisplayName = $_.PrincipalDisplayName 
          PrincipalId     = $_.PrincipalId 
          ResourceDisplayName = $_.ResourceDisplayName 
          ResourceId      = $_.ResourceId 
          SnapshotDate     = $SnapshotDate
        } 
      } 
 
 
 
 

        $createdDateTime = $_.CreatedDateTime -replace "\\/Date\((\d+)\)\\/", '$1' 
        # Convert the milliseconds timestamp to a readable date format if necessary 
        $result += [PSCustomObject]@{ 
          Id = $_.Id
          AppRoleId      = $_.AppRoleId
          CreatedDateTime   = $createdDateTime
          PrincipalDisplayName = $user.DisplayName
          PrincipalId     = $user.Id
          AssignmentPrincipalType = $_.PrincipalType
          AssignmentPrincipalDisplayName = $_.PrincipalDisplayName
          AssignmentPrincipalId     = $_.PrincipalId
          ResourceDisplayName = $_.ResourceDisplayName
          ResourceId      = $_.ResourceId
          SnapshotDate     = $SnapshotDate
        } 
      } 

MODIFIED docs/id-governance/entitlement-management-dynamic-approval.md

Modified by Ortagus Winfrey on May 8, 2025 4:26 AM
📖 View on learn.microsoft.com

+7 / -7 lines changed

Commit: updates

Changes:

Before

After

1. On the Add an Action pane, select **HTTP**.
 
1. On the **HTTP** pane under Parameters, enter the following parameters:
    URI: https://graph.microsoft.com/beta@{triggerBody()?['CallbackUriPath']}
    Method: POST
    Body: Your own custom logic data based on the parameters you want to query for. For more information, see: [Call external HTTP or HTTPS endpoints from workflows in Azure Logic Apps](/azure/connectors/connectors-native-http?tabs=standard). For an example of the body action see: [HTTP action example](entitlement-management-dynamic-approval.md#http-action-example).
    Authentication Type: Managed identity
    Managed Identity: System-assigned managed identity
    Audience: https://graph.microsoft.com
1. Under HTTP Settings, disable **Asynchronous Pattern**. 
    :::image type="content" source="media/entitlement-management-dynamic-approval/disable-asynchronous-pattern.png" alt-text="Screenshot of disabling asynchronous pattern in a logic app http call.":::
1. After you've made changes to the HTTP trigger, select **Save**. 
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Catalog owner](../id-governance/entitlement-management-delegate.md#entitlement-management-roles) of the catalog where the custom extension is located.
    > [!TIP]
    > Other least privilege roles that can complete this task include the the Access package manager, Access package assignment manager, and Identity Governance Administrator.
1. Browse to **ID Governance** > **Entitlement management** > **Access package**.
 
1. On the Access packages page, open the access package you want to view requests of.

1. On the Add an Action pane, select **HTTP**.
 
1. On the **HTTP** pane under Parameters, enter the following parameters:
    - URI: https://graph.microsoft.com/beta@{triggerBody()?['CallbackUriPath']}
    - Method: POST
    - Body: Your own custom logic data based on the parameters you want to query for. For more information, see: [Call external HTTP or HTTPS endpoints from workflows in Azure Logic Apps](/azure/connectors/connectors-native-http?tabs=standard). For an example of the body action see: [HTTP action example](entitlement-management-dynamic-approval.md#http-action-example).
    - Authentication Type: Managed identity
    - Managed Identity: System-assigned managed identity
    - Audience: https://graph.microsoft.com
1. Under HTTP Settings, disable **Asynchronous Pattern**. 
    :::image type="content" source="media/entitlement-management-dynamic-approval/disable-asynchronous-pattern.png" alt-text="Screenshot of disabling asynchronous pattern in a logic app http call.":::
1. After you've made changes to the HTTP trigger, select **Save**. 
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Catalog owner](../id-governance/entitlement-management-delegate.md#entitlement-management-roles) of the catalog where the custom extension is located.
    > [!TIP]
    > Other least privilege roles that can complete this task include the Access package manager, Access package assignment manager, and Identity Governance Administrator.
1. Browse to **ID Governance** > **Entitlement management** > **Access package**.
 
