Microsoft Entra Documentation Changes

MODIFIED docs/global-secure-access/how-to-palo-alto-coexistence.md

Modified by Ken Withee on May 20, 2025 6:11 AM
📖 View on learn.microsoft.com

+651 / -48 lines changed

Commit: Adds content from Word conversion.

Changes:

Before

After

ms.author: kenwith
manager: femila
ms.topic: conceptual
ms.date: 02/21/2025
ms.service: global-secure-access
ms.subservice: entra-private-access 
ms.reviewer: shkhalid
 
# Learn about Security Service Edge (SSE) coexistence with Microsoft and Palo Alto Networks
 
Microsoft’s Security Service Edge solution provides a robust set of capabilities to increase security and improve performance of your Microsoft 365 products. Some of these capabilities include: 
 
- Prevent data moving to untrusted tenants.
- Verify users and conditions before giving access to the network.
- Revoke access to Microsoft 365 products when conditions change by using continuous access evaluation.
- Apply location-based Conditional Access, risk detection, and enhanced activity logs by taking advantage of source IP restoration.
- Protect Microsoft 365 apps against token infiltration and anonymous access.
 
These capabilities are unique to Microsoft Entra Internet Access for Microsoft 365. You can use these features for Microsoft 365 and use Palo Alto Networks Security Service Edge (SSE) solution at the same time. As a result, you harness a robust set of capabilities from both platforms to elevate your SSE journey. The synergy between these platforms empowers you with enhanced security and seamless connectivity. 
 

ms.author: kenwith
manager: femila
ms.topic: conceptual
ms.date: 05/19/2025
ms.service: global-secure-access
ms.subservice: entra-private-access 
ms.reviewer: shkhalid
 
# Learn about Security Service Edge (SSE) coexistence with Microsoft and Palo Alto Networks
 
# GSA + Palo Alto GlobalProtect Co-Existence Solutions Guide 
 
<table>
<colgroup>
<col style="width: 20%" />
<col style="width: 20%" />
<col style="width: 20%" />
<col style="width: 20%" />
<col style="width: 20%" />
</colgroup>

MODIFIED docs/external-id/tenant-restrictions-v2.md

Modified by ShawnJackson on May 20, 2025 4:33 AM
📖 View on learn.microsoft.com

+19 / -19 lines changed

Commit: edit pass: articles-about-tenant-restrictions

Changes:

Before

After

| Step  | Description  |
|---------|---------|
|**1**     | Contoso configures tenant restrictions in its cross-tenant access settings to block all external accounts and external apps. Contoso adds enforcement signaling with the tenant restrictions v2 header via either [universal tenant restrictions v2](#option-1-use-universal-tenant-restrictions-v2-as-part-of-microsoft-entra-global-secure-access) or a [corporate proxy](#option-2-set-up-tenant-restrictions-v2-on-your-corporate-proxy). Microsoft Entra ID enforces the tenant restrictions v2 policy when the header is present on the request.      |
|**2**     |  The user of a Contoso-managed device tries to sign in to an external app by using an account from an unknown tenant. The tenant restrictions v2 HTTP header, with Contoso's tenant ID and the tenant restrictions policy ID, is added to the authentication request.        |
|**3**     | *Authentication plane protection:* Microsoft Entra ID enforces Contoso's tenant restrictions v2 policy and blocks external accounts from accessing external tenants during the authentication.        |
|**4**     | *Data plane protection (preview):* Microsoft Entra ID blocks any anonymous access to Microsoft Forms, SharePoint files, or Microsoft Teams meetings. Microsoft Entra ID also blocks user access to the resource with an infiltrated token.       |
|||
 
