Microsoft Entra Documentation Changes

📝 Modified Documentation Files

MODIFIED docs/identity/authentication/concept-mfa-regional-opt-in.md

Modified by Justinha on May 21, 2025 3:22 AM
📖 View on learn.microsoft.com

+238 / -238 lines changed

Commit: fixed links and table order

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 03/04/2025
 
author: aloom3
ms.author: justinha
manager: femila
ms.reviewer: aloom3
---
# Regions that need to opt in for MFA telephony verification  
 
This applies to Entra tenants only.
 
For B2C tenants follow the guidelines here: [B2C service limits](https://learn.microsoft.com/azure/active-directory-b2c/service-limits)
 
For Entra External ID tenants follow the guidelines here: [How to region code opt-in](../../external-id/customers/how-to-region-code-opt-in.md)
 
As a protection for our customers, Microsoft doesn't automatically support telephony verification for certain region codes. If you want to receive traffic from phone numbers with these region codes, your administrator must submit a support ticket and request to opt in.  
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 05/20/2025
 
author: justinha
ms.author: justinha
manager: femila
ms.reviewer: aloom3
---
# Regions that need to opt in for MFA telephony verification  
 
 
 
As a protection for our customers, Microsoft doesn't automatically support telephony verification for certain region codes. If you want to receive traffic from phone numbers with these region codes, a Microsoft Entra administrator must submit a support ticket and request to opt in.  
 
B2C tenants can follow the guidelines in [B2C service limits](/azure/active-directory-b2c/service-limits).
Microsoft Entra External ID tenants acn follow the guidelines in [How to region code opt-in](/azure/external-id/customers/how-to-region-code-opt-in).
 
## Why this protection is needed  

MODIFIED docs/global-secure-access/how-to-transport-layer-security.md

Modified by jayrusso on May 21, 2025 9:26 AM
📖 View on learn.microsoft.com

+81 / -42 lines changed

Commit: May 20 updates per PM feedback

Changes:

Before

After

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 04/18/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (preview)
A significant percentage of internet traffic is encrypted. By terminating Transport Layer Security (TLS) at the edge, Global Secure Access inspects and applies security policies to decrypted traffic, enabling threat detection, content filtering, and granular access controls.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
 
This article explains how to create a context-aware Transport Layer Security inspection policy and assign it to users in your organization.
 
## Prerequisites
To complete the steps in this process, you must have the following prerequisites in place: 
- A Microsoft Entra tenant onboarded to the TLS inspection preview.     

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 05/20/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (Preview)
Because most internet traffic is encrypted, terminating Transport Layer Security (TLS) at the edge allows Global Secure Access to decrypt and inspect traffic. This inspection enables Global Secure Access to enforce security policies such as threat detection, content filtering, and fine-grained access controls, which enhances protection against threats concealed within encrypted communications.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
 
This article explains how to create a context-aware Transport Layer Security inspection policy and assign it to users in your organization.
 
## Prerequisites   
To complete the steps in this process, you must have the following prerequisites in place:      
- A Public Key Infrastructure (PKI) service to sign the Certificate Signing Request (CSR) and generate an intermediate certificate for TLS inspection. For testing scenarios, you can also use a self-signed root certificate created with OpenSSL.   

MODIFIED docs/external-id/customers/concept-supported-features-customers.md

Modified by Yoel Horvitz on May 21, 2025 5:56 PM
📖 View on learn.microsoft.com

+16 / -3 lines changed

Commit: Update concept-supported-features-customers.md

Changes:

Before

After

|---------|---------|---------|
|   **Protocol** |  SAML relying parties, OpenID Connect, and OAuth2  |  [SAML relying parties](how-to-register-saml-app.md), [OpenID Connect](how-to-register-ciam-app.md), and OAuth2 |
| **Supported account types**| The following [account types](~/identity-platform/quickstart-register-app.md#register-an-application): <ul><li>Accounts in this organizational directory only (Single tenant)</li><li>Accounts in any organizational directory (Any Microsoft Entra tenant - Multitenant)</li><li>Accounts in any organizational directory (Any Microsoft Entra tenant - Multitenant) and personal Microsoft accounts (such as Skype, Xbox)</li><li>Personal Microsoft accounts only</li></ul> | Always use *Accounts in this organizational directory only (Single tenant)*. |
| **Platform** | The following [platforms](../../identity-platform/how-to-add-redirect-uri.md): <ul><li>Public client/native (mobile & desktop)</li><li>Web</li><li>Single page application (SPA)</li></ul>| The following [platforms](../../identity-platform/how-to-add-redirect-uri.md): <ul><li>Public client (mobile & desktop)</li><li>[Native authentication mobile](concept-native-authentication.md) </li><li>Web</li><li>Single page application (SPA)</li></ul>|
| **Authentication** > **Redirect URIs**| The URIs Microsoft Entra ID accepts as destinations when returning authentication responses (tokens) after successfully authenticating or signing out users. | Same as workforce.|
| **Authentication** > **Front-channel logout URL**| This URL is where Microsoft Entra ID sends a request to have the application clear the user's session data. The Front-channel logout URL is required for single sign-out to work correctly.| Same as workforce.|
| **Authentication** > **Implicit grant and hybrid flows**| Request a token directly from the authorization endpoint. | Same as workforce.|
| **Certificates & secrets** | <ul><li>[Certificate](../../identity-platform/quickstart-register-app.md?tabs=certificate)</li><li>[Client secrets](../../identity-platform/quickstart-register-app.md?tabs=client-secret)</li><li>[Federated credentials](../../identity-platform/quickstart-register-app.md?tabs=federated-credential)</li></ul>| Same as workforce.|
| **API permissions** | Add, remove, and replace permissions to an application. After permissions are added to your application, users or admins need to grant consent to the new permissions. Learn more about [updating an app's requested permissions in Microsoft Entra ID](../../identity-platform/howto-update-permissions.md).  | The following are the allowed permissions: Microsoft Graph `offline_access`, `openid`, and `User.Read` and your **My APIs** delegated permissions. Only an admin can consent on behalf of the organization.  |
| **Expose an API** | [Define custom scopes](../../identity-platform/quickstart-configure-app-expose-web-apis.md) to restrict access to data and functionality protected by the API. An application that requires access to parts of this API can request that a user or admin consent to one or more of these scopes. | Define custom scopes to restrict access to data and functionality protected by the API. An application that requires access to parts of this API can request that admin consent to one or more of these scopes. |
| **App roles**| App roles are [custom roles](../../identity-platform/howto-add-app-roles-in-apps.md) to assign permissions to users or apps. The application defines and publishes the app roles and interprets them as permissions during authorization.| Same as workforce. Learn more about [using role-based access control for applications](how-to-use-app-roles-customers.md) in an external tenant. |
| **Owners** | Application owners can view and edit the application registration. Additionally, any user (who might not be listed) with administrative privileges to manage any application (for example, [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator)) can view and edit the application registration. | Same as workforce. |
| **Roles and administrators** | [Administrative roles](~/identity/role-based-access-control/permissions-reference.md) are used for granting access for privileged actions in Microsoft Entra ID. | Only the [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator) role can be used for apps in external tenants. This role grants the ability to create and manage all aspects of application registrations and enterprise applications.  |
|**Assigning users and groups to an app**| When user assignment is required, only those users you assign to the application (either through direct user assignment or based on group membership) are able to sign in. For more information, see [manage users and groups assignment to an application](~/identity/enterprise-apps/assign-user-or-group-access-portal.md)| Not available |
 
## OpenID Connect and OAuth2 flows
 
|**Grant**|[Grant or block access to resources](~/identity/conditional-access/concept-conditional-access-grant.md)|<ul><li>[Block access](~/identity/conditional-access/concept-conditional-access-grant.md#block-access)</li><li>[Require multifactor authentication](./how-to-multifactor-authentication-customers.md)</li><li>[Require password reset](./how-to-enable-password-reset-customers.md)</li></ul>|
|**Session**|[Session controls](~/identity/conditional-access/concept-conditional-access-session.md)|Not available|
 

