Microsoft Entra Documentation Changes

MODIFIED docs/identity/devices/howto-vm-sign-in-azure-ad-windows.md

Modified by mgreenegit on May 15, 2025 4:00 AM
📖 View on learn.microsoft.com

+206 / -232 lines changed

Commit: Draft adding Arc details to Entra sign in

Changes:

Before

After

---
title: Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID
description: Learn how to sign in to an Azure VM that's running Windows by using Microsoft Entra authentication.
 
ms.service: entra-id
ms.subservice: devices
ms.topic: how-to
ms.date: 10/21/2024
 
ms.author: owinfrey
author: owinfreyATL
manager: femila
ms.reviewer: sandeo
ms.custom: references_regions, devx-track-azurecli, subject-rbac-steps, has-azure-ad-ps-ref
---
 
# Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID including passwordless
 
Organizations can improve the security of Windows virtual machines (VMs) in Azure by integrating with Microsoft Entra authentication. You can now use Microsoft Entra ID as a core authentication platform to Remote Desktop Protocol (RDP) into *Windows Server 2019 Datacenter edition* and later, or *Windows 10 1809* and later. You can then centrally control and enforce Azure role-based access control (RBAC) and Conditional Access policies that allow or deny access to the VMs.
 

---
title: Sign in to Windows virtual machine in Azure or Arc-enabled Windows Server, using Microsoft Entra ID
description: Learn how to sign in to an Azure virtual machine or Arc-enabled Windows Server that's running Windows Server by using Microsoft Entra authentication.
 
ms.service: entra-id
ms.subservice: devices
ms.topic: how-to
ms.date: 05/13/2025
 
ms.author: owinfrey
author: owinfreyATL
manager: femila
ms.reviewer: sandeo
ms.custom: references_regions, devx-track-azurecli, subject-rbac-steps, has-azure-ad-ps-ref
zone_pivot_groups: identity-extension-windows-environment
---
 
# Sign in to Windows virtual machine in Azure or Arc-enabled Windows Server, using Microsoft Entra ID
 
Organizations can improve the security of Windows devices in Azure or connected using Azure Arc by integrating with Microsoft Entra authentication. You can now use Microsoft Entra ID as a core authentication platform to Remote Desktop Protocol (RDP) into *Windows Server 2019 Datacenter edition* and later, or *Windows 10 1809* and later. You can then centrally control and enforce Azure role-based access control (RBAC) and Conditional Access policies that allow or deny access to the devices.

MODIFIED docs/external-id/tenant-restrictions-v2.md

Modified by ShawnJackson on May 16, 2025 8:58 AM
📖 View on learn.microsoft.com

+162 / -160 lines changed

Commit: edit pass: articles-about-tenant-restrictions

Changes:

Before

After

manager: celestedg
ms.custom: it-pro
ms.collection: M365-identity-device-management
#customer intent: As an IT admin, I want to configure tenant restrictions v2 so that I can control access to external apps and enhance security for users signing in from my organization's networks or devices.
---
 
# Set up tenant restrictions v2
> [!NOTE]
> Certain features described in this article are preview features. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
 
To enhance security, you can limit what your users can access when they use an external account to sign in from your networks or devices. The **Tenant restrictions** settings, included with [cross-tenant access settings](cross-tenant-access-overview.md), let you create a policy to control access to external apps.
 
For example, suppose a user in your organization created a separate account in an unknown tenant, or an external organization gave your user an account that lets them sign in to their organization. You can use tenant restrictions to prevent the user from using some or all external apps while they're signed in with the external account on your network or devices.
 