| Feature |Tenant restrictions v1  |Tenant restrictions v2  |
|----------------------|---------|---------|
|**Policy enforcement**    | The corporate proxy enforces the tenant restrictions policy in the Microsoft Entra ID control plane.         |     Options: <br></br>- Universal tenant restrictions in Global Secure Access provide authentication plane support on all platforms. <br></br>- In corporate proxy header injection, the corporate proxy sets tenant restrictions v2 signals on all traffic. <br></br>- Windows device management provides both authentication plane and data plane protection. Devices are configured to point Microsoft traffic to the tenant restrictions policy. The policy is enforced in the cloud.     |
|**Policy enforcement limitation**    | You can manage corporate proxies by adding tenants to the Microsoft Entra traffic allowlist. The character limit of the header value in `Restrict-Access-To-Tenants: <allowed-tenant-list>` limits the number of tenants that you can add. |     This feature is managed by a cloud policy in the cross-tenant access policy. A default policy is created at the tenant level, and a partner policy is created for each external tenant.  |
|**Malicious tenant requests** | Microsoft Entra ID blocks malicious tenant authentication requests to provide authentication plane protection.         |    Microsoft Entra ID blocks malicious tenant authentication requests to provide authentication plane protection.     |
|**Granularity**           | This feature is limited to tenants and all Microsoft accounts.        |   This feature includes tenant, user, group, and application granularity. (User-level granularity isn't supported with Microsoft accounts.)      |
 
### Step 3: Enable tenant restrictions v2 on the corporate proxy
 
You can configure the corporate proxy to enable client-side tagging of the tenant restrictions V2 header by using the following corporate proxy setting: `sec-Restrict-Tenant-Access-Policy: <DirectoryID>:<policyGUID>`.
 
In that setting, replace `<DirectoryID>` with your Microsoft Entra tenant ID. Replace `<policyGUID>` with the object ID for your cross-tenant access policy.

| Step  | Description  |
|---------|---------|
|**1**     | Contoso configures tenant restrictions in its cross-tenant access settings to block all external accounts and external apps. Contoso adds enforcement signaling with the tenant restrictions v2 header via either [universal tenant restrictions v2](#option-1-use-universal-tenant-restrictions-v2-as-part-of-microsoft-entra-global-secure-access) or a [corporate proxy](#option-2-set-up-tenant-restrictions-v2-on-your-corporate-proxy). Microsoft Entra ID enforces the tenant restrictions v2 policy when the header is present on the request.      |
|**2**     |  The user of a Contoso-managed device tries to sign in to an external app by using an account from an unknown tenant. The tenant restrictions v2 HTTP header, with Contoso's tenant ID and the policy ID for tenant restrictions, is added to the authentication request.        |
|**3**     | *Authentication plane protection:* Microsoft Entra ID enforces Contoso's tenant restrictions v2 policy and blocks external accounts from accessing external tenants during the authentication.        |
|**4**     | *Data plane protection (preview):* Microsoft Entra ID blocks any anonymous access to Microsoft Forms, SharePoint files, or Microsoft Teams meetings. Microsoft Entra ID also blocks user access to the resource with an infiltrated token.       |
|||
 
| Feature |Tenant restrictions v1  |Tenant restrictions v2  |
|----------------------|---------|---------|
|**Policy enforcement**    | The corporate proxy enforces the tenant restrictions policy on the Microsoft Entra ID control plane.         |     Options: <br></br>- Universal tenant restrictions in Global Secure Access provide authentication plane support on all platforms. <br></br>- In corporate proxy header injection, the corporate proxy sets tenant restrictions v2 signals on all traffic. <br></br>- Windows device management provides both authentication plane and data plane protection. Devices are configured to point Microsoft traffic to the tenant restrictions policy. The policy is enforced in the cloud.     |
|**Policy enforcement limitation**    | You can manage corporate proxies by adding tenants to the Microsoft Entra traffic allowlist. The character limit of the header value in `Restrict-Access-To-Tenants: <allowed-tenant-list>` limits the number of tenants that you can add. |     This feature is managed by a cloud policy in the cross-tenant access policy. A default policy is created at the tenant level, and a partner policy is created for each external tenant.  |
|**Malicious tenant requests** | Microsoft Entra ID blocks malicious tenant authentication requests to provide authentication plane protection.         |    Microsoft Entra ID blocks malicious tenant authentication requests to provide authentication plane protection.     |
|**Granularity**           | This feature is limited to tenants and all Microsoft accounts.        |   This feature includes tenant, user, group, and application granularity. (User-level granularity isn't supported with Microsoft accounts.)      |
 
### Step 3: Enable tenant restrictions v2 on the corporate proxy
 
You can configure the corporate proxy to enable client-side tagging of the tenant restrictions v2 header by using the following corporate proxy setting: `sec-Restrict-Tenant-Access-Policy: <DirectoryID>:<policyGUID>`.
 
In that setting, replace `<DirectoryID>` with your Microsoft Entra tenant ID. Replace `<policyGUID>` with the object ID for your cross-tenant access policy.