|---------|---------|---------|
|   **Protocol** |  SAML relying parties, OpenID Connect, and OAuth2  |  [SAML relying parties](how-to-register-saml-app.md), [OpenID Connect](how-to-register-ciam-app.md), and OAuth2 |
| **Supported account types**| The following [account types](~/identity-platform/quickstart-register-app.md#register-an-application): <ul><li>Accounts in this organizational directory only (Single tenant)</li><li>Accounts in any organizational directory (Any Microsoft Entra tenant - Multitenant)</li><li>Accounts in any organizational directory (Any Microsoft Entra tenant - Multitenant) and personal Microsoft accounts (such as Skype, Xbox)</li><li>Personal Microsoft accounts only</li></ul> | Always use *Accounts in this organizational directory only (Single tenant)*. |
| **Platform** | The following [platforms](../../identity-platform/how-to-add-redirect-uri.md): <ul><li>Public client/native (mobile & desktop)</li><li>Web</li><li>Single page application (SPA)</li></ul>| The following [platforms](../../identity-platform/how-to-add-redirect-uri.md): <ul><li>Public client (mobile & desktop)</li><li>Web</li><li>Single page application (SPA)</li><li>Native authentication for [mobile](concept-native-authentication.md) and [single page (SPA)](how-to-native-authentication-cors-solution-production-environment.md) applications. </li></ul>|
| **Authentication** > **Redirect URIs**| The URIs Microsoft Entra ID accepts as destinations when returning authentication responses (tokens) after successfully authenticating or signing out users. | Same as workforce.|
| **Authentication** > **Front-channel logout URL**| This URL is where Microsoft Entra ID sends a request to have the application clear the user's session data. The Front-channel logout URL is required for single sign-out to work correctly.| Same as workforce.|
| **Authentication** > **Implicit grant and hybrid flows**| Request a token directly from the authorization endpoint. | Same as workforce.|
| **Certificates & secrets** | <ul><li>[Certificate](../../identity-platform/how-to-add-credentials.md?tabs=certificate)</li><li>[Client secrets](../../identity-platform/how-to-add-credentials.md?tabs=client-secret)</li><li>[Federated credentials](../../identity-platform/how-to-add-credentials.md?tabs=federated-credential)</li></ul>| Same as workforce.|
| **Certificates & secrets** > **Rotation**| Update client credentials to ensure they remain valid and secure, while users can continue to sign-in. [Certificates](../../identity-platform/how-to-add-credentials.md?tabs=certificate), [secrets](../../identity-platform/how-to-add-credentials.md?tabs=client-secret), and [federated credentials](../../identity-platform/how-to-add-credentials.md?tabs=federated-credential) can be rotated by adding a new one and then removing the old one.|Same as workforce.|
|**Certificates & secrets** > **Policy** | Configure the [application management policies](~/identity/enterprise-apps/tutorial-enforce-secret-standards.md) to enforce secret and certificate restrictions. | Not available |
| **API permissions** | Add, remove, and replace permissions to an application. After permissions are added to your application, users or admins need to grant consent to the new permissions. Learn more about [updating an app's requested permissions in Microsoft Entra ID](../../identity-platform/howto-update-permissions.md).  | The following are the allowed permissions: Microsoft Graph `offline_access`, `openid`, and `User.Read` and your **My APIs** delegated permissions. Only an admin can consent on behalf of the organization.  |
| **Expose an API** | [Define custom scopes](../../identity-platform/quickstart-configure-app-expose-web-apis.md) to restrict access to data and functionality protected by the API. An application that requires access to parts of this API can request that a user or admin consent to one or more of these scopes. | Define custom scopes to restrict access to data and functionality protected by the API. An application that requires access to parts of this API can request that admin consent to one or more of these scopes. |
| **App roles**| App roles are [custom roles](../../identity-platform/howto-add-app-roles-in-apps.md) to assign permissions to users or apps. The application defines and publishes the app roles and interprets them as permissions during authorization.| Same as workforce. Learn more about [using role-based access control for applications](how-to-use-app-roles-customers.md) in an external tenant. |
| **Owners** | Application owners can view and edit the application registration. Additionally, any user (who might not be listed) with administrative privileges to manage any application (for example, [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator)) can view and edit the application registration. | Same as workforce. |
| **Roles and administrators** | [Administrative roles](~/identity/role-based-access-control/permissions-reference.md) are used for granting access for privileged actions in Microsoft Entra ID. | Only the [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator) role can be used for apps in external tenants. This role grants the ability to create and manage all aspects of application registrations and enterprise applications.  |
| **Assigning users and groups to an app**| When user assignment is required, only those users you assign to the application (either through direct user assignment or based on group membership) are able to sign in. For more information, see [manage users and groups assignment to an application](~/identity/enterprise-apps/assign-user-or-group-access-portal.md)| Not available |
 
## OpenID Connect and OAuth2 flows
 
|**Grant**|[Grant or block access to resources](~/identity/conditional-access/concept-conditional-access-grant.md)|<ul><li>[Block access](~/identity/conditional-access/concept-conditional-access-grant.md#block-access)</li><li>[Require multifactor authentication](./how-to-multifactor-authentication-customers.md)</li><li>[Require password reset](./how-to-enable-password-reset-customers.md)</li></ul>|

MODIFIED docs/architecture/gsa-poc-internet-access.md

Modified by Janice Ricketts on May 21, 2025 2:24 AM
📖 View on learn.microsoft.com

+0 / -18 lines changed

Commit: Update gsa-poc-internet-access.md

Changes:

Before

After

 
1. View activity in the [traffic log](../global-secure-access/how-to-view-traffic-logs.md) to confirm that Global Secure Access enabled access. Verify in the sign-in logs that **Through Global Secure Access** shows as **Yes**.
 
### Implement universal tenant restrictions
 
[Universal tenant restrictions](../global-secure-access/how-to-universal-tenant-restrictions.md) enable you to control access to external tenants by unmanaged identities on company-managed devices and networks. You can enforce this restriction at the authentication plane with tenant restrictions v1, by either blocking or allowing all traffic to an external tenant.
 
This scenario usually requires hair-pinning traffic to a corporate network proxy. With universal tenant restrictions, organizations can restrict access on a per-application level, extend protection to the data plane (in addition to the authentication plane), and eliminate the need to hair-pin traffic to reduce network latency.
 
After you enable the Microsoft traffic profile, follow these steps to implement universal tenant restrictions:
 
1. [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2). If your organization currently uses tenant restrictions v1, review the [guide for migrating to tenant restrictions v2](https://aka.ms/trv2migration).
 
1. [Enable Global Secure Access signaling for tenant restrictions](../global-secure-access/how-to-universal-tenant-restrictions.md#enable-global-secure-access-signaling-for-tenant-restrictions).
 
1. Sign in to your test device and try to access a different tenant's SharePoint Online or Exchange Online resource for which you have valid credentials.
 
1. [Validate authentication plane protection](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-the-authentication-plane-protection).
 