| Step  | Description  |
|---------|---------|
|**1**     | Contoso configures tenant restrictions in its cross-tenant access settings to block all external accounts and external apps. Contoso adds enforcement signaling with the tenant restrictions v2 header via either [universal tenant restrictions v2](#option-1-universal-tenant-restrictions-v2-as-part-of-microsoft-entra-global-secure-access) or a [corporate proxy](#option-2-set-up-tenant-restrictions-v2-on-your-corporate-proxy). Microsoft Entra ID enforces the tenant restrictions v2 policy when the header is present on the request.      |
|**2**     |  A user who's using a Contoso-managed device tries to sign in to an external app by using an account from an unknown tenant. The tenant restrictions v2 HTTP header, with Contoso's tenant ID and the tenant restrictions policy ID, is added to the authentication request.        |
|**3**     | *Authentication plane protection:* Microsoft Entra ID enforces Contoso's tenant restrictions v2 policy and blocks external accounts from accessing external tenants during the authentication, in accordance with the Contoso tenant restrictions v2 policy.        |
|**4**     | *Data plane protection (preview):* Microsoft Entra ID blocks any anonymous access to Microsoft forms, SharePoint files, or Microsoft Teams meetings. Microsoft Entra ID also blocks user access to the resource with an infiltrated token.       |

manager: celestedg
ms.custom: it-pro
ms.collection: M365-identity-device-management
#customer intent: As an IT admin, I want to configure tenant restrictions v2 so that I can control access to external apps and enhance security for users who sign in from my organization's networks or devices.
---
 
# Set up tenant restrictions v2
> [!NOTE]
> Certain features described in this article are preview features. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
 
To enhance security, you can limit what your users can access when they use an external account to sign in from your networks or devices. The *tenant restrictions* settings, included with [cross-tenant access settings](cross-tenant-access-overview.md), let you create a policy to control access to external apps.
 
For example, suppose a user in your organization created a separate account in an unknown tenant, or an external organization gave your user an account that lets them sign in to their organization. You can use tenant restrictions to prevent the user from using some or all external apps while they're signed in with the external account on your network or devices.
 
| Step  | Description  |
|---------|---------|
|**1**     | Contoso configures tenant restrictions in its cross-tenant access settings to block all external accounts and external apps. Contoso adds enforcement signaling with the tenant restrictions v2 header via either [universal tenant restrictions v2](#option-1-universal-tenant-restrictions-v2-as-part-of-microsoft-entra-global-secure-access) or a [corporate proxy](#option-2-set-up-tenant-restrictions-v2-on-your-corporate-proxy). Microsoft Entra ID enforces the tenant restrictions v2 policy when the header is present on the request.      |
|**2**     |  The user of a Contoso-managed device tries to sign in to an external app by using an account from an unknown tenant. The tenant restrictions v2 HTTP header, with Contoso's tenant ID and the tenant restrictions policy ID, is added to the authentication request.        |
|**3**     | *Authentication plane protection:* Microsoft Entra ID enforces Contoso's tenant restrictions v2 policy and blocks external accounts from accessing external tenants during the authentication.        |
|**4**     | *Data plane protection (preview):* Microsoft Entra ID blocks any anonymous access to Microsoft Forms, SharePoint files, or Microsoft Teams meetings. Microsoft Entra ID also blocks user access to the resource with an infiltrated token.       |

MODIFIED docs/external-id/whats-new-docs.md

Modified by csmulligan on May 16, 2025 11:54 PM
📖 View on learn.microsoft.com

+67 / -16 lines changed

Commit: Hub update.

Changes:

Before

After

---
title: What's new in Microsoft Entra External ID
description: New and updated documentation for the Microsoft Entra External ID.
ms.date: 05/01/2025
ms.service: entra-external-id
ms.topic: whats-new
 
ms.author: cmulligan
author: csmulligan
manager: CelesteDG
# Customer intent: As a Microsoft Entra External ID user, I want to stay updated on the new documentation and significant updates, so that I can stay informed about the changes and improvements in the service.
---
 
# What's new in docs: External ID in workforce tenants
 
Welcome to what's new in documentation for Microsoft Entra External ID in workforce tenants. This article lists new docs that were added and docs that were significantly updated in the last three months. To learn what's new with the Microsoft Entra ID service, see [What's new in Microsoft Entra ID](~/fundamentals/whats-new.md).
 
## April 2025
 
### New article

---
title: What's new in Microsoft Entra External ID
description: New and updated documentation for the Microsoft Entra External ID.
ms.date: 04/01/2025
ms.service: entra-external-id
ms.topic: whats-new
 
ms.author: cmulligan
author: csmulligan
manager: CelesteDG
 
# Customer intent: As a Microsoft Entra External ID user, I want to stay updated on the new documentation and significant updates, so that I can stay informed about the changes and improvements in the service.
---
 
# What's new in docs: External ID
 
Welcome to what's new in documentation for Microsoft Entra External ID. This article lists new docs that were added and docs that were significantly updated in the last three months. To learn what's new with the Microsoft Entra ID service, see [What's new in Microsoft Entra ID](~/fundamentals/whats-new.md).
 