MODIFIED docs/identity/devices/whats-new-linux.md

Modified by Justin on May 20, 2025 5:11 AM
📖 View on learn.microsoft.com

+15 / -15 lines changed

Commit: correct link issue

Changes:

Before

After

This article provides information about the latest updates to Microsoft Single Sign-on for Linux. 
 
### Package Repositories
Microsoft uses the following package repositories to distribute the Microsoft Identity Broker and Microsoft Identity Diagnostics for Linux. Packages are available in either `.deb` or `.rpm` format, however only Ubuntu Long-Term Support (LTS) & Red Hat Enterprise Linux (LTS) are supported today.
 
 
#### [Ubuntu20.04](#tab/ubuntu2004)
- [microsoft-identity-broker](https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/)
- [microsoft-identity-diagnostics](https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/microsoft-identity-diagnostics/)
 
#### [Ubuntu24.04](tab/ubuntu2404)
- [microsoft-identity-broker](https://packages.microsoft.com/ubuntu/24.04/prod/pool/main/m/microsoft-identity-broker)
 
#### [RedHat 9](#tab/redhat9)
- [microsoft-identity-broker](https://packages.microsoft.com/rhel/9/prod/Packages/m/)
 
## Microsoft-Identity-Broker
 
### 2.0.1 - 18-Nov-2024 
- Releasing package support for ubuntu 24.04

This article provides information about the latest updates to Microsoft Single Sign-on for Linux. 
 
### Package Repositories
Microsoft uses the following package repositories to distribute the Microsoft Identity Broker and Microsoft Identity Diagnostics for Linux. Packages are available in either `.deb` or `.rpm` format, however only Ubuntu Long-Term Support (LTS) & Red Hat Enterprise Linux (LTS) are supported.
 
 
#### [Ubuntu20.04](#tab/ubuntu2004)
- [microsoft-identity-broker](https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/)
- [microsoft-identity-diagnostics](https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/microsoft-identity-diagnostics/)
 
#### [Ubuntu24.04](#tab/ubuntu2404)
- [microsoft-identity-broker](https://packages.microsoft.com/ubuntu/24.04/prod/pool/main/m/microsoft-identity-broker/)
 
#### [RedHat 9](#tab/redhat9)
- [microsoft-identity-broker](https://packages.microsoft.com/rhel/9/prod/Packages/m/)
 
## Microsoft-Identity-Broker
 
### 2.0.1 - Nov 18, 2024 
- Releasing package support for ubuntu 24.04

MODIFIED docs/external-id/customers/concept-supported-features-customers.md

Modified by Yoel Horvitz on May 20, 2025 3:57 PM
📖 View on learn.microsoft.com

+19 / -3 lines changed

Commit: Authentication methods available in Microsoft Entra external ID

Changes:

Before

After

 
ms.subservice: external
ms.topic: concept-article
ms.date: 05/15/2025
ms.author: mimart
ms.custom: it-pro, seo-july-2024
 
|Feature  |Workforce tenant  | External tenant |
|---------|---------|---------|
| **Identity providers for external users (primary authentication)** | **For self-service sign-up guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- Facebook federation<br></br>**For invited guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- SAML/WS-Fed federation | **For self-service sign-up users (consumers, business customers)**</br>- [Email with password](concept-authentication-methods-customers.md#email-and-password-sign-in)</br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)</br>- [Google federation (preview)](./how-to-google-federation-customers.md)</br>- [Facebook federation (preview)](./how-to-facebook-federation-customers.md)</br>- [Apple federation (preview)](./how-to-apple-federation-customers.md)</br>- [OpenID Connect federation](./how-to-custom-oidc-federation-customers.md)<br>- [SAML/WS-Fed federation](../direct-federation.md)<br></br>**For invited guests (preview)**</br>Guests invited with a directory role (for example, admins):</br>- Microsoft Entra accounts </br>- Microsoft accounts </br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)<br>- [SAML/WS-Fed federation](../direct-federation.md) |
| **Authentication methods for MFA**  | **For internal users (employees and admins)** </br>- [Authentication and verification methods](~/identity/authentication/concept-authentication-methods.md) </br>**For guests (invited or self-service sign-up)** </br>- [Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users)  |  **For self-service sign-up users (consumers, business customers) or invited users (preview)**</br>- [Email one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</br>- [SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)    |
 