1. On the Access packages page, open the access package you want to view requests of.

MODIFIED docs/identity/authentication/howto-authentication-methods-activity.md

Modified by Miguel Ferreira on May 8, 2025 5:42 AM
📖 View on learn.microsoft.com

+7 / -6 lines changed

Commit: Learn Editor: Update howto-authentication-methods-activity.md

Changes:

Before

After

1. There are two tabs in the report: **Registration** and **Usage**.
 
   ![Authentication Methods Activity overview](media/how-to-authentication-methods-usage-insights/registration-usage-tabs.png)
 
## Registration details
 
You can access the **Registration** tab to show the number of users capable of multifactor authentication, passwordless authentication, and self-service password reset. 
  This number doesn't reflect users registered for MFA outside of Microsoft Entra ID. 
- **Users capable of passwordless authentication** shows the breakdown of users who are registered to sign in without a password by using FIDO2, Windows Hello for Business, or passwordless Phone sign-in with the Microsoft Authenticator app. 
- **Users capable of self-service password reset** shows the breakdown of users who can reset their passwords. Users can reset their password if they're both:
  - Registered for enough methods to satisfy their organization's policy for self-service password reset 
  - Enabled to reset their password 
 
  ![Screenshot of users who can register](media/how-to-authentication-methods-usage-insights/users-capable.png)
 
**Users registered by authentication method** shows how many users are registered for each authentication method. Click an authentication method to see who is registered for that method.
 
![Screenshot of Users Registered](media/how-to-authentication-methods-usage-insights/users-registered.png)
- Last Updated Time (The date and time when the report most recently updated. This value is not related the user's authentication method registration.)
 

1. There are two tabs in the report: **Registration** and **Usage**.
 
   ![Authentication Methods Activity overview](media/how-to-authentication-methods-usage-insights/registration-usage-tabs.png)
   
## Registration details
 
You can access the **Registration** tab to show the number of users capable of multifactor authentication, passwordless authentication, and self-service password reset. 
  This number doesn't reflect users registered for MFA outside of Microsoft Entra ID. 
- **Users capable of passwordless authentication** shows the breakdown of users who are registered to sign in without a password by using FIDO2, Windows Hello for Business, or passwordless Phone sign-in with the Microsoft Authenticator app. 
- **Users capable of self-service password reset** shows the breakdown of users who can reset their passwords. Users can reset their password if they're both:
- Registered for enough methods to satisfy their organization's policy for self-service password reset 
  - Enabled to reset their password 
 
  ![Screenshot of users who can register](media/how-to-authentication-methods-usage-insights/users-capable.png)
  
**Users registered by authentication method** shows how many users are registered for each authentication method. Click an authentication method to see who is registered for that method.
 
![Screenshot of Users Registered](media/how-to-authentication-methods-usage-insights/users-registered.png)
- Last Updated Time (The date and time when the report most recently updated. This value is not related the user's authentication method registration.)
 

MODIFIED docs/global-secure-access/troubleshoot-connectors.md

Modified by Ken Withee on May 8, 2025 4:58 AM
📖 View on learn.microsoft.com

+6 / -6 lines changed

Commit: Update troubleshoot-connectors.md

Changes:

Before

After

 
## Verify machine and backend component certificate support
 
**Objective:** Verify that the connector machine, backend proxy, and firewall can support the certificate created by the connector. Also, verify the certificate is valid.
 
>[!NOTE]
>The connector tries to create a `SHA512` cert that is supported by Transport Layer Security (TLS) 1.2. If the machine or the backend firewall and proxy does not support TLS 1.2, the installation fails.
 
**Review the prerequisites required:**
 
</ConnectorTrustSettingsFile>
```
 
The possible **IsInUserStore** values are **true** and **false**. A value of **true** means the certificate is automatically renewed and stored in the personal container in the user certificate store of the Network Service. A value of **false** means the client certificate is created during the installation or registration initiated by `Register-MicrosoftEntraPrivateNetworkConnector`. The certificate is stored in the personal container in the certificate store of the local machine.
 
If the value is **true**, follow these steps to verify the certificate:
1. Download [PsTools.zip](/sysinternals/downloads/pstools).
2. Extract [PsExec](/sysinternals/downloads/psexec) from the package and run **psexec -i -u "nt authority\network service" cmd.exe** from an elevated command prompt.
3. Run **certmgr.msc** in the newly appeared command prompt.
4. In the management console, expand the Personal container and select on Certificates.

 
## Verify machine and backend component certificate support
 
**Objective:** Verify that the connector machine, backend proxy, and firewall support the certificate the connector created. Also, verify the certificate is valid.
 
>[!NOTE]
>The connector tries to create a `SHA512` cert that supports Transport Layer Security (TLS) 1.2. If the machine or the backend firewall and proxy does not support TLS 1.2, the installation fails.
 
**Review the prerequisites required:**
 
</ConnectorTrustSettingsFile>
```
 
The possible **IsInUserStore** values are **true** and **false**. A value of **true** means the certificate is automatically renewed and stored in the personal container in the user certificate store of the Network Service. A value of **false** means the client certificate is created during the installation or registration `Register-MicrosoftEntraPrivateNetworkConnector` initiates. The certificate is stored in the personal container in the certificate store of the local machine.
 