# [Workforce tenants](#tab/workforce-tenants)
 

MODIFIED docs/global-secure-access/reference-global-secure-access-certifications.md

Modified by jayrusso on May 16, 2025 8:44 AM
📖 View on learn.microsoft.com

+35 / -6 lines changed

Commit: May 15 added table draft

Changes:

Before

After

author: HULKsmashGithub
manager: femila
ms.topic: reference
ms.date: 03/20/2025
ms.service: global-secure-access
ms.reviewer: absinh
 
#customer intent: As an IT admin, I want to know which certifications Global Secure Access supports so that I can ensure compliance with industry standards.
 
---
# Global Secure Access certifications
To support your compliance needs across various regulated industries and global markets, Global Secure Access is actively pursuing certifications across numerous compliance offerings. This article lists the current certifications and is updated as new certifications are completed.
 
## Supported certifications
Global Secure Access is included in several Azure compliance audits. The supported certifications are:
- Service Organization Control (SOC)
- International Standards Organization (ISO)
- Payment Card Industry (PCI)
 
## Related content

author: HULKsmashGithub
manager: femila
ms.topic: reference
ms.date: 05/15/2025
ms.service: global-secure-access
ms.reviewer: abhijeetsinha
 
#customer intent: As an IT admin, I want to know which certifications Global Secure Access supports so that I can ensure compliance with industry standards.
 
---
# Global Secure Access certifications
Global Secure Access supports compliance across different regulated industries and global markets. This article lists the current certifications and updates the list as new certifications are completed.
 
## Supported certifications
Global Secure Access is included in several Azure compliance audits. The supported certifications are:
   
| Certification | Details | Inherited from | Status |
| --- | --- | --- | --- |
| [Canadian Privacy Laws](https://global.azure.com/auditmanager/certificates/views/cert/217) | Canadian privacy laws—such as the Privacy Act, Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta Personal Information Protection Act (PIPA), and British Columbia Freedom of Information and Protection of Privacy Act (BC FIPPA)—aim to protect the privacy of individuals and give them the right to access information gathered about them. For more information, see [Canadian Privacy Laws](/azure/compliance/offerings/offering-canada-privacy-laws) | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) |  |
| CDSA | The Content Delivery & Security Association (CDSA) Content Protection & Security (CPS) Standard provides guidance and requirements for securing media assets within a Content Security Management System (CSMS). The standard specifies a set of controls designed to ensure the integrity of intellectual property and the confidentiality and security of media assets at every stage of the digital media supply chain. For more information, see [Content Delivery & Security Association (CDSA) - Azure Compliance](/azure/compliance/offerings/offering-cdsa) | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | Certification available |

MODIFIED docs/external-id/customers/how-to-define-custom-attributes.md

Modified by Michele Martin on May 16, 2025 7:27 AM
📖 View on learn.microsoft.com

+18 / -18 lines changed

Commit: add info on hidden and editable flags

Changes:

Before

After

 
ms.subservice: external
ms.topic: how-to
ms.date: 05/14/2025
ms.author: mimart
ms.custom: it-pro
 
 
1. When all your changes are complete, select **Save**.
 
### Configure attribute visibility and editability during sign-up
 
You can control which attributes are shown or collected from users during sign-up by configuring the hidden and editable flags for each attribute. These settings are not currently available in the admin center UI, but you can configure them using Microsoft Graph.
 
Each attribute supports the following flags:
 
- `hidden`: Set to `true` to hide the attribute from the sign-up page, or `false` to display it.
- `editable`: Set to `true` to allow users to edit the attribute, or `false` to make it read-only.
 
Examples:

 
ms.subservice: external
ms.topic: how-to
ms.date: 05/15/2025
ms.author: mimart
ms.custom: it-pro
 
1. When all your changes are complete, select **Save**.
 
### Configure a single-select checkbox (CheckboxSingleSelect)
 
An attribute with a Boolean data type has a user input type of CheckboxSingleSelect. You can modify the text that displays next to the checkbox and include hyperlinks.
 