## Application registration

 
ms.subservice: external
ms.topic: concept-article
ms.date: 05/20/2025
ms.author: mimart
ms.custom: it-pro, seo-july-2024
 
 
|Feature  |Workforce tenant  | External tenant |
|---------|---------|---------|
| **Identity providers for external users (primary authentication)** | **For self-service sign-up guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- Facebook federation<br></br>**For invited guests**</br>- Microsoft Entra accounts</br>- Microsoft accounts</br>- Email one-time passcode</br>- Google federation</br>- SAML/WS-Fed federation | **For self-service sign-up users (consumers, business customers)**</br>- [Authentication methods available in Microsoft Entra external ID](#authentication-methods-available-in-microsoft-entra-external-id)<br></br>**For invited guests (preview)**</br>Guests invited with a directory role (for example, admins):</br>- Microsoft Entra accounts </br>- Microsoft accounts </br>- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)<br>- [SAML/WS-Fed federation](../direct-federation.md) |
| **Authentication methods for MFA**  | **For internal users (employees and admins)** </br>- [Authentication and verification methods](~/identity/authentication/concept-authentication-methods.md) </br>**For guests (invited or self-service sign-up)** </br>- [Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users)  |  **For self-service sign-up users (consumers, business customers)**</br>- [Authentication methods available in Microsoft Entra external ID](#authentication-methods-available-in-microsoft-entra-external-id) </br></br>**For invited users (preview)**</br>- [Email one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</br>- [SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)    |
 
### Authentication methods available in Microsoft Entra external ID
 
Some authentication methods can be used as the primary factor when users sign in to an application, such username and password. Other authentication methods are only available as a secondary factor. The following table outlines when an authentication method can be used during sign-in, self-service sign-up, self-service password reset and  multifactor authentication (MFA) in Microsoft Entra external ID:
 
|Method  |Sign-in  |Sign-up  |Password reset  |MFA  |
|---------|---------|---------|---------|---------|
| [Email with password](./concept-authentication-methods-customers#email-and-password-sign-in) | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |  |  |

MODIFIED docs/identity/devices/sso-linux.md

Modified by Justin on May 20, 2025 5:11 AM
📖 View on learn.microsoft.com

+8 / -7 lines changed

Commit: correct link issue

Changes:

Before

After

 
---
 
For more information, see the following Intune documentation:
 
- [Deployment guide: Manage Linux devices in Microsoft Intune](/mem/intune-service/fundamentals/deployment-guide-platform-linux)
 
- [Enrollment guide: Enroll Linux desktop devices in Microsoft Intune](/mem/intune-service/fundamentals/deployment-guide-enrollment-linux).
 
### Update app for Ubuntu Desktop 
 
Run the following commands to update the app manually.    
## Troubleshooting 
 
If you experience issues when implementing macOS Platform SSO, refer to our documentation on [macOS Platform single sign-on known issues and troubleshooting](troubleshoot-macos-platform-single-sign-on-extension.md)

 
---
 
### Update app for Ubuntu Desktop 
 
Run the following commands to update the app manually.    
## Troubleshooting 
 
If you experience issues when implementing macOS Platform SSO, refer to our documentation on [macOS Platform single sign-on known issues and troubleshooting](troubleshoot-macos-platform-single-sign-on-extension.md)
 
## Related Content
 
For more information, see the following Intune documentation:
 
- [Deployment guide: Manage Linux devices in Microsoft Intune](/mem/intune-service/fundamentals/deployment-guide-platform-linux)
 
- [Enrollment guide: Enroll Linux desktop devices in Microsoft Intune](/mem/intune-service/fundamentals/deployment-guide-enrollment-linux).

MODIFIED docs/identity/hybrid/connect/reference-connect-version-history.md

Modified by Bill Mathers on May 20, 2025 2:16 AM
📖 View on learn.microsoft.com

+7 / -4 lines changed

Commit: updating

Changes:

Before

After

|[2.4.21.0](#24210)|15 Nov 2025 (12 months after release of 2.4.27.0)|
|[2.4.27.0](#24270)|15 Jan 2026 (12 months after release of 2.4.129.0)|
|[2.4.129.0](#241290)|27 Mar 2026 (12 months after release of 2.4.131.0)|
|[2.4.131.0](#241310)|30 April 2026|(12 months after release of 2.4.257.0)|
|[2.4.257.0](#242570)||
 
**All other versions are not supported**
 
To read more about autoupgrade, see [Microsoft Entra Connect: Automatic upgrade](how-to-connect-install-automatic-upgrade.md).
 
