📋 Microsoft Entra Documentation Changes

---

title: Global Secure Access and Universal Tenant Restrictions

ms.service: global-secure-access

ms.topic: how-to

ms.date: 02/21/2025

---

# Universal tenant restrictions

 

 

 

 

The following table explains the steps taken at each point in the previous diagram.

 

| Step | Description |

| --- | --- |

 

| Enforce attestation set to Yes | Enforce attestation set to No |

|--------------------------------|-------------------------------|

 

>[!NOTE]

>Vendors are responsible to publish all root attestation certificates to the FIDO Alliance MDS; otherwise, attestation verification can fail.

 

## FIDO2 security keys eligible for attestation with Microsoft Entra ID

 

 

Description|AAGUID|Bio|USB|NFC|BLE

-----------|------|---|---|---|---

Cryptnox FIDO2|9c835346-796b-4c27-8898-d6032f515cc5|❌|❌|✅|❌

Cryptnox FIDO2.1|1d1b4e33-76a1-47fb-97a0-14b10d0933f1|❌|❌|✅|❌

Dapple Authenticator from Dapple Security Inc.|6dae43be-af9c-417b-8b9f-1b611168ec60|❌|❌|❌|❌

Deepnet SafeKey/Classic (USB)|b9f6b7b6-f929-4189-bca9-dd951240c132|❌|❌|❌|❌

ms.subservice: external

ms.topic: concept-article

ms.author: mimart

ms.custom: it-pro, seo-july-2024

 

|**Custom claims provider**| [Custom authentication extension](~/identity-platform/custom-extension-overview.md) that calls an external REST API, to fetch claims from external systems. | Same as workforce. [Learn more](../../identity-platform/custom-claims-provider-overview.md)|

|**Security groups**| [Configure groups optional claims](../../identity-platform/optional-claims.md#configure-groups-optional-claims). |[Configure groups optional claims](../../identity-platform/optional-claims.md#configure-groups-optional-claims) are limited to the group object ID.|

| **Token lifetimes**| You can [specify the lifetime](../../identity-platform/configurable-token-lifetimes.md) of security tokens issued by the Microsoft Entra ID.| Same as workforce.|

 

## Microsoft Graph APIs

 

# Microsoft Entra Suite services and integration partners

* [Microsoft Entra ID Governance](../id-governance/identity-governance-overview.md)

* [Microsoft Global Secure Access](../global-secure-access/overview-what-is-global-secure-access.md)

|---|---|

|Accenture|Accenture's Microsoft Entra Suite offering is distinguished by its exceptional global delivery capabilities, advanced technical expertise, and proven proficiency. As Microsoft's 19-time Global Systems Integrator Partner of the Year award recipient, Accenture provides state-of-the-art solutions and seamless integration, positioning itself as the foremost partner for all enterprise requirements. |

|[Armis](https://www.armisgroup.com/services/it-services/security-and-identity/identity/)|Armis, applying over 20 years of digital transformation expertise, provides global tech solutions as a trusted Microsoft partner. We specialize in security, data and AI, also business applications, delivering innovative solutions that boost efficiency and sustainable growth. By using the comprehensive capabilities of the Microsoft Entra Suite, Armis supports businesses in adopting Zero Trust principles. This effort fortifies their security posture and enabling a resilient, future-ready infrastructure. |

|[Atea](https://www.atea.se/eshop/campaigns/microsoft-entra-suite)|Atea is the largest Microsoft partner in the Nordic and Baltic regions. We are specialized in providing our customers with professional services around Microsoft Entra. With our license specialists and certified experts, we make sure that our customers get the full value out of the components in the Microsoft Entra Suite. |

|[Avande](https://www.avanade.com/en/services/microsoft-tech/microsoft-security/advanced-identity)|Avanade's asset-driven approach to the Microsoft Entra Suite harnesses a robust Microsoft Entra ID Governance content library, complete with repeatable lifecycle workflows, and advanced assets for Microsoft Entra Verified ID. It also features accelerated methodologies for Security Service Edge (SSE), streamlining adoption and migration from legacy solutions. This distinctive strategy boosts security, improves operational efficiency, and speeds up transformation. |

|[baseVISION AG](https://www.basevision.ch/our-solutions/identity-management-solutions/)|baseVISION is a leading Microsoft Security Partner focused on secure and modern endpoint management. Our Microsoft Entra ID Governance services enable companies to transform their identity and access management (IAM) processes around the globe, in a more efficient and modern way, and at an enterprise scale. We combine exceptional knowledge with practical experience, thanks to our focused company strategy and partnership with Microsoft. |