1. On the **Page layouts** page, select **Save**.
 
## Configure attribute visibility and editability with Microsoft Graph
 
You can control which attributes are shown or collected from users during sign-up by configuring the hidden and editable flags for each attribute. These settings are not currently available in the admin center UI, but you can configure them using Microsoft Graph.

MODIFIED docs/identity/multi-tenant-organizations/cross-tenant-synchronization-configure.md

Modified by rolyon on May 16, 2025 2:51 AM
📖 View on learn.microsoft.com

+7 / -7 lines changed

Commit: Moved check box permissions

Changes:

Before

After

 
    :::image type="content" source="./media/cross-tenant-synchronization-configure/access-settings-cross-cloud-sync.png" alt-text="Screenshot of Microsoft cloud settings that shows check box to enable cross-cloud synchronization." lightbox="./media/cross-tenant-synchronization-configure/access-settings-cross-cloud-sync.png":::
 
1. Select **Save**.
 
::: zone-end
 
    :::image type="content" source="./media/cross-tenant-synchronization-configure/configuration-name-cross-cloud-sync.png" alt-text="Screenshot of a new configuration that shows the name and cross-cloud synchronization check box." lightbox="./media/cross-tenant-synchronization-configure/configuration-name-cross-cloud-sync.png":::
 
    When you select this check box, it grants an underlying service principal the following permissions:
 
    - User.ReadWrite.CrossCloud
    - User.Invite.All
    - Organization.Read.All
    - Policy.Read.All
 
6. Select **Create**.
 
    It can take up to 15 seconds for the configuration that you just created to appear in the list.

 
    :::image type="content" source="./media/cross-tenant-synchronization-configure/access-settings-cross-cloud-sync.png" alt-text="Screenshot of Microsoft cloud settings that shows check box to enable cross-cloud synchronization." lightbox="./media/cross-tenant-synchronization-configure/access-settings-cross-cloud-sync.png":::
 
    When you select this check box, it grants an underlying service principal the following permissions:
 
    - User.ReadWrite.CrossCloud
    - User.Invite.All
    - Organization.Read.All
    - Policy.Read.All
 
1. Select **Save**.
 
::: zone-end
 
    :::image type="content" source="./media/cross-tenant-synchronization-configure/configuration-name-cross-cloud-sync.png" alt-text="Screenshot of a new configuration that shows the name and cross-cloud synchronization check box." lightbox="./media/cross-tenant-synchronization-configure/configuration-name-cross-cloud-sync.png":::
 
6. Select **Create**.
 
    It can take up to 15 seconds for the configuration that you just created to appear in the list.

MODIFIED docs/id-governance/entra-suite-scenario.md

Modified by Ortagus Winfrey on May 16, 2025 8:47 AM
📖 View on learn.microsoft.com

+7 / -6 lines changed

Commit: updates

Changes:

Before

After

---
title: Microsoft Entra Suite Scenario - Use Entitlement Management and Global Secure Access to restrict employee access to cloud apps 
description: Learn how you can use Entitlement Management and Global Secure Access to restrict employee access to cloud apps.
author: owinfreyatl
manager: femila
ms.service: entra-id-governance
---
 
 
# Microsoft Entra Suite Scenario: Use Entitlement Management and Global Secure Access to restrict employee access to cloud apps 
 
The Microsoft Entra Suite provides capabilities to govern who can access restricted websites. Microsoft Entra Internet Access protects access to SaaS apps and Entitlement management enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration.
 
In this scenario, you set up Global Secure Access and Conditional Access to block access to a specific unauthorized website such as an unsanctioned AI app, while using Entitlement Management to provide governed access to users who should be exempt from the policy. This scenario is useful for generative AI applications and other web applications that don't support provisioning or federation with Microsoft Entra.
 