 
## 2.4.257.0
 
### Release status
 
04/30/2025: Released for download via the Microsoft Entra admin center.
 
### Added Features
- Modern Authentication enabled allowing customers to configure application-based authentication for enhanced securit (Public Preview).
### Updated Features

|[2.4.21.0](#24210)|15 Nov 2025 (12 months after release of 2.4.27.0)|
|[2.4.27.0](#24270)|15 Jan 2026 (12 months after release of 2.4.129.0)|
|[2.4.129.0](#241290)|27 Mar 2026 (12 months after release of 2.4.131.0)|
|[2.4.131.0](#241310)|30 April 2026|(12 months after release of 2.5.2.0)|
|[2.5.2.0](#2520)||
 
**All other versions are not supported**
 
To read more about autoupgrade, see [Microsoft Entra Connect: Automatic upgrade](how-to-connect-install-automatic-upgrade.md).
 
 
## 2.5.2.0
 
### Release status
 
05/26/2025: Released for download via the Microsoft Entra admin center.
 
### Added Features
- Modern Authentication enabled allowing customers to configure application-based authentication for enhanced securit (Public Preview).
### Updated Features

MODIFIED docs/external-id/tenant-configurations.md

Modified by csmulligan on May 20, 2025 11:35 PM
📖 View on learn.microsoft.com

+5 / -4 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

 
ms.subservice: external
ms.topic: conceptual
ms.date: 10/21/2024
ms.author: mimart
ms.custom: it-pro
 
- If you don't already have a Microsoft Entra tenant and want to try out External ID features in an external tenant, we recommend using the get started experience to start a free trial.
 
When you create a tenant, you can set your correct geographic location and your domain name.
 
> [!NOTE]
> If you currently use Azure AD B2C, the new workforce and customer tenant model doesn't affect your existing Azure AD B2C tenants.
 
## How workforce and external tenants compare

 
ms.subservice: external
ms.topic: conceptual
ms.date: 05/20/2025
ms.author: mimart
ms.custom: it-pro
 
- If you don't already have a Microsoft Entra tenant and want to try out External ID features in an external tenant, we recommend using the get started experience to start a free trial.
 
When you create a tenant, you can set your correct geographic location and your domain name. If you currently use Azure AD B2C, the new workforce and customer tenant model doesn't affect your existing Azure AD B2C tenants.
 
When you create a tenant, you can specify your correct geographic location and domain name. If you currently use Azure AD B2C, the new workforce and customer tenant model does not affect your existing Azure AD B2C tenants.
 
[!INCLUDE [active-directory-b2c-end-of-sale-notice.md](./includes/active-directory-b2c-end-of-sale-notice.md)]
 
## How workforce and external tenants compare

MODIFIED docs/external-id/self-service-sign-up-add-approvals.md

Modified by csmulligan on May 20, 2025 11:35 PM
📖 View on learn.microsoft.com

+1 / -7 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

 
ms.service: entra-external-id
ms.topic: how-to
ms.date: 04/14/2025
 
ms.author: mimart
author: msmimart
- Automatically approve the user and allow Microsoft Entra ID to create the user account.
- Trigger a manual review. If the request is approved, the approval system uses Microsoft Graph to provision the user account. The approval system can also notify the user that their account has been created.
 
> [!IMPORTANT]
>
> - **As of July 12, 2021**, if Microsoft Entra B2B customers set up new Google integrations for use with self-service sign-up for their custom or line-of-business applications, authentication with Google identities won’t work until authentications are moved to system web-views. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).
> - **On September 30, 2021**, Google [deprecated embedded web-view sign-in support](https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html). If your apps authenticate users with an embedded web-view and you're using Google federation with [Azure AD B2C](/azure/active-directory-b2c/identity-provider-google) or Microsoft Entra B2B for [external user invitations](google-federation.md) or [self-service sign-up](identity-providers.md), Google Gmail users won't be able to authenticate. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).
 