1. [Validate data plane protection](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-the-data-plane-protection).

 
1. View activity in the [traffic log](../global-secure-access/how-to-view-traffic-logs.md) to confirm that Global Secure Access enabled access. Verify in the sign-in logs that **Through Global Secure Access** shows as **Yes**.
 
## Troubleshoot
 
If you have problems with your PoC, these articles can help you with troubleshooting, logging, and monitoring:

MODIFIED docs/id-protection/overview-identity-protection.md

Modified by shlipsey3 on May 21, 2025 5:20 AM
📖 View on learn.microsoft.com

+7 / -7 lines changed

Commit: updated-statistics

Changes:

Before

After

ms.service: entra-id-protection
 
ms.topic: overview
ms.date: 05/14/2025
 
author: shlipsey3
ms.author: sarahlipsey
 
## Remediate risks 
 
Why is automation critical in security?
 
In the blog post *[Cyber Signals: Defending against cyber threats with the latest research, insights, and trends](https://www.microsoft.com/security/blog/2022/02/03/cyber-signals-defending-against-cyber-threats-with-the-latest-research-insights-and-trends/)* dated February 3, 2022, Microsoft shared a threat intelligence brief including the following statistics: 
 
> Analyzed ...24 trillion security signals combined with intelligence we track by monitoring more than 40 nation-state groups and over 140 threat groups... 
> 
> ...From January 2021 through December 2021, we’ve blocked more than 25.6 billion Microsoft Entra brute force authentication attacks... 
 
The scale of signals and attacks requires automation to keep up.
 

ms.service: entra-id-protection
 
ms.topic: overview
ms.date: 05/20/2025
 
author: shlipsey3
ms.author: sarahlipsey
 
## Remediate risks 
 
Automation is critical in security because the scale of signals and attacks requires automation to keep up.
 
The [Microsoft Digital Defense Report 2024](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf) provides the following statistics:
 
> 78 trillion security signals analyzed per day, an increase of 13 trillion from the previous year
> 600 million attacks on Microsoft customers per day
> 2.75x increase year over year in human-operated ransomware attacks
 
These statistics continue to trend upwards, with no sign of slowing down. In this environment, automation is the key to identifying and remediating risk so IT organizations can focus on the right priorities.
 

MODIFIED docs/architecture/locate-integration-partners.md

Modified by Ed McKillop on May 21, 2025 1:00 AM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Update locate-integration-partners.md

Changes:

Before

After

|Partner|Description|
|---|---|
|Accenture|Accenture's Microsoft Entra Suite offering is distinguished by its exceptional global delivery capabilities, advanced technical expertise, and proven proficiency. As Microsoft's 19-time Global Systems Integrator Partner of the Year award recipient, Accenture provides state-of-the-art solutions and seamless integration, positioning itself as the foremost partner for all enterprise requirements. |
|[Armis](https://www.armisgroup.com/services/it-services/security-and-identity/identity/)|Armis, applying over 20 years of digital transformation expertise, provides global tech solutions as a trusted Microsoft partner. We specialize in security, data and AI, also business applications, delivering innovative solutions that boost efficiency and sustainable growth. By using the comprehensive capabilities of the Microsoft Entra Suite, Armis supports businesses in adopting Zero Trust principles. This effort fortifies their security posture and enabling a resilient, future-ready infrastructure. |
|[Ascent Solutions](https://www.meetascent.com/services/cybersecurity/identity-management)|Ascent Solutions accelerates secure Microsoft Entra adoption by combining deep identity expertise with tailored deployment, governance, and protection services. We optimize Microsoft Entra to enable secure single sign-on (SSO), Microsoft Entra multi-factor authentication (MFA), and Microsoft Entra Conditional Access, while aligning identity governance with compliance goals. Ascent empowers organizations to reduce risk, simplify access, and fully enable their Microsoft investment. |
|[Atea](https://www.atea.se/eshop/campaigns/microsoft-entra-suite)|Atea is the largest Microsoft partner in the Nordic and Baltic regions. We are specialized in providing our customers with professional services around Microsoft Entra. With our license specialists and certified experts, we make sure that our customers get the full value out of the components in the Microsoft Entra Suite. |
|[Avande](https://www.avanade.com/en/services/microsoft-tech/microsoft-security/advanced-identity)|Avanade's asset-driven approach to the Microsoft Entra Suite harnesses a robust Microsoft Entra ID Governance content library, complete with repeatable lifecycle workflows, and advanced assets for Microsoft Entra Verified ID. It also features accelerated methodologies for Security Service Edge (SSE), streamlining adoption and migration from legacy solutions. This distinctive strategy boosts security, improves operational efficiency, and speeds up transformation. |
|[baseVISION AG](https://www.basevision.ch/our-solutions/identity-management-solutions/)|baseVISION is a leading Microsoft Security Partner focused on secure and modern endpoint management. Our Microsoft Entra ID Governance services enable companies to transform their identity and access management (IAM) processes around the globe, in a more efficient and modern way, and at an enterprise scale. We combine exceptional knowledge with practical experience, thanks to our focused company strategy and partnership with Microsoft. |
|[BDO](https://www.bdo.com/services/bdo-digital/cybersecurity)|As a global cybersecurity advisor and integrator, BDO helps clients manage risk and transform their organization with the Microsoft Entra Suite. Using our industry experience, we help clients grow confidently with transformative security and cloud solutions that implement the right identity strategy and governance, powered by Microsoft. |
|[Campana & Schott](https://www.campana-schott.com/de/en/expertise/strategie/cyber-security-services/identity-access-management)|Campana & Schott is an international management and technology consultancy with more than 600 employees in Europe and the U.S. We have longstanding transformation experience, and in-depth knowledge of Microsoft technologies, IT strategy, and IT organization. We're an ideal partner to support you in your identity and access management (IAM) transformation with the Microsoft Entra Suite. |
|[Condatis](https://condatis.com/technology/microsoft-entra-suite/)|Condatis delivers practical identity solutions using the Microsoft Entra Suite for complex global clients. Working closely with Microsoft, Condatis has strong IAM expertise, focused on reducing cyber risk, and optimizing costs. The Microsoft Entra Suite ensures seamless and secure access to empower your workforce, safeguard your digital ecosystem, and deliver measurable business outcomes. |
|[Cyclotron](https://www.cyclotron.com/post/streamline-identity-access-management-with-microsofts-entra-suite)|Cyclotron provides expert migration for SailPoint to the Microsoft Entra Suite, Okta to the Microsoft Entra Suite, and specialized knowledge of other toolset migration. Our proprietary migration tools significantly help accelerate deployment timelines, while our Change Leadership experts ease the burden of change on users and seamlessly engage stakeholders throughout the success strategy. |
|[DXC Technologies](https://dxc.com/content/dam/dxc/projects/dxc-com/us/pdfs/practices/DXC%20Service%20for%20MS%20Entra%20FS.pdf)|DXC Technology, a trusted global partner, is excited to enable the spectrum of controls in the Microsoft Entra Suite. We help organizations improve efficiencies and adopt a Zero Trust model through strategy, planning, preparation, transformation. We enable operational management of key security domains including identity, network, devices, applications, workloads, and data. |
|[Ernst & Young, LLP](https://www.ey.com/en_us/alliances/simplify-your-cybersecurity-with-the-ey-microsoft-alliance)|EY is a trusted global leader in professional services that creates a better working world with people at the center, using technology at scale and driving innovation at speed. The EY-Microsoft Alliance collaborates on innovative identity management solutions with Microsoft Entra, transforming the way businesses protect and manage identities, creating a future where trust and safety are paramount. |
|[Japan Business System, Inc.](https://blog.jbs.co.jp/archive/category/Microsoft%20Entra%20ID)|JBS has extensive integration experience and expertise in Microsoft Entra and Microsoft 365, and provides one-stop services across all phases, from initial planning and validation to implementation, deployment, and operational support. Their strong partnership with Microsoft further strengthens their ability to deliver comprehensive solutions. |
|[Kloudynet](https://www.kloudynet.com/services/identity-security/)|Kloudynet delivers Zero Trust-aligned Converged Identity solutions on the Microsoft Entra Suite. Our KloudIdentity platform accelerates app onboarding, enables user reconciliation, and supports Linux, SQL, and AS400, with enterprise resource planning (ERP) integrations on the roadmap. As a Microsoft Intelligent Security Association (MISA) member, we bring deep identity expertise, and faster time-to-value than traditional identity governance and administration (IGA) implementations. |
|[Kocho Group](https://kocho.co.uk/solutions/identity-governance/)|Kocho uses the Microsoft Entra Suite, including Microsoft Entra ID Governance, Microsoft Entra Verified ID, and Microsoft Entra Private Access, to provide tailored assessments and services. We helped UK organizations, across many industries modernize identity management, secure access, and reduce operational complexity through automated user lifecycle processes and privileged account management. We can start you on your journey with a free-of-charge Vision Call, led by one of our Identity Architects. |
|[KPMG](https://kpmg.com/us/en/capabilities-services/advisory-services/cyber-security-services.html)|KPMG's offering with the Microsoft Entra Suite is built on our award winning, proprietary Powered Enterprise methodology and accelerators. With this approach, our clients supercharge their transformation initiatives and enable seamless, standards-based, and scalable deployments with Zero Trust architecture at its core.|
|[MajorKey Technologies](https://www.majorkeytech.com/microsoft-entra-id-partner)|MajorKey, a Microsoft Elite Partner, accelerates identity and access management transformation with the Microsoft Entra AI-driven, cloud-native platform. We help clients move beyond stalled, partially deployed systems by rapidly implementing unified identity and access management (IAM) strategies. We seamlessly integrate advanced security features, and eliminate costly legacy inefficiencies, while future-proofing identity security programs with Zero Trust principles. |
|[MSP Corp](https://mspcorp.ca/technologies/microsoft-entra-consulting-services/)|MSP Corp offers Microsoft Entra Suite solutions that enhance security, streamline identity management, and ensure integration. Our expert team can help deploy Microsoft Entra Private Access, replacing virtual private networks (VPNs), and Face Check with Microsoft Entra Verified ID, enabling users to verify identity through facial recognition against a digital credential, ensuring secure access. |