:::image type="content" source="media/entra-suite-scenario/restrict-access-saas-app.png" alt-text="Screenshot of a diagram showing restricting software as a service app using conditional access and Global Secure Access.":::
 
 
1. Save the policy.
 

---
title: Microsoft Entra Suite Scenario - Use entitlement management and Global Secure Access to restrict employee access to cloud apps 
description: Learn how you can use entitlement management and Global Secure Access to restrict employee access to cloud apps.
author: owinfreyatl
manager: femila
ms.service: entra-id-governance
---
 
 
# Microsoft Entra Suite Scenario: Use entitlement management and Global Secure Access to restrict employee access to cloud apps 
 
The Microsoft Entra Suite provides capabilities to govern who can access restricted websites. Microsoft Entra Internet Access protects access to SaaS apps and entitlement management enables organizations to manage identity and access lifecycle at scale, by automating access request workflows, access assignments, reviews, and expiration.
 
In this scenario, you set up Global Secure Access and Conditional Access to block access to a specific unauthorized website such as an unsanctioned AI app, while using entitlement management to provide governed access to users who should be exempt from the policy. This scenario is useful for generative AI applications and other web applications that don't support provisioning or federation with Microsoft Entra.
 
:::image type="content" source="media/entra-suite-scenario/restrict-access-saas-app.png" alt-text="Screenshot of a diagram showing restricting software as a service app using conditional access and Global Secure Access.":::
 
 
1. Save the policy.
 

MODIFIED docs/identity/saas-apps/15five-tutorial.md

Modified by omondiatieno on May 16, 2025 8:44 PM
📖 View on learn.microsoft.com

+8 / -1 lines changed

Commit: BULK UPDATES - Replace common sso wizard content with centralized include file - Batch 1

Changes:

Before

After

* Manage your accounts in one central location.
 
## Prerequisites
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* 15Five single sign-on (SSO) enabled subscription.
 
## Scenario description
 
In this article,  you configure and test Microsoft Entra single sign-on in a test environment.
1. In the **Add from the gallery** section, type **15Five** in the search box.
1. Select **15Five** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides)
 
<a name='configure-and-test-azure-ad-sso-for-15five'></a>

* Manage your accounts in one central location.
 
## Prerequisites
 
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* 15Five single sign-on (SSO) enabled subscription.
 
 
## Prerequisites
 
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
 
## Scenario description
 
In this article,  you configure and test Microsoft Entra single sign-on in a test environment.
1. In the **Add from the gallery** section, type **15Five** in the search box.
1. Select **15Five** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 

MODIFIED docs/identity/authentication/concept-mfa-regional-opt-in.md

Modified by skylockw on May 16, 2025 4:45 AM
📖 View on learn.microsoft.com

+6 / -0 lines changed

Commit: Update concept-mfa-regional-opt-in.md

Changes:

Before

After

---
# Regions that need to opt in for MFA telephony verification  
 
As a protection for our customers, Microsoft doesn't automatically support telephony verification for certain region codes. If you want to receive traffic from phone numbers with these region codes, your administrator must submit a support ticket and request to opt in.  
 
## Why this protection is needed

---
# Regions that need to opt in for MFA telephony verification  
 
This applies to Entra tenants only.
 
For B2C tenants follow the guidelines here: [B2C service limits](https://learn.microsoft.com/en-us/azure/active-directory-b2c/service-limits)
 
For Entra External ID tenants follow the guidelines here: [How to region code opt-in](../../external-id/customers/how-to-region-code-opt-in.md)
 
As a protection for our customers, Microsoft doesn't automatically support telephony verification for certain region codes. If you want to receive traffic from phone numbers with these region codes, your administrator must submit a support ticket and request to opt in.  
 
## Why this protection is needed

MODIFIED docs/identity/saas-apps/hrworks-single-sign-on-tutorial.md

Modified by omondiatieno on May 16, 2025 9:35 PM
📖 View on learn.microsoft.com

+3 / -2 lines changed

Commit: BULK UPDATES - Replace sso wizard content with include file - Batch 12

Changes:

Before

After

ms.subservice: saas-apps
 
ms.topic: how-to
ms.date: 03/25/2024
ms.author: gideonkiratu
 
# Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and HRworks Single Sign-On so that I can control who has access to HRworks Single Sign-On, enable automatic sign-in with Microsoft Entra accounts, and manage my accounts in one central location.
* Manage your accounts in one central location.
 