## Register an application for your approval system
 
 
You need to register your approval system as an application in your Microsoft Entra tenant so it can authenticate with Microsoft Entra ID and have permission to create users. Learn more about [authentication and authorization basics for Microsoft Graph](/graph/auth/auth-concepts).
 

 
ms.service: entra-external-id
ms.topic: how-to
ms.date: 05/20/2025
 
ms.author: mimart
author: msmimart
- Automatically approve the user and allow Microsoft Entra ID to create the user account.
- Trigger a manual review. If the request is approved, the approval system uses Microsoft Graph to provision the user account. The approval system can also notify the user that their account has been created.
 
## Register an application for your approval system
 
You need to register your approval system as an application in your Microsoft Entra tenant so it can authenticate with Microsoft Entra ID and have permission to create users. Learn more about [authentication and authorization basics for Microsoft Graph](/graph/auth/auth-concepts).
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](~/identity/role-based-access-control/permissions-reference.md#user-administrator).

MODIFIED docs/global-secure-access/reference-china-user-support.md

Modified by Sumeet Mittal on May 20, 2025 5:29 AM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Update reference-china-user-support.md

Changes:

Before

After

---
title: Global Secure Access Support for Microsoft Azure in China (Preview)
description: Learn about how Microsoft is dedicated to supporting Global Secure Access capabilities for Microsoft Azure in China.
ms.author: jayrusso
author: HULKsmashGithub
manager: femila
# Customer intent: As an IT admin, I want to evaluate the regulatory constraints of using Global Secure Access in China so that I can ensure compliance and plan connectivity strategies effectively.   
---
 
# Global Secure Access Support for Microsoft Azure in China (Preview)
Microsoft supports Global Secure Access capabilities in China, offering secure and compliant connectivity solutions tailored to the needs of organizations operating in China. 
 
> [!IMPORTANT]
> Global Secure Access support for Microsoft Azure in China is currently in PREVIEW.
> This information relates to a prerelease functionality that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided in this article.
 
There are two scenarios that are applicable to Global Secure Access in China:      

---
title: Global Secure Access Support in China (Preview)
description: Learn about how Microsoft is dedicated to supporting Global Secure Access capabilities in China.
ms.author: jayrusso
author: HULKsmashGithub
manager: femila
# Customer intent: As an IT admin, I want to evaluate the regulatory constraints of using Global Secure Access in China so that I can ensure compliance and plan connectivity strategies effectively.   
---
 
# Global Secure Access Support in China (Preview)
Microsoft supports Global Secure Access capabilities in China, offering secure and compliant connectivity solutions tailored to the needs of organizations operating in China. 
 
> [!IMPORTANT]
> Global Secure Access support in China is currently in PREVIEW.
> This information relates to a prerelease functionality that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided in this article.
 
There are two scenarios that are applicable to Global Secure Access in China:      

MODIFIED docs/identity/authentication/concept-mfa-regional-opt-in.md

Modified by Dan Mabee on May 20, 2025 1:03 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update concept-mfa-regional-opt-in.md

Changes:

Before

After

| 82 | South Korea |
| 84 | Vietnam |
| 86 | China |
| 90 | Turkey |
| 91 | India |
| 92 | Pakistan |
| 93 | Afghanistan |
| 691 | Federated States of Micronesia |
| 692 | Marshall Islands |
| 850 | North Korea |
| 852 | Hong Kong |
| 853 | Macau |
| 855 | Cambodia |
| 856 | Laos |
| 880 | Bangladesh |

| 82 | South Korea |
| 84 | Vietnam |
| 86 | China |
| 90 | Türkiye |
| 91 | India |
| 92 | Pakistan |
| 93 | Afghanistan |
| 691 | Federated States of Micronesia |
| 692 | Marshall Islands |
| 850 | North Korea |
| 852 | Hong Kong SAR|
| 853 | Macao SAR |
| 855 | Cambodia |
| 856 | Laos |
| 880 | Bangladesh |

MODIFIED docs/identity/role-based-access-control/custom-create.md

Modified by rolyon on May 20, 2025 6:46 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Azure custom role link

Changes:

Before

After

---
title: Create a custom role in Microsoft Entra ID
description: Learn how to create a custom role in Microsoft Entra ID using the Microsoft Entra admin center, Microsoft Graph PowerShell, or Microsoft Graph API
author: rolyon
ms.author: rolyon
manager: femila
ms.reviewer: vincesm
ms.date: 01/03/2025
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: how-to
 
# Create a custom role in Microsoft Entra ID
 
This article describes how to create a custom role in Microsoft Entra ID using the Microsoft Entra admin center, Microsoft Graph PowerShell, or Microsoft Graph API.
 