|[Paramount](https://paramountassure.com/microsoft-entra/)|Paramount Computer Systems is a cybersecurity leader in the Middle East geography, backed by over 20 years of expertise in identity and access management (IAM). Paramount partners strategically with Microsoft for advanced identity solutions such as Paramount Identity 360, powered by the Microsoft Entra Suite. Our IAM subject-matter experts implemented successful identity governance, access management, access recertification, verified identity, and global secure access. This work was for enterprises, small, medium, corporate (SMC), and small-to-medium business (SMB) customers. Our team excels at custom development, and integrating complex legacy environments, ensuring a seamless identity modernization journey. |

|[Protiviti](https://www.protiviti.com/us-en/microsoft-consulting-solutions)|Protiviti offers innovative solutions to modernize digital identity management through the powerful capabilities of the Microsoft Entra Suite. Our tailored solutions empower your identity modernization journey transitioning on-premises identities, applications, authentication, and devices to Microsoft Entra. We apply robust access security and governance through cutting-edge technologies such as risk-based Microsoft Entra Conditional Access and Microsoft Global Secure Access. |

|[PwC](https://www.pwc.com/us/en/technology/alliances/microsoft/cybersecurity.html)|PwC's differentiated approach tailors delivery by using custom accelerators for strategic planning, deployment, and managed services to enhance identity security and support Zero Trust frameworks. We offer end-to-end strategic and technical services to implement the Microsoft Entra Suite. The offering encompasses Microsoft Entra ID Protection, Microsoft Entra ID Governance, Microsoft Entra Verified ID, workloads, and Security Service Edge (SSE).|

|[Ravenswood Technology Group](https://www.ravenswoodtechnology.com/microsoft-technologies/identity-and-access-solutions/microsoft-entra-suite-overview/)|Ravenswood brings decades of identity expertise to your initiative. Our team excels at integrating complex enterprise systems, both on premises, and in the cloud. Ravenswood helps organizations around the world, including some of the most recognized brand names, tackle challenging identity, security, and compliance challenges. |

|[SB Technology Corp.](https://www.softbanktech.co.jp/service/list/microsoft365/e5-security)|Integrating Entra Suite via SB Technology's service provides a robust security framework, protecting against sophisticated cyber threats. Key features include multi-factor authentication (MFA), identity protection, and risk-based conditional access, ensuring comprehensive security management tailored to your organization's needs. |

---

title: B2B Invitation Redemption

ms.topic: concept-article

ms.author: cmulligan

author: csmulligan

manager: celestedg

 

[!INCLUDE [applies-to-workforce-only](./includes/applies-to-workforce-only.md)]

 

 

When you add a guest user to your directory, the guest user account has a consent status (viewable in PowerShell) that’s initially set to **PendingAcceptance**. This setting remains until the guest accepts your invitation and agrees to your privacy policy and terms of use. After that, the consent status changes to **Accepted**, and the consent pages are no longer presented to the guest.

 

 

Guest users can now sign in to your multitenant or Microsoft first-party apps through a common endpoint (URL), for example `https://myapps.microsoft.com`. Previously, a common URL would redirect a guest user to their home tenant instead of your resource tenant for authentication, so a tenant-specific link was required (for example `https://myapps.microsoft.com/?tenantid=<tenant id>`). Now the guest user can go to the application's common URL, choose **Sign-in options**, and then select **Sign in to an organization**. The user then types the domain name of your organization.

 

---

author: csmulligan

ms.author: cmulligan

manager: celestedg

ms.subservice: external

ms.topic: how-to

ms.custom: it-pro

 

#Customer intent: As a dev, devops, or it admin, I want to learn about how to add customized browser languages to my app's authentication experience.

---

 

[!INCLUDE [applies-to-external-only](../includes/applies-to-external-only.md)]

 

> [!TIP]

### Create a memberOf dynamic group

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](~/identity/role-based-access-control/permissions-reference.md#user-administrator).

1. Select **New group**.

1. Fill in group details. The group type can be **Security** or **Microsoft 365**, and the membership type can be set to **Dynamic User** or **Dynamic Device**.