## Prerequisites
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* HRworks Single Sign-On single sign-on (SSO) enabled subscription.
1. In the **Add from the gallery** section, type **HRworks Single Sign-On** in the search box.
1. Select **HRworks Single Sign-On** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides)
 
<a name='configure-and-test-azure-ad-sso-for-hrworks-single-sign-on'></a>
 

ms.subservice: saas-apps
 
ms.topic: how-to
ms.date: 05/16/2025
ms.author: gideonkiratu
 
# Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and HRworks Single Sign-On so that I can control who has access to HRworks Single Sign-On, enable automatic sign-in with Microsoft Entra accounts, and manage my accounts in one central location.
* Manage your accounts in one central location.
 
## Prerequisites
 
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* HRworks Single Sign-On single sign-on (SSO) enabled subscription.
1. In the **Add from the gallery** section, type **HRworks Single Sign-On** in the search box.
1. Select **HRworks Single Sign-On** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 [!INCLUDE [sso-wizard.md](~/identity/saas-apps/includes/sso-wizard.md)]
 
<a name='configure-and-test-azure-ad-sso-for-hrworks-single-sign-on'></a>

MODIFIED docs/identity/saas-apps/adpfederatedsso-tutorial.md

Modified by omondiatieno on May 16, 2025 8:44 PM
📖 View on learn.microsoft.com

+3 / -2 lines changed

Commit: BULK UPDATES - Replace common sso wizard content with centralized include file - Batch 1

Changes:

Before

After

* Manage your accounts in one central location.
 
## Prerequisites
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* ADP single sign-on (SSO) enabled subscription.
1. In the **Add from the gallery** section, type **ADP** in the search box.
1. Select **ADP** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides)
 
<a name='configure-and-test-azure-ad-sso-for-adp'></a>
 
1. In the **Add from the gallery** section, type **ADP** in the search box.
1. Select **ADP** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides)
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator).
1. Browse to **Entra ID** > **Enterprise apps**.

* Manage your accounts in one central location.
 
## Prerequisites
 
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* ADP single sign-on (SSO) enabled subscription.
1. In the **Add from the gallery** section, type **ADP** in the search box.
1. Select **ADP** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 [!INCLUDE [sso-wizard.md](~/identity/saas-apps/includes/sso-wizard.md)]
 
<a name='configure-and-test-azure-ad-sso-for-adp'></a>
 
1. In the **Add from the gallery** section, type **ADP** in the search box.
1. Select **ADP** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 [!INCLUDE [sso-wizard.md](~/identity/saas-apps/includes/sso-wizard.md)]
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator).

MODIFIED docs/global-secure-access/how-to-universal-tenant-restrictions.md

Modified by ShawnJackson on May 16, 2025 8:58 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: edit pass: articles-about-tenant-restrictions

Changes:

Before

After

| ---------- | ----------- | ------------ | ----------- | --------------- | ------- |
|`[email protected]`| Member | contoso.com | No(same tenant) | Yes | No |
|`[email protected]`|Member|fabrikam.com|Yes|Yes (tenant allowed by policy)|No|
|`[email protected]`|Member|northwinds.com|Yes|No (tenant not allowed by policy)|No|
|`[email protected]`|Member|contoso.com|No (same tenant)|Yes|No|
|`bob_northwinds.com#EXT#@contoso.com`|Guest|contoso.com|No (guest user)|Yes|No|
 
### Validate authentication plane protection
 

| ---------- | ----------- | ------------ | ----------- | --------------- | ------- |
|`[email protected]`| Member | contoso.com | No(same tenant) | Yes | No |
|`[email protected]`|Member|fabrikam.com|Yes|Yes (tenant allowed by policy)|No|
|`[email protected]`|Member|northwindtraders.com|Yes|No (tenant not allowed by policy)|No|
|`[email protected]`|Member|contoso.com|No (same tenant)|Yes|No|
|`bob_northwindtraders.com#EXT#@contoso.com`|Guest|contoso.com|No (guest user)|Yes|No|
 
### Validate authentication plane protection
 

MODIFIED docs/global-secure-access/how-to-configure-global-access-with-pim.md

Modified by Mohammad Zmaili on May 16, 2025 3:21 AM
📖 View on learn.microsoft.com

+3 / -1 lines changed

Commit: Update how-to-configure-global-access-with-pim.md

Changes:

Before

After

 
For the scenario where you need to control access to specific *critical* resources, such as highly valued servers and applications, Microsoft recommends that you add an extra security layer by enforcing just-in-time privileged access on top of their already secured private access. 
 