For the basics of custom roles, see the [custom roles overview](custom-overview.md). The role can be assigned either at the directory-level scope or an app registration resource scope only. For information about the maximum number of custom roles that can be created in a Microsoft Entra organization, see [Microsoft Entra service limits and restrictions](~/identity/users/directory-service-limits-restrictions.md).
 

---
title: Create a custom role in Microsoft Entra ID
description: Learn how to create a custom role to manage access to Microsoft Entra resources using the Microsoft Entra admin center, Microsoft Graph PowerShell, or Microsoft Graph API
author: rolyon
ms.author: rolyon
manager: femila
ms.reviewer: vincesm
ms.date: 05/19/2025
ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: how-to
 
# Create a custom role in Microsoft Entra ID
 
This article describes how to create a custom role to manage access to Microsoft Entra resources using the Microsoft Entra admin center, Microsoft Graph PowerShell, or Microsoft Graph API. If you want to instead create a custom role to manage access to Azure resources, see [Create or update Azure custom roles using the Azure portal](/azure/role-based-access-control/custom-roles-portal).
 
For the basics of custom roles, see the [custom roles overview](custom-overview.md). The role can be assigned either at the directory-level scope or an app registration resource scope only. For information about the maximum number of custom roles that can be created in a Microsoft Entra organization, see [Microsoft Entra service limits and restrictions](~/identity/users/directory-service-limits-restrictions.md).
 

MODIFIED docs/identity/authentication/howto-mfa-mfasettings.md

Modified by Justinha on May 20, 2025 12:02 PM
📖 View on learn.microsoft.com

+4 / -1 lines changed

Commit: added back note about report suspicious activity including legacy features

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/14/2025
 
ms.author: justinha
author: justinha
 
To customize the end-user experience for Microsoft Entra multifactor authentication (MFA), you can configure options for reporting suspicious activities. The following table describes Microsoft Entra MFA settings, and subsections cover each setting in more detail.
 
| Feature | Description |
| ------- | ----------- |
| [Account lockout (MFA Server only)](#account-lockout-mfa-server-only) | Temporarily lock accounts from using Microsoft Entra MFA if there are too many denied authentication attempts in a row. This feature applies only to users who use MFA Server to enter a PIN to authenticate. |
 
 
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/19/2025
 
ms.author: justinha
author: justinha
 
To customize the end-user experience for Microsoft Entra multifactor authentication (MFA), you can configure options for reporting suspicious activities. The following table describes Microsoft Entra MFA settings, and subsections cover each setting in more detail.
 
>[!NOTE]
>[Report suspicious activity](#report-suspicious-activity) replaces the Block/unblock users, Fraud alert, and Notifications legacy features. On March 1, 2025, the legacy features were removed. 
 
| Feature | Description |
| ------- | ----------- |
| [Account lockout (MFA Server only)](#account-lockout-mfa-server-only) | Temporarily lock accounts from using Microsoft Entra MFA if there are too many denied authentication attempts in a row. This feature applies only to users who use MFA Server to enter a PIN to authenticate. |

MODIFIED docs/id-governance/entitlement-management-access-package-auto-assignment-policy.md

Modified by Jorge Lopez on May 20, 2025 8:35 AM
📖 View on learn.microsoft.com

+3 / -2 lines changed

Commit: Update entitlement-management-access-package-auto-assignment-policy.md

Changes:

Before

After

 
You can use rules to determine access package assignment based on user properties in Microsoft Entra ID, part of Microsoft Entra. In Entitlement Management, an access package can have multiple policies, and each policy establishes how users get an assignment to the access package, and for how long. As an administrator, you can establish a policy for automatic assignments by supplying a membership rule, that Entitlement Management follows to create and remove assignments automatically. Similar to a [dynamic group](../identity/users/groups-create-rule.md), when an automatic assignment policy is created, user attributes are evaluated for matches with the policy's membership rule. When an attribute changes for a user, these automatic assignment policy rules in the access packages are processed for membership changes. Assignments to users are then added or removed depending on whether they meet the rule criteria.
 