If the value is **true**, follow these steps to verify the certificate:
1. Download [PsTools.zip](/sysinternals/downloads/pstools).
2. Extract [PsExec](/sysinternals/downloads/psexec) from the package and run **psexec -i -u "nt authority\network service" cmd.exe** from an elevated command prompt.
3. Run **certmgr.msc** in the newly appeared command prompt.
4. In the management console, expand the Personal container and select on Certificates.

MODIFIED docs/identity/devices/device-join-macos-platform-single-sign-on-kerberos-configuration.md

Modified by Michael Epping on May 8, 2025 9:29 AM
📖 View on learn.microsoft.com

+6 / -5 lines changed

Commit: Update device-join-macos-platform-single-sign-on-kerberos-configuration.md

Changes:

Before

After

</plist>
```
 
> [!NOTE]
> Make sure you pay attention to the usePlatformSSOTGT and performKerberosOnly keys.
> If usePlatformSSOTGT is set to true, the Kerberos Extension uses the TGT from Platform SSO with the same realm. The default is false.
> If performKerberosOnly is set to true, the Kerberos extension doesn't perform password expiration checks, external password change checks, or retrieve the user’s home directory. The default is false.
 
Save the configuration using a text editor with the *mobileconfig* file extension (for example, the file could be named *on-prem-kerberos.mobileconfig*) after updating the configuration with the proper values for your environment.
 
## Kerberos SSO MDM profile configuration for Microsoft Entra ID Cloud Kerberos
 
Save the configuration using a text editor with the *mobileconfig* file extension (for example, the file could be named *cloud-kerberos.mobileconfig*) after updating the configuration with the proper values for your environment.
 
## Intune configuration steps
 
If you use Intune as your MDM, you can perform the following steps to deploy the profile. Make sure you follow the [previous instructions](#Kerberos SSO MDM profile configuration for on-premises Active Directory) about replacing **contoso.com** values with the proper values for your organization.
 

</plist>
```
 
Save the configuration using a text editor with the *mobileconfig* file extension (for example, the file could be named *on-prem-kerberos.mobileconfig*) after updating the configuration with the proper values for your environment.
 
## Kerberos SSO MDM profile configuration for Microsoft Entra ID Cloud Kerberos
 
Save the configuration using a text editor with the *mobileconfig* file extension (for example, the file could be named *cloud-kerberos.mobileconfig*) after updating the configuration with the proper values for your environment.
 
> [!NOTE]
> Make sure you pay attention to the usePlatformSSOTGT and performKerberosOnly keys.
> If usePlatformSSOTGT is set to true, the Kerberos Extension uses the TGT from Platform SSO with the same realm. The default is false.
> If performKerberosOnly is set to true, the Kerberos extension doesn't perform password expiration checks, external password change checks, or retrieve the user’s home directory. The default is false.
> This is applicable to both the on-premises and cloud configurations, these keys should be configured in both profiles.
 
## Intune configuration steps
 
If you use Intune as your MDM, you can perform the following steps to deploy the profile. Make sure you follow the [previous instructions](#Kerberos SSO MDM profile configuration for on-premises Active Directory) about replacing **contoso.com** values with the proper values for your organization.

MODIFIED docs/external-id/customers/how-to-customize-branding-customers.md

Modified by csmulligan on May 8, 2025 1:45 AM
📖 View on learn.microsoft.com

+2 / -7 lines changed

Commit: Updated images.

Changes:

Before

After

 
ms.subservice: external
ms.topic: how-to
ms.date: 01/07/2025
ms.author: cmulligan
ms.custom: it-pro
 
- [Create a user flow](how-to-user-flow-sign-up-sign-in-customers.md)
- Review the file size requirements for each image you want to add. You may need to use a photo editor to create the right-sized images. The preferred image type for all images is PNG, but JPG is accepted.
 