This article discusses how to use Microsoft Entra Private Access to enable Privileged Identity Management (PIM) with Global Secure Access. For details about enabling (PIM), see [What is Microsoft Entra Privileged Identity Management?](/entra/id-governance/privileged-identity-management/pim-configure). 
 
## Ensure secure access to your high value private applications

 
For the scenario where you need to control access to specific *critical* resources, such as highly valued servers and applications, Microsoft recommends that you add an extra security layer by enforcing just-in-time privileged access on top of their already secured private access. 
 
This article discusses how to use Microsoft Entra Private Access to enable Privileged Identity Management (PIM) with Global Secure Access. For details about enabling (PIM), see [What is Microsoft Entra Privileged Identity Management?](/entra/id-governance/privileged-identity-management/pim-configure). <br /><br />
 
> [!VIDEO https://www.youtube.com/embed/Wb6Bh2PbHaM]
 
## Ensure secure access to your high value private applications

MODIFIED docs/identity/enterprise-apps/manage-group-owner-consent-policies.md

Modified by omondiatieno on May 16, 2025 11:30 PM
📖 View on learn.microsoft.com

+1 / -2 lines changed

Commit: Remove irrelevant section

Changes:

Before

After

ms.subservice: enterprise-apps
 
ms.topic: how-to
ms.date: 08/25/2023
ms.author: jomondi
ms.reviewer: phsignor, yuhko
ms.custom: 
  - [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator)
  - A custom role with the necessary [permissions to manage group owner consent policies](~/identity/role-based-access-control/custom-consent-permissions.md#managing-app-consent-policies)
  - The Microsoft Graph app role (application permission) Policy.ReadWrite.PermissionGrant (when connecting as an app or a service)
- To allow group owner consent subject to app consent policies, the group owner consent setting must be disabled. Once disabled, your current policy is read from the app consent policy. To learn how to disable group owner consent, see [Disable group owner consent setting](configure-user-consent-groups.md)
 
:::zone pivot="ms-powershell"
 

ms.subservice: enterprise-apps
 
ms.topic: how-to
ms.date: 05/16/2025
ms.author: jomondi
ms.reviewer: phsignor, yuhko
ms.custom: 
  - [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator)
  - A custom role with the necessary [permissions to manage group owner consent policies](~/identity/role-based-access-control/custom-consent-permissions.md#managing-app-consent-policies)
  - The Microsoft Graph app role (application permission) Policy.ReadWrite.PermissionGrant (when connecting as an app or a service)
 
:::zone pivot="ms-powershell"
 
 

MODIFIED docs/identity/saas-apps/neustar-ultradns-tutorial.md

Modified by omondiatieno on May 16, 2025 9:50 PM
📖 View on learn.microsoft.com

+2 / -1 lines changed

Commit: BULK UPDATES - Replace sso wizard content with include file - Batch 17

Changes:

Before

After

* Manage your accounts in one central location.
 
## Prerequisites
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* Neustar UltraDNS single sign-on (SSO) enabled subscription.
1. In the **Add from the gallery** section, type **Neustar UltraDNS** in the search box.
1. Select **Neustar UltraDNS** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides)
 
<a name='configure-and-test-azure-ad-sso-for-neustar-ultradns'></a>
 
 

* Manage your accounts in one central location.
 
## Prerequisites
 
The scenario outlined in this article assumes that you already have the following prerequisites:
[!INCLUDE [common-prerequisites.md](~/identity/saas-apps/includes/common-prerequisites.md)]
* Neustar UltraDNS single sign-on (SSO) enabled subscription.
1. In the **Add from the gallery** section, type **Neustar UltraDNS** in the search box.
1. Select **Neustar UltraDNS** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
 
 [!INCLUDE [sso-wizard.md](~/identity/saas-apps/includes/sso-wizard.md)]
 
<a name='configure-and-test-azure-ad-sso-for-neustar-ultradns'></a>
 

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files

🗑️ Deleted Documentation Files