|Partner|Description|
|---|---|
|Accenture|Accenture's Microsoft Entra Suite offering is distinguished by its exceptional global delivery capabilities, advanced technical expertise, and proven proficiency. As Microsoft's 19-time Global Systems Integrator Partner of the Year award recipient, Accenture provides state-of-the-art solutions and seamless integration, positioning itself as the foremost partner for all enterprise requirements. |
|[Armis](https://www.armisgroup.com/services/it-services/security-and-identity/identity/)|Armis applies over 20 years of digital transformation expertise, and provides global tech solutions as a trusted Microsoft partner. We specialize in security, data and AI, also business applications, delivering innovative solutions that boost efficiency and sustainable growth. By using the comprehensive capabilities of the Microsoft Entra Suite, Armis supports businesses in adopting Zero Trust principles. This effort fortifies their security posture and enabling a resilient, future-ready infrastructure. |
|[Ascent Solutions](https://www.meetascent.com/services/cybersecurity/identity-management)|Ascent Solutions accelerates secure Microsoft Entra adoption by combining deep identity expertise with tailored deployment, governance, and protection services. We optimize Microsoft Entra to enable secure single sign-on (SSO), Microsoft Entra multi-factor authentication (MFA), and Microsoft Entra Conditional Access, while aligning identity governance with compliance goals. Ascent empowers organizations to reduce risk, simplify access, and fully enable their Microsoft investment. |
|[Atea](https://www.atea.se/eshop/campaigns/microsoft-entra-suite)|Atea is the largest Microsoft partner in the Nordic and Baltic regions. We are specialized in providing our customers with professional services around Microsoft Entra. With our license specialists and certified experts, we make sure that our customers get the full value out of the components in the Microsoft Entra Suite. |
|[Avande](https://www.avanade.com/en/services/microsoft-tech/microsoft-security/advanced-identity)|Avanade's asset-driven approach to the Microsoft Entra Suite harnesses a robust Microsoft Entra ID Governance content library, complete with repeatable lifecycle workflows, and advanced assets for Microsoft Entra Verified ID. It also features accelerated methodologies for Security Service Edge (SSE), streamlining adoption and migration from legacy solutions. This distinctive strategy boosts security, improves operational efficiency, and speeds up transformation. |
|[baseVISION AG](https://www.basevision.ch/our-solutions/identity-management-solutions/)|baseVISION is a leading Microsoft Security Partner focused on secure and modern endpoint management. Our Microsoft Entra ID Governance services enable companies to transform their identity and access management (IAM) processes around the globe, in a more efficient and modern way, and at an enterprise scale. We combine exceptional knowledge with practical experience, thanks to our focused company strategy and partnership with Microsoft. |
|[BDO](https://www.bdo.com/services/bdo-digital/cybersecurity)|As a global cybersecurity advisor and integrator, BDO helps clients manage risk and transform their organization with the Microsoft Entra Suite. Using our industry experience, we help clients grow confidently with transformative security and cloud solutions that implement the right identity strategy and governance, powered by Microsoft. |
|[Campana & Schott](https://www.campana-schott.com/de/en/expertise/strategie/cyber-security-services/identity-access-management)|Campana & Schott is an international management and technology consultancy with more than 600 employees in Europe and the U.S. We have longstanding transformation experience, and in-depth knowledge of Microsoft technologies, IT strategy, and IT organization. We're an ideal partner to support you in your identity and access management (IAM) transformation with the Microsoft Entra Suite. |
|[Condatis](https://condatis.com/technology/microsoft-entra-suite/)|Condatis delivers practical identity solutions using the Microsoft Entra Suite for complex global clients. Condatis works closely with Microsoft to enable our strong IAM expertise, focused on reducing cyber risk, and optimizing costs. The Microsoft Entra Suite ensures seamless and secure access to empower your workforce, safeguard your digital ecosystem, and deliver measurable business outcomes. |
|[Cyclotron](https://www.cyclotron.com/post/streamline-identity-access-management-with-microsofts-entra-suite)|Cyclotron provides expert migration for SailPoint to the Microsoft Entra Suite, Okta to the Microsoft Entra Suite, and specialized knowledge of other toolset migration. Our proprietary migration tools significantly help accelerate deployment timelines, while our Change Leadership experts ease the burden of change on users and seamlessly engage stakeholders throughout the success strategy. |
|[DXC Technologies](https://dxc.com/content/dam/dxc/projects/dxc-com/us/pdfs/practices/DXC%20Service%20for%20MS%20Entra%20FS.pdf)|DXC Technology, a trusted global partner, is excited to enable the spectrum of controls in the Microsoft Entra Suite. We help organizations improve efficiencies and adopt a Zero Trust model through strategy, planning, preparation, transformation. We enable operational management of key security domains including identity, network, devices, applications, workloads, and data. |
|[Ernst & Young, LLP](https://www.ey.com/en_us/alliances/simplify-your-cybersecurity-with-the-ey-microsoft-alliance)|EY is a trusted global leader in professional services that creates a better working world with people at the center, using technology at scale and driving innovation at speed. The EY-Microsoft Alliance collaborates on innovative identity management solutions with Microsoft Entra, transforming the way businesses protect and manage identities, creating a future where trust and safety are paramount. |
|[Japan Business System, Inc.](https://blog.jbs.co.jp/archive/category/Microsoft%20Entra%20ID)|JBS has extensive integration experience and expertise in Microsoft Entra and Microsoft 365, and provides one-stop services across all phases, from initial planning and validation to implementation, deployment, and operational support. Their strong partnership with Microsoft further strengthens their ability to deliver comprehensive solutions. |
|[Kloudynet](https://www.kloudynet.com/services/identity-security/)|Kloudynet delivers Zero Trust-aligned Converged Identity solutions on the Microsoft Entra Suite. Our KloudIdentity platform accelerates app onboarding, enables user reconciliation, and supports Linux, SQL, and AS400, with enterprise resource planning (ERP) integrations on the roadmap. As a Microsoft Intelligent Security Association (MISA) member, we bring deep identity expertise, and faster time-to-value than traditional identity governance and administration (IGA) implementations. |
|[Kocho Group](https://kocho.co.uk/solutions/identity-governance/)|Kocho uses the Microsoft Entra Suite, including Microsoft Entra ID Governance, Microsoft Entra Verified ID, and Microsoft Entra Private Access, to provide tailored assessments and services. We helped UK organizations, across many industries modernize identity management, secure access, and reduce operational complexity through automated user lifecycle processes and privileged account management. We can start you on your journey with a free-of-charge Vision Call, led by one of our Identity Architects. |
|[KPMG](https://kpmg.com/us/en/capabilities-services/advisory-services/cyber-security-services.html)|KPMG's offering with the Microsoft Entra Suite is built on our award winning, proprietary Powered Enterprise methodology, and accelerators. With this approach, our clients supercharge their transformation initiatives and enable seamless, standards-based, and scalable deployments with Zero Trust architecture at its core.|
|[MajorKey Technologies](https://www.majorkeytech.com/microsoft-entra-id-partner)|MajorKey, a Microsoft Elite Partner, accelerates identity and access management transformation with the Microsoft Entra AI-driven, cloud-native platform. We help clients move beyond stalled, partially deployed systems by rapidly implementing unified identity and access management (IAM) strategies. We seamlessly integrate advanced security features, and eliminate costly legacy inefficiencies, while future-proofing identity security programs with Zero Trust principles. |
|[MSP Corp](https://mspcorp.ca/technologies/microsoft-entra-consulting-services/)|MSP Corp offers Microsoft Entra Suite solutions that enhance security, streamline identity management, and ensure integration. Our expert team can help deploy Microsoft Entra Private Access, replacing virtual private networks (VPNs), and Face Check with Microsoft Entra Verified ID, enabling users to verify identity through facial recognition against a digital credential, ensuring secure access. |