 
 
<a name='comparing-the-default-sign-in-experiences-between-the-external-tenant-and-the-azure-ad-tenant'></a>
 
## Branding elements
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Organizational Branding Administrator](~/identity/role-based-access-control/permissions-reference.md#organizational-branding-administrator).
1. If you have access to multiple tenants, use the **Settings** icon :::image type="icon" source="media/common/admin-center-settings-icon.png" border="false"::: in the top menu to switch to the external tenant you created earlier from the **Directories + subscriptions** menu.
1. Browse to **Company Branding** either by using the search bar or by navigating to **Home** > **Tenant overview** > **Customize branding**.
 

 
ms.subservice: external
ms.topic: how-to
ms.date: 05/07/2025
ms.author: cmulligan
ms.custom: it-pro
 
- [Create a user flow](how-to-user-flow-sign-up-sign-in-customers.md)
- Review the file size requirements for each image you want to add. You may need to use a photo editor to create the right-sized images. The preferred image type for all images is PNG, but JPG is accepted.
 
<a name='comparing-the-default-sign-in-experiences-between-the-external-tenant-and-the-azure-ad-tenant'></a>
 
## Branding elements
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Organizational Branding Administrator](~/identity/role-based-access-control/permissions-reference.md#organizational-branding-administrator).
1. If you have access to multiple tenants, use the **Settings** icon :::image type="icon" source="media/common/admin-center-settings-icon.png" border="false"::: in the top menu to switch to the external tenant you created earlier from the **Directories + subscriptions** menu.
1. Browse to **Company branding** either by using the search bar or by navigating to **Identity** > **User experiences** > **Company branding**.
1. On the **Default sign-in** tab, select **Edit**.
 
   :::image type="content" source="media/how-to-customize-branding-customers/company-branding-default-edit-button.png" alt-text="Screenshot of the company branding edit button.":::

MODIFIED docs/external-id/customers/concept-authentication-methods-customers.md

Modified by Michele Martin on May 8, 2025 5:14 AM
📖 View on learn.microsoft.com

+2 / -5 lines changed

Commit: Remove preview tags for SAML WS-Fed IdP GA

Changes:

Before

After

 
ms.subservice: external
ms.topic: concept-article
ms.date: 03/12/2025
ms.author: mimart
ms.custom: it-pro, seo-july-2024
#customer intent: As an External ID administrator, I want to configure and enable multiple identity providers (such as email one-time passcode, Google, Facebook, Apple, SAML/WS-Fed, and custom OIDC) for external users, so that they can easily sign in and access our apps and resources.
The following screenshots show the sign-in with Apple experience. In the sign-in page, users select **Sign-in with Apple**. Then the user is redirected to the Apple identity provider to complete the sign-in.
Learn how to [add Apple as an identity provider](how-to-apple-federation-customers.md).
 
## Custom SAML/WS-Fed identity providers (preview)
 
You can set up a SAML or WS-Fed identity provider to allow users to sign up and sign in to your applications using their own account with the identity provider. The user can sign up or sign in by selecting the **Sign up with** or **Sign in with** option. They're redirected to the identity provider, and then returned to Microsoft Entra once they successfully sign in. For external tenants, a user's sign-in email doesn't need to match the predefined domains set up during SAML federation. As a result, updating the federation setup by adding, changing, or removing domains won't affect the experience for existing users.
 
 
For more information, see [SAML/WS-Fed identity providers](../direct-federation-overview.md). For detailed setup steps, see [Add federation with SAML/WS-Fed identity providers](../direct-federation.md).
 
> [!NOTE]
> SAML/WS-Fed federation is generally available for workforce tenants.
 

 
ms.subservice: external
ms.topic: concept-article
ms.date: 05/07/2025
ms.author: mimart
ms.custom: it-pro, seo-july-2024
#customer intent: As an External ID administrator, I want to configure and enable multiple identity providers (such as email one-time passcode, Google, Facebook, Apple, SAML/WS-Fed, and custom OIDC) for external users, so that they can easily sign in and access our apps and resources.
The following screenshots show the sign-in with Apple experience. In the sign-in page, users select **Sign-in with Apple**. Then the user is redirected to the Apple identity provider to complete the sign-in.
Learn how to [add Apple as an identity provider](how-to-apple-federation-customers.md).
 
## Custom SAML/WS-Fed identity providers
 
You can set up a SAML or WS-Fed identity provider to allow users to sign up and sign in to your applications using their own account with the identity provider. The user can sign up or sign in by selecting the **Sign up with** or **Sign in with** option. They're redirected to the identity provider, and then returned to Microsoft Entra once they successfully sign in. For external tenants, a user's sign-in email doesn't need to match the predefined domains set up during SAML federation. As a result, updating the federation setup by adding, changing, or removing domains won't affect the experience for existing users.
 
 
For more information, see [SAML/WS-Fed identity providers](../direct-federation-overview.md). For detailed setup steps, see [Add federation with SAML/WS-Fed identity providers](../direct-federation.md).
 
