📋 Microsoft Entra Documentation Changes

Changes for May 19th 2025

Period: May 18th 2025, 12:00 AM to May 19th 2025, 12:00 AM

📚 Historical Report: This report shows documentation changes that occurred during the 24-hour period ending on May 19th 2025.

📊 Summary

8
Total Commits
0
New Files
4
Modified Files
0
Deleted Files
5
Contributors

📝 Modified Documentation Files

+36 / -37 lines changed
Commit: Update how-to-authentication-track-linkable-identifiers.md
Changes:
Before
After
title: Track and investigate identity activities with linkable identifiers in Microsoft Entra (preview)
description: Discover how linkable identifiers like session IDs and unique token identifiers in Microsoft Entra help track and investigate identity-related activities, enhancing security and transparency.
ms.topic: conceptual
ms.date: 03/28/2025
ms.author: justinha
author: vimrang
manager: femila
 
# Track and investigate identity activities with linkable identifiers in Microsoft Entra (preview)
 
## Overview
 
Microsoft embeds specific identifiers in all access tokens that enable the correlation of activities back to a single root authentication event. These linkable identifiers are surfaced in customer-facing logs to support threat hunters and security analysts in investigating and mitigating identity-based attacks. By leveraging these identifiers, security professionals can more effectively trace, analyze, and respond to malicious activity across sessions and tokens, enhancing both the transparency and security of the environment.
 
There are two types of linkable identifiers used to to support advanced identity investigation and threat hunting scenarios:
 
**Session ID (SID)-Based Identifier**
The SID-based identifier enables correlation of all authentication artifacts such as [access token (AT)](/entra/identity-platform/access-tokens), [refresh token (RT)](/entra/identity-platform/refresh-tokens), and session cookies issued from a single root authentication event. This identifier is especially useful for tracking activity across a session.
 
Common SID-based investigation scenarios include:
title: Track and investigate identity activities with linkable identifiers in Microsoft Entra (preview)
description: Discover how linkable identifiers like session IDs and unique token identifiers in Microsoft Entra help track and investigate identity-related activities, enhancing security and transparency.
ms.topic: conceptual
ms.date: 05/17/2025
ms.author: justinha
author: vimrang
manager: femila
 
# Track and investigate identity activities with linkable identifiers in Microsoft Entra (preview)
 
Microsoft embeds specific identifiers in all access tokens that enable the correlation of activities back to a single root authentication event. These linkable identifiers are surfaced in customer-facing logs to support threat hunters and security analysts in investigating and mitigating identity-based attacks. By leveraging these identifiers, security professionals can more effectively trace, analyze, and respond to malicious activity across sessions and tokens, enhancing both the transparency and security of the environment.
 
## Types of linkable identifiers
 
There are two types of linkable identifiers used to to support advanced identity investigation and threat hunting scenarios: session ID-based identifiers and unique token identifiers.
 
### Session ID-based identifiers
An identifier based on session ID (SID-based identifier) enables correlation of all authentication artifacts such as [access token (AT)](/entra/identity-platform/access-tokens), [refresh token (RT)](/entra/identity-platform/refresh-tokens), and session cookies issued from a single root authentication event. This identifier is especially useful for tracking activity across a session.
 
Common SID-based investigation scenarios include:
+43 / -23 lines changed
Commit: ExternalTenantNotFound error
Changes:
Before
After
 
It can take up to 15 seconds for the configuration that you just created to appear in the list.
 
On the Configurations page for cross-cloud synchronization, the tenant ID and name will be empty.
 
::: zone-end
 
 
Follow the steps in [Step 3: Automatically redeem invitations in the target tenant](#step-3-automatically-redeem-invitations-in-the-target-tenant) and [Step 4: Automatically redeem invitations in the source tenant](#step-4-automatically-redeem-invitations-in-the-source-tenant).
 
#### Symptom - Automatic redemption checkbox is disabled
 
When configuring cross-tenant synchronization, the **Automatic redemption** checkbox is disabled.
 
Then you can use [provisionOnDemand with PowerShell](/graph/api/synchronization-synchronizationjob-provisionondemand?tabs=powershell#request) for each user. The rate limit for this API is 5 requests per 10 seconds. For more information, see [Known limitations for on-demand provisioning](/entra/identity/app-provisioning/provision-on-demand?pivots=cross-tenant-synchronization#known-limitations).
 
::: zone pivot="cross-cloud-synchronization"
 
#### Symptom - Test connection fails with AzureActiveDirectoryTokenExpired
 
 
It can take up to 15 seconds for the configuration that you just created to appear in the list.
 
On the Configurations page for cross-cloud synchronization, the **Tenant Name** and **Tenant ID** columns will be empty.
 
::: zone-end
 
 
Follow the steps in [Step 3: Automatically redeem invitations in the target tenant](#step-3-automatically-redeem-invitations-in-the-target-tenant) and [Step 4: Automatically redeem invitations in the source tenant](#step-4-automatically-redeem-invitations-in-the-source-tenant).
 