MODIFIED docs/external-id/customers/how-to-create-external-tenant-portal.md

Modified by Csilla Mulligan on May 21, 2025 10:04 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update how-to-create-external-tenant-portal.md

Changes:

Before

After

 
ms.subservice: external
ms.topic: how-to
ms.date: 11/06/2024
ms.author: cmulligan
ms.custom: it-pro, seo-july-2024
 
 
    :::image type="content" source="media/how-to-create-external-tenant-portal/create-tenant.png" alt-text="Screenshot of the create tenant option.":::
 
1. Select **Customer**, and then **Continue**. 
 
    :::image type="content" source="media/how-to-create-external-tenant-portal/select-tenant-type.png" alt-text="Screenshot of the select tenant type screen.":::
 
 
- [Register an app](/entra/identity-platform/quickstart-register-app)
- [Create user flows](how-to-user-flow-sign-up-sign-in-customers.md)
- [Delete an external tenant](how-to-delete-external-tenant-portal.md)

 
ms.subservice: external
ms.topic: how-to
ms.date: 05/21/2025
ms.author: cmulligan
ms.custom: it-pro, seo-july-2024
 
 
    :::image type="content" source="media/how-to-create-external-tenant-portal/create-tenant.png" alt-text="Screenshot of the create tenant option.":::
 
1. Select **External**, and then **Continue**. 
 
    :::image type="content" source="media/how-to-create-external-tenant-portal/select-tenant-type.png" alt-text="Screenshot of the select tenant type screen.":::
 
 
- [Register an app](/entra/identity-platform/quickstart-register-app)
- [Create user flows](how-to-user-flow-sign-up-sign-in-customers.md)
- [Delete an external tenant](how-to-delete-external-tenant-portal.md)

MODIFIED docs/identity/enterprise-apps/f5-big-ip-kerberos-easy-button.md

Modified by omondiatieno on May 21, 2025 6:33 PM
📖 View on learn.microsoft.com

+3 / -2 lines changed

Commit: fix broken links

Changes:

Before

After

* Ensure the hostname for the domain controller and web application are resolvable in DNS
* Ensure there are no duplicate SPNs in your AD environment: execute the following query at the command line on a domain PC: setspn -q HTTP/my_target_SPN

You can refer to our [application proxy guidance](~/identity/app-proxy/application-proxy-back-end-kerberos-constrained-delegation-how-to.md) to validate an IIS application is configured for KCD. See also the AskF5 article, [Kerberos single sign on method](https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration/kerberos-single-sign-on-method.html).