1. Select **Add dynamic query**.

1. Select **OK**.

1. Select **Create group**.

---

author: owinfreyatl

manager: femila

editor: HANKI

---

 

 

 

The Microsoft Entra Suite provides capabilities to govern who can access restricted websites. Microsoft Entra Internet Access protects access to SaaS apps and Entitlement management enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration.

 

author: henrymbuguakiarie

manager: CelesteDG

ms.author: henrymbugua

ms.reviewer: jmprieur

ms.service: identity-platform

 

| An app that runs natively on a mobile device or desktop machine | Node.js electron, Windows desktop, UWP, React Native, Android, iOS/macOS | Mobile and desktop applications |

 

If you're building an iOS app using one of the following methods, use the **Mobile and desktop applications** platform to add a redirect URI:

- iOS apps using open source SDKs (AppAuth)

- iOS apps using cross-plat tech we don't support (Flutter)

- iOS apps implementing our OAuth protocols directly

author: cilwerner

manager: CelesteDG

ms.author: cwerner

ms.devlang: java

ms.reviewer: shoatman

ms.service: identity-platform

 

The MSAL account ID isn't an account object ID. It isn't meant to be parsed and/or relied upon to convey anything other than uniqueness within the Microsoft identity platform.

 

 

```java

// The following would always retrieve the same account object for [email protected] because each identifier is valid

- PIM alerts for Microsoft Entra roles in Microsoft Graph API - Preview.

- PIM alerts for Azure Resources in ARM API - Preview.

 

Having PIM for Microsoft Entra roles in Microsoft Graph API and PIM for Azure Resources in ARM API provide a few benefits including:

- Alignment of the PIM APIs for regular role assignment for both Microsoft Entra roles and Azure Resource roles.

- Reducing the need to call other PIM APIs to onboard a resource, get a resource, or get role definition.

 

## Next steps

 

For organizations that have no established use of device code flow, blocking can be done with the following Conditional Access policy:

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).

1. Select **New policy**.

1. Under **Assignments**, select **Users or workload identities**.

1. Under **Include**, select the users you want to be in-scope for the policy (**all users** recommended).

Use the **Authentication flows** condition in Conditional Access to manage the feature. You might want to block [authentication transfer](concept-authentication-transfer.md) if you don’t want users to transfer authentication from their PC to a mobile device. For example, if you don’t allow Outlook to be used on personal devices by certain groups. Blocking authentication transfer can be done with the following Conditional Access policy:

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).

1. Select **Create new policy**.

1. Under **Assignments**, select **Users or workload identities**.

1. Under **Include**, select **All users** or user groups you would like to block for authentication transfer.

In this tutorial, set up SSPR for a set of users in a test group. Use the *SSPR-Test-Group* and provide your own Microsoft Entra group as needed:

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](~/identity/role-based-access-control/permissions-reference.md#authentication-policy-administrator).

1. From the **Properties** page, under the option *Self service password reset enabled*, choose **Selected**.

1. If your group isn't visible, choose **No groups selected**, browse for and select your Microsoft Entra group, like *SSPR-Test-Group*, and then choose *Select*.

 

 

1. To apply the notification preferences, select **Save**.

 

 

1. From the menu on the left side of the **Customization** page, set **Customize helpdesk link** to *Yes*.

1. In the **Custom helpdesk email or URL** field, provide an email address or web page URL where your users can get more help from your organization, like *https:\//support.contoso.com/*

$messageInfo.customizedMessageBody = "Hello. You are invited to the Contoso organization."

 

foreach ($email in $invitations) {

-InvitedUserEmailAddress $email.InvitedUserEmailAddress `

-InvitedUserDisplayName $email.Name `

-InviteRedirectUrl https://myapplications.microsoft.com/?tenantid=aaaabbbb-0000-cccc-1111-dddd2222eeee `

 

In this tutorial, you sent bulk invitations to guest users outside of your organization. Next, learn how to bulk invite guest users on the portal and how to enforce MFA for them.

 

author: rwike77

manager: CelesteDG

ms.author: ryanwi

ms.date: 04/10/2024

ms.reviewer: ludwignick

ms.service: identity-platform

 

If your app reuses authorization codes to get tokens for multiple resources, we recommend that you use the code to get a refresh token, and then use that refresh token to acquire additional tokens for other resources. Authorization codes can only be used once, but refresh tokens can be used multiple times across multiple resources. Any new app that attempts to reuse an authentication code during the OAuth code flow will get an invalid_grant error.

 

 

## May 2018