::: zone pivot="cross-cloud-synchronization"
 
#### Symptom - Test connection fails with ExternalTenantNotFound
 
When configuring cross-cloud synchronization in the source tenant and you test the connection, it fails with the following error message:
 
```
You appear to have entered invalid credentials. Please confirm you are using the correct information for an administrative account.
Error code: ExternalTenantNotFound
Details: This tenant was not found by the authentication authority of the current cloud: <targetTenantId>. The authentication authority is https://login.microsoftonline.com/<targetTenantId>.
Modified by James Barnett on May 18, 2025 7:38 AM
📖 View on learn.microsoft.com
+9 / -9 lines changed
Commit: numbered list to bulleted
Changes:
Before
After
Microsoft Entra terms of use is designed to function optimally on the following platforms and browsers.
 
Supported desktop and mobile operating systems (latest stable versions):
1. Windows
1. macOS
1. Linux
1. Android
1. iOS
Supported modern web browsers (latest stable versions):
1. Microsoft Edge
1. Mozilla Firefox
1. Google Chrome
1. Safari
 
### Functionality on other configurations
Users on operating systems or browsers not listed above, or those using older versions of supported operating systems or browsers, may still be able to accept terms of use during the sign-in process. However, please be aware that some features, visual rendering, or performance may be degraded. We do not actively test or provide support for operating systems and browsers not explicitly listed as supported. This includes, but is not limited to, browsers based on legacy engines such as EdgeHTML (found in Legacy Edge) and Trident/MSHTML (found in Internet Explorer).
Microsoft Entra terms of use is designed to function optimally on the following platforms and browsers.
 
Supported desktop and mobile operating systems (latest stable versions):
* Windows
* macOS
* Linux
* Android
* iOS
Supported modern web browsers (latest stable versions):
* Microsoft Edge
* Mozilla Firefox
* Google Chrome
* Safari
 
### Functionality on other configurations
Users on operating systems or browsers not listed above, or those using older versions of supported operating systems or browsers, may still be able to accept terms of use during the sign-in process. However, please be aware that some features, visual rendering, or performance may be degraded. We do not actively test or provide support for operating systems and browsers not explicitly listed as supported. This includes, but is not limited to, browsers based on legacy engines such as EdgeHTML (found in Legacy Edge) and Trident/MSHTML (found in Internet Explorer).
+2 / -1 lines changed
Commit: Group public membership limitation
Changes:
Before
After
ms.service: entra-id
ms.topic: conceptual
ms.subservice: role-based-access-control
ms.date: 06/13/2024
ms.author: rolyon
ms.custom: oldportal;it-pro;
---
 
- The restricted management setting must be applied during administrative unit creation and can't be changed once the administrative unit is created.
- Groups and users in a restricted management administrative unit can't be managed with Microsoft Entra ID Governance features such as [Privileged Identity Management](../../id-governance/privileged-identity-management/groups-discover-groups.md), [Entitlement management](../../id-governance/entitlement-management-overview.md), [Lifecycle workflows](../../id-governance/what-are-lifecycle-workflows.md) and [Access reviews](../../id-governance/access-reviews-overview.md).
- Role-assignable groups, when added to a restricted management administrative unit, can't have their membership modified. Group owners aren't allowed to manage groups in restricted management administrative units and only Global Administrators and Privileged Role Administrators (neither of which can be assigned at administrative unit scope) can modify membership.
- Certain actions might not be possible when an object is in a restricted management administrative unit, if the required role isn't one of the roles that can be assigned at administrative unit scope. For example, a Global Administrator in a restricted management administrative unit can't have their password reset by any other administrator in the system, because there's no admin role that can be assigned at the administrative unit scope that can reset the password of a Global Administrator. In such scenarios, the Global Administrator would need to be removed from the restricted management administrative unit first, and then have their password reset by another Global Administrator or Privileged Role Administrator.
- When deleting a restricted management administrative unit, it can take up to 30 minutes to remove all protections from the former members.
 
ms.service: entra-id
ms.topic: conceptual
ms.subservice: role-based-access-control
ms.date: 05/19/2025
ms.author: rolyon
ms.custom: oldportal;it-pro;
---
 
- The restricted management setting must be applied during administrative unit creation and can't be changed once the administrative unit is created.
- Groups and users in a restricted management administrative unit can't be managed with Microsoft Entra ID Governance features such as [Privileged Identity Management](../../id-governance/privileged-identity-management/groups-discover-groups.md), [Entitlement management](../../id-governance/entitlement-management-overview.md), [Lifecycle workflows](../../id-governance/what-are-lifecycle-workflows.md) and [Access reviews](../../id-governance/access-reviews-overview.md).
- When a group is configured to have public membership (by setting the [visibility](/graph/api/resources/group#properties) property to `Public`), users can join the group by using [self-service group membership](../users/groups-self-service-management.md). This configuration is not the default setting, and it is not recommended to configure groups in restricted management administrative units to allow for public membership. This is a temporary limitation and will be removed.
- Role-assignable groups, when added to a restricted management administrative unit, can't have their membership modified. Group owners aren't allowed to manage groups in restricted management administrative units and only Global Administrators and Privileged Role Administrators (neither of which can be assigned at administrative unit scope) can modify membership.
- Certain actions might not be possible when an object is in a restricted management administrative unit, if the required role isn't one of the roles that can be assigned at administrative unit scope. For example, a Global Administrator in a restricted management administrative unit can't have their password reset by any other administrator in the system, because there's no admin role that can be assigned at the administrative unit scope that can reset the password of a Global Administrator. In such scenarios, the Global Administrator would need to be removed from the restricted management administrative unit first, and then have their password reset by another Global Administrator or Privileged Role Administrator.
- When deleting a restricted management administrative unit, it can take up to 30 minutes to remove all protections from the former members.