## Custom OIDC identity provider
 
You can set up a custom OpenID Connect (OIDC) identity provider to allow users to sign up and sign in to your applications using their credentials in the external identity provider. You can also federate your sign-in and sign-up flows with an Azure AD B2C tenant using the OIDC protocol.

MODIFIED docs/fundamentals/new-name.md

Modified by Celeste de Guzman on May 8, 2025 1:59 PM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: Scrubbed references to Entra Permissions Management

Changes:

Before

After

ms.service: entra
ms.subservice: fundamentals
ms.topic: concept-article
ms.date: 10/04/2024
ms.author: celested
ms.reviewer: nicholepet
 
| Identity and access management | New identity categories | Network access |
|---------|---------|---------|
| [Microsoft Entra ID (previously known as Azure AD)](../index.yml) | [Microsoft Entra Verified ID](~/verified-id/index.yml) | [Microsoft Entra Internet Access](https://aka.ms/GlobalSecureAccessDocs) |
| [Microsoft Entra ID Governance](~/id-governance/index.yml) | [Microsoft Entra Permissions Management](~/permissions-management/index.yml) | [Microsoft Entra Private Access](https://aka.ms/GlobalSecureAccessDocs) |
| [Microsoft Entra External ID](~/external-id/index.yml) | [Microsoft Entra Workload ID](~/workload-id/index.yml) |  |
 
### Where can I manage Microsoft Entra ID?
|       | Azure Active Directory External Identities<br/> Azure AD External Identities | Microsoft Entra External ID<br/> (Second use: External ID) |
|       | Azure Active Directory Identity Governance<br/> Azure AD Identity Governance<br/> Microsoft Entra Identity Governance | Microsoft Entra ID Governance<br/> (Second use: ID Governance) |
|       | *New* | Microsoft Entra Internet Access<br/> (Second use: Internet Access) |
|       | Cloud Knox | Microsoft Entra Permissions Management<br/> (Second use: Permissions Management) |
|       | *New* | Microsoft Entra Private Access<br/> (Second use: Private Access) |
|       | Azure Active Directory Verifiable Credentials<br/> Azure AD Verifiable Credentials | Microsoft Entra Verified ID<br/> (Second use: Verified ID) |

ms.service: entra
ms.subservice: fundamentals
ms.topic: concept-article
ms.date: 05/07/2025
ms.author: celested
ms.reviewer: nicholepet
 
| Identity and access management | New identity categories | Network access |
|---------|---------|---------|
| [Microsoft Entra ID (previously known as Azure AD)](../index.yml) | [Microsoft Entra Verified ID](~/verified-id/index.yml) | [Microsoft Entra Internet Access](https://aka.ms/GlobalSecureAccessDocs) |
| [Microsoft Entra ID Governance](~/id-governance/index.yml) |  | [Microsoft Entra Private Access](https://aka.ms/GlobalSecureAccessDocs) |
| [Microsoft Entra External ID](~/external-id/index.yml) | [Microsoft Entra Workload ID](~/workload-id/index.yml) |  |
 
### Where can I manage Microsoft Entra ID?
|       | Azure Active Directory External Identities<br/> Azure AD External Identities | Microsoft Entra External ID<br/> (Second use: External ID) |
|       | Azure Active Directory Identity Governance<br/> Azure AD Identity Governance<br/> Microsoft Entra Identity Governance | Microsoft Entra ID Governance<br/> (Second use: ID Governance) |
|       | *New* | Microsoft Entra Internet Access<br/> (Second use: Internet Access) |
|       | *New* | Microsoft Entra Private Access<br/> (Second use: Private Access) |
|       | Azure Active Directory Verifiable Credentials<br/> Azure AD Verifiable Credentials | Microsoft Entra Verified ID<br/> (Second use: Verified ID) |
|       | Azure Active Directory Workload Identities<br/> Azure AD Workload Identities | Microsoft Entra Workload ID<br/> (Second use: Workload ID) |

MODIFIED docs/external-id/direct-federation-overview.md

Modified by Michele Martin on May 8, 2025 5:14 AM
📖 View on learn.microsoft.com

+1 / -4 lines changed

Commit: Remove preview tags for SAML WS-Fed IdP GA

Changes:

Before

After

 
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 02/21/2025
 
ms.author: mimart
author: msmimart
 
Setting up SAML/WS-Fed IdP federation requires configuration both in your tenant and in the external organization's IdP. In some cases, the partner needs to update their DNS text records. They also need to update their IdP with the required claims and relying party trusts.
 
> [!NOTE]
> SAML/WS-Fed federation is currently in preview for external tenants and is generally available for workforce tenants.
 