You can have at most one automatic assignment policy in an access package, and the policy can only be created by an administrator. (Catalog owners and access package managers can't create automatic assignment policies.)
 
This article describes how to create an access package automatic assignment policy for an existing access package.
 
To create a policy for an access package, you need to start from the access package's policy tab. Follow these steps to create a new automatic assignment policy for an access package.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).
 
1. Browse to **ID Governance** > **Entitlement management** > **Access package**.

 
You can use rules to determine access package assignment based on user properties in Microsoft Entra ID, part of Microsoft Entra. In Entitlement Management, an access package can have multiple policies, and each policy establishes how users get an assignment to the access package, and for how long. As an administrator, you can establish a policy for automatic assignments by supplying a membership rule, that Entitlement Management follows to create and remove assignments automatically. Similar to a [dynamic group](../identity/users/groups-create-rule.md), when an automatic assignment policy is created, user attributes are evaluated for matches with the policy's membership rule. When an attribute changes for a user, these automatic assignment policy rules in the access packages are processed for membership changes. Assignments to users are then added or removed depending on whether they meet the rule criteria.
 
   > [!NOTE]
   > Only one automatic assignment policy is allowed per access package, configuring more than one will lead to processing issues and subsequent problems with the access of assigned individuals. 
 
This article describes how to create an access package automatic assignment policy for an existing access package.
 
To create a policy for an access package, you need to start from the access package's policy tab. Follow these steps to create a new automatic assignment policy for an access package.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).Catalog owners and access package managers can't create automatic assignment policies.
 
1. Browse to **ID Governance** > **Entitlement management** > **Access package**.

MODIFIED docs/external-id/customers/how-to-migrate-users.md

Modified by csmulligan on May 20, 2025 11:35 PM
📖 View on learn.microsoft.com

+3 / -1 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

ms.service: entra-external-id
ms.subservice: external
ms.topic: how-to
ms.date: 04/01/2024
ms.author: godonnell
---
 
 
In this guide, you learn the fundamentals of how to migrate users and credentials from your current identity provider, including Azure AD B2C, to Microsoft Entra External ID. This guide covers different solutions you can use depending on your current configuration. With each of these approaches, you need to write an application or script that uses the [Microsoft Graph API](/graph/api/resources/identity-network-access-overview) to create user accounts in External ID.
 
## Pre-requisites
 
Before you start migrating users to External ID, you need:
 
 

ms.service: entra-external-id
ms.subservice: external
ms.topic: how-to
ms.date: 05/20/2025
ms.author: godonnell
---
 
 
In this guide, you learn the fundamentals of how to migrate users and credentials from your current identity provider, including Azure AD B2C, to Microsoft Entra External ID. This guide covers different solutions you can use depending on your current configuration. With each of these approaches, you need to write an application or script that uses the [Microsoft Graph API](/graph/api/resources/identity-network-access-overview) to create user accounts in External ID.
 
[!INCLUDE [active-directory-b2c-end-of-sale-notice.md](../includes/active-directory-b2c-end-of-sale-notice.md)]
 
## Pre-requisites
 
Before you start migrating users to External ID, you need:

MODIFIED docs/architecture/b2c-deployment-plans.md

Modified by csmulligan on May 20, 2025 1:12 AM
📖 View on learn.microsoft.com

+3 / -1 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

ms.service: entra
ms.subservice: architecture
ms.topic: conceptual
ms.date: 01/17/2023
ms.author: gasinh
author: gargi-sinha
manager: martinco
 
# Azure Active Directory B2C deployment plans
 
Azure Active Directory B2C (Azure AD B2C) is an identity and access management solution that can ease integration with your infrastructure. Use the following guidance to help understand requirements and compliance throughout an Azure AD B2C deployment.
 
## Plan an Azure AD B2C deployment
 
 

ms.service: entra
ms.subservice: architecture
ms.topic: conceptual
ms.date: 05/19/2025
ms.author: gasinh
author: gargi-sinha
manager: martinco
 
# Azure Active Directory B2C deployment plans
 
[!INCLUDE [active-directory-b2c-end-of-sale-notice](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
Azure Active Directory B2C (Azure AD B2C) is an identity and access management solution that can ease integration with your infrastructure. Use the following guidance to help understand requirements and compliance throughout an Azure AD B2C deployment.
 
## Plan an Azure AD B2C deployment

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files

🗑️ Deleted Documentation Files