## User authentication with SAML/WS-Fed IdP federation
 
Once you set up federation with a partner's SAML/WS-Fed IdP, users can sign up or sign in by selecting the **Sign up with** or **Sign in with** option. They're redirected to the identity provider, and then returned to Microsoft Entra once they successfully sign in.

 
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 05/07/2025
 
ms.author: mimart
author: msmimart
 
Setting up SAML/WS-Fed IdP federation requires configuration both in your tenant and in the external organization's IdP. In some cases, the partner needs to update their DNS text records. They also need to update their IdP with the required claims and relying party trusts.
 
## User authentication with SAML/WS-Fed IdP federation
 
Once you set up federation with a partner's SAML/WS-Fed IdP, users can sign up or sign in by selecting the **Sign up with** or **Sign in with** option. They're redirected to the identity provider, and then returned to Microsoft Entra once they successfully sign in.

MODIFIED docs/external-id/direct-federation.md

Modified by Michele Martin on May 8, 2025 5:14 AM
📖 View on learn.microsoft.com

+1 / -4 lines changed

Commit: Remove preview tags for SAML WS-Fed IdP GA

Changes:

Before

After

 
ms.service: entra-external-id
ms.topic: how-to
ms.date: 02/21/2025
 
ms.author: mimart
author: msmimart
[!INCLUDE [applies-to-workforce-external](./includes/applies-to-workforce-external.md)]
 
Your Microsoft Entra tenant can be directly federated with external organizations that use a SAML or WS-Fed identity provider (IdP). Users from the external organization can then use their own IdP-managed accounts to sign in to your apps or resources, either during invitation redemption or self-service sign-up, without having to create new Microsoft Entra credentials. The user is redirected to their IdP when signing up or signing in to your app, and then returned to Microsoft Entra once they successfully sign in. 
<!-- Do we need to break down the preview status further by tenant type and invitation vs. SSSU? -->
> [!NOTE]
> SAML/WS-Fed federation is currently in preview for external tenants and is generally available for workforce tenants.
 
## Prerequisites
 

 
ms.service: entra-external-id
ms.topic: how-to
ms.date: 05/07/2025
 
ms.author: mimart
author: msmimart
[!INCLUDE [applies-to-workforce-external](./includes/applies-to-workforce-external.md)]
 
Your Microsoft Entra tenant can be directly federated with external organizations that use a SAML or WS-Fed identity provider (IdP). Users from the external organization can then use their own IdP-managed accounts to sign in to your apps or resources, either during invitation redemption or self-service sign-up, without having to create new Microsoft Entra credentials. The user is redirected to their IdP when signing up or signing in to your app, and then returned to Microsoft Entra once they successfully sign in. 
 
## Prerequisites

MODIFIED docs/architecture/architecture.md

Modified by Celeste de Guzman on May 8, 2025 10:04 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Updated overview intro per mktg fdback and updated metadata

Changes:

Before

After

 
# What is the Microsoft Entra architecture?
 
Microsoft Entra ID enables you to securely manage user access to Azure services and resources. Included with Microsoft Entra ID is a full suite of identity management capabilities. For information about Microsoft Entra features, see [What is Microsoft Entra ID?](~/fundamentals/whatis.md)
 
With Microsoft Entra ID, you can create and manage users and groups, and enable permissions to allow and deny access to enterprise resources. For information about identity management, see The [fundamentals of Azure identity management](~/fundamentals/whatis.md).
 
<a name='azure-ad-architecture'></a>

 
# What is the Microsoft Entra architecture?
 
Microsoft Entra enables you to securely manage user access to services and resources. Included with Microsoft Entra is a family of identity management and network access capabilities. For information about Microsoft Entra features, see [What is Microsoft Entra?](~/fundamentals/whatis.md)
 
With Microsoft Entra, you can create and manage users and groups, and enable permissions to allow and deny access to enterprise resources. For information about identity management, see the [fundamentals of identity management](~/fundamentals/whatis.md).
 
<a name='azure-ad-architecture'></a>

MODIFIED docs/external-id/b2b-fundamentals.md

Modified by Michele Martin on May 8, 2025 5:14 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Remove preview tags for SAML WS-Fed IdP GA

Changes:

Before

After

 
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 10/29/2024
ms.author: cmulligan
author: csmulligan
manager: celestedg
| Restrict guest user access to the directory  | By default, guest users have limited access to your Microsoft Entra directory. They can manage their own profile and see some information about other users, groups, and apps. You can further restrict access so that guests can see only their own profile information. Learn more about [default guest permissions](~/fundamentals/users-default-permissions.md) and how to configure [external collaboration settings](external-collaboration-settings-configure.md).  |
| Determine who can invite guests  | By default, all users in your organization, including B2B collaboration guest users, can invite external users to B2B collaboration. If you want to limit the ability to send invitations, you can turn invitations on or off for everyone, or limit invitations to certain roles by configuring [external collaboration settings](external-collaboration-settings-configure.md).  |
| Use tenant restrictions to control how external accounts are used on your networks and managed devices. | With tenant restrictions, you can prevent your users from using accounts they've created in unknown tenants or accounts they've received from external organizations. We recommend you disallow these accounts and use B2B collaboration instead.  |
| For an optimal sign-in experience, federate with identity providers | Whenever possible, federate directly with identity providers to allow invited users to sign in to your shared apps and resources without having to create Microsoft Accounts (MSAs) or Microsoft Entra accounts. You can use the [Google federation feature](google-federation.md) to allow B2B guest users to sign in with their Google accounts. Or, you can use the [SAML/WS-Fed identity provider (preview) feature](direct-federation.md) to set up federation with any organization whose identity provider (IdP) supports the SAML 2.0 or WS-Fed protocol. |
| Use the Email one-time passcode  feature for B2B guests who can’t authenticate by other means | The [Email one-time passcode](one-time-passcode.md) feature authenticates B2B guest users when they can't be authenticated through other means like Microsoft Entra ID, a Microsoft account (MSA), or Google federation. When the guest user redeems an invitation or accesses a shared resource, they can request a temporary code, which is sent to their email address. Then they enter this code to continue signing in. |
| Add company branding to your sign-in page | You can customize your sign-in page so it's more intuitive for your B2B guest users. See how to [add company branding to sign in and Access Panel pages](~/fundamentals/how-to-customize-branding.md). |
| Add your privacy statement to the B2B guest user redemption experience | You can add the URL of your organization's privacy statement to the first time invitation redemption process so that an invited user must consent to your privacy terms to continue. See [How-to: Add your organization's privacy info in Microsoft Entra ID](~/fundamentals/properties-area.yml). |

 
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 05/07/2025
ms.author: cmulligan
author: csmulligan
manager: celestedg
| Restrict guest user access to the directory  | By default, guest users have limited access to your Microsoft Entra directory. They can manage their own profile and see some information about other users, groups, and apps. You can further restrict access so that guests can see only their own profile information. Learn more about [default guest permissions](~/fundamentals/users-default-permissions.md) and how to configure [external collaboration settings](external-collaboration-settings-configure.md).  |
| Determine who can invite guests  | By default, all users in your organization, including B2B collaboration guest users, can invite external users to B2B collaboration. If you want to limit the ability to send invitations, you can turn invitations on or off for everyone, or limit invitations to certain roles by configuring [external collaboration settings](external-collaboration-settings-configure.md).  |
| Use tenant restrictions to control how external accounts are used on your networks and managed devices. | With tenant restrictions, you can prevent your users from using accounts they've created in unknown tenants or accounts they've received from external organizations. We recommend you disallow these accounts and use B2B collaboration instead.  |
| For an optimal sign-in experience, federate with identity providers | Whenever possible, federate directly with identity providers to allow invited users to sign in to your shared apps and resources without having to create Microsoft Accounts (MSAs) or Microsoft Entra accounts. You can use the [Google federation feature](google-federation.md) to allow B2B guest users to sign in with their Google accounts. Or, you can use the [SAML/WS-Fed identity provider feature](direct-federation.md) to set up federation with any organization whose identity provider (IdP) supports the SAML 2.0 or WS-Fed protocol. |
| Use the Email one-time passcode  feature for B2B guests who can’t authenticate by other means | The [Email one-time passcode](one-time-passcode.md) feature authenticates B2B guest users when they can't be authenticated through other means like Microsoft Entra ID, a Microsoft account (MSA), or Google federation. When the guest user redeems an invitation or accesses a shared resource, they can request a temporary code, which is sent to their email address. Then they enter this code to continue signing in. |
| Add company branding to your sign-in page | You can customize your sign-in page so it's more intuitive for your B2B guest users. See how to [add company branding to sign in and Access Panel pages](~/fundamentals/how-to-customize-branding.md). |
| Add your privacy statement to the B2B guest user redemption experience | You can add the URL of your organization's privacy statement to the first time invitation redemption process so that an invited user must consent to your privacy terms to continue. See [How-to: Add your organization's privacy info in Microsoft Entra ID](~/fundamentals/properties-area.yml). |

MODIFIED docs/external-id/customers/concept-supported-features-customers.md

Modified by Michele Martin on May 8, 2025 5:14 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Remove preview tags for SAML WS-Fed IdP GA

Changes:

Before

After

 
ms.subservice: external
ms.topic: concept-article
ms.date: 04/03/2025
ms.author: mimart
ms.custom: it-pro, seo-july-2024
 
 
|Feature  |Workforce tenant  | External tenant |
|---------|---------|---------|
| **Identity providers for external users (primary authentication)** | **For self-service sign-up guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- Facebook federation<br></br>**For invited guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- SAML/WS-Fed federation | **For self-service sign-up users (consumers, business customers)**</br>- [Email with password](concept-authentication-methods-customers.md#email-and-password-sign-in)</br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)</br>- [Google federation (preview)](./how-to-google-federation-customers.md)</br>- [Facebook federation (preview)](./how-to-facebook-federation-customers.md)</br>- [Apple federation (preview)](./how-to-apple-federation-customers.md)</br>- [OIDC federation](./how-to-custom-oidc-federation-customers.md)<br></br>**For invited guests (preview)**</br>Guests invited with a directory role (for example, admins):</br>- Microsoft Entra accounts </br>- Microsoft accounts </br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)<br>- [SAML/WS-Fed federation](../direct-federation.md) |
|   **Authentication methods for MFA**  | **For internal users (employees and admins)** </br>- [Authentication and verification methods](~/identity/authentication/concept-authentication-methods.md) </br>**For guests (invited or self-service sign-up)** </br>- [Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users)  |  **For self-service sign-up users (consumers, business customers) or invited users (preview)**</br>- [Email one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</br>- [SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)    |
 
## Application registration

 
ms.subservice: external
ms.topic: concept-article
ms.date: 05/07/2025
ms.author: mimart
ms.custom: it-pro, seo-july-2024
 
 
|Feature  |Workforce tenant  | External tenant |
|---------|---------|---------|
| **Identity providers for external users (primary authentication)** | **For self-service sign-up guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- Facebook federation<br></br>**For invited guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- SAML/WS-Fed federation | **For self-service sign-up users (consumers, business customers)**</br>- [Email with password](concept-authentication-methods-customers.md#email-and-password-sign-in)</br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)</br>- [Google federation (preview)](./how-to-google-federation-customers.md)</br>- [Facebook federation (preview)](./how-to-facebook-federation-customers.md)</br>- [Apple federation (preview)](./how-to-apple-federation-customers.md)</br>- [OIDC federation](./how-to-custom-oidc-federation-customers.md)<br>- [SAML/WS-Fed federation](../direct-federation.md)<br></br>**For invited guests (preview)**</br>Guests invited with a directory role (for example, admins):</br>- Microsoft Entra accounts </br>- Microsoft accounts </br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)<br>- [SAML/WS-Fed federation](../direct-federation.md) |
|   **Authentication methods for MFA**  | **For internal users (employees and admins)** </br>- [Authentication and verification methods](~/identity/authentication/concept-authentication-methods.md) </br>**For guests (invited or self-service sign-up)** </br>- [Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users)  |  **For self-service sign-up users (consumers, business customers) or invited users (preview)**</br>- [Email one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</br>- [SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)    |
 
## Application registration

MODIFIED docs/external-id/customers/how-to-saml-ws-federation-self-service-sign-up.md

Modified by Michele Martin on May 8, 2025 5:14 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Remove preview tags for SAML WS-Fed IdP GA

Changes:

Before

After

 
ms.service: entra-external-id
ms.topic: how-to
ms.date: 02/21/2025
ms.author: mimart
author: msmimart
manager: celestedg
#customer intent: As an IT admin setting up federation with an external organization's SAML/WS-Fed identity provider, I want to invite users from that organization to sign in to my Microsoft Entra tenant with their work account.
---
 
# Add the SAML/WS-Fed identity provider to a user flow (preview)
 
[!INCLUDE [applies-to-external-only](../includes/applies-to-external-only.md)]
 

 
ms.service: entra-external-id
ms.topic: how-to
ms.date: 05/07/2025
ms.author: mimart
author: msmimart
manager: celestedg
#customer intent: As an IT admin setting up federation with an external organization's SAML/WS-Fed identity provider, I want to invite users from that organization to sign in to my Microsoft Entra tenant with their work account.
---
 
# Add the SAML/WS-Fed identity provider to a user flow
 
[!INCLUDE [applies-to-external-only](../includes/applies-to-external-only.md)]
 

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files