### Log analysis: increase verbosity

For more information, see:

* dev/central: [APM variable assign examples](https://community.f5.com/t5/codeshare/apm-variable-assign-examples/ta-p/287962)
* MyF5: [Session Variables](https://techdocs.f5.com/en-us/bigip-15-0-0/big-ip-access-policy-manager-visual-policy-editor/session-variables.html)

* Ensure the hostname for the domain controller and web application are resolvable in DNS
* Ensure there are no duplicate SPNs in your AD environment: execute the following query at the command line on a domain PC: setspn -q HTTP/my_target_SPN

You can refer to our [application proxy guidance](~/identity/app-proxy/application-proxy-back-end-kerberos-constrained-delegation-how-to.md) to validate an IIS application is configured for KCD. See also the AskF5 article, [Kerberos single sign on method](https://techdocs.f5.com/en-us/bigip-17-1-0/big-ip-access-policy-manager-single-sign-on-concepts-configuration/kerberos-single-sign-on-method.html).

### Log analysis: increase verbosity

For more information, see:

* dev/central: [APM variable assign examples](https://community.f5.com/t5/codeshare/apm-variable-assign-examples/ta-p/287962)
* MyF5: [Session Variables](https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-visual-policy-editor/session-variables.html)

MODIFIED docs/identity/devices/howto-device-identity-virtual-desktop-infrastructure.md

Modified by Sandeep Deo on May 21, 2025 12:36 PM
📖 View on learn.microsoft.com

+4 / -1 lines changed

Commit: Update howto-device-identity-virtual-desktop-infrastructure.md

Changes:

Before

After

ms.service: entra-id
ms.subservice: devices
ms.topic: conceptual
ms.date: 11/25/2024
 
ms.author: owinfrey
author: owinfreyATL
|   |   |   | Non-persistent | No |
| Microsoft Entra registered | Federated/Managed | Windows current | Persistent/Non-persistent | Not Applicable |
 
<sup>3</sup> A **Federated** identity infrastructure environment represents an environment with an identity provider (IdP) such as AD FS or other non-Microsoft IdP. In a federated identity infrastructure environment, computers follow the [federated device registration flow](device-registration-how-it-works.md#microsoft-entra-joined-in-federated-environments) based on the [Microsoft Windows Server Active Directory Service Connection Point (SCP) settings](hybrid-join-manual.md#configure-a-service-connection-point).
 
<sup>4</sup> A **Managed** identity infrastructure environment represents an environment with Microsoft Entra ID as the identity provider deployed with either [password hash sync (PHS)](~/identity/hybrid/connect/whatis-phs.md) or [pass-through authentication (PTA)](~/identity/hybrid/connect/how-to-connect-pta.md) with [seamless single sign-on](~/identity/hybrid/connect/how-to-connect-sso.md).
 
 
 

ms.service: entra-id
ms.subservice: devices
ms.topic: conceptual
ms.date: 05/21/2024
 
ms.author: owinfrey
author: owinfreyATL
|   |   |   | Non-persistent | No |
| Microsoft Entra registered | Federated/Managed | Windows current | Persistent/Non-persistent | Not Applicable |
 
> [!IMPORTANT]
> When deploying a VDI farm (persistent or non-persistent), customers should take into consideration [Entra device registration throttling limits](https://learn.microsoft.com/graph/throttling-limits#identity-and-access-device-registration-service-limits). Microsoft recommends device registration requests to be stage at the rate of 750 to 1000 requests per 150 second interval. Failure to stage such requests can lead to throttling errros resulting in device registration failures.
 
<sup>3</sup> A **Federated** identity infrastructure environment represents an environment with an identity provider (IdP) such as AD FS or other non-Microsoft IdP. In a federated identity infrastructure environment, computers follow the [federated device registration flow](device-registration-how-it-works.md#microsoft-entra-joined-in-federated-environments) based on the [Microsoft Windows Server Active Directory Service Connection Point (SCP) settings](hybrid-join-manual.md#configure-a-service-connection-point).
 
<sup>4</sup> A **Managed** identity infrastructure environment represents an environment with Microsoft Entra ID as the identity provider deployed with either [password hash sync (PHS)](~/identity/hybrid/connect/whatis-phs.md) or [pass-through authentication (PTA)](~/identity/hybrid/connect/how-to-connect-pta.md) with [seamless single sign-on](~/identity/hybrid/connect/how-to-connect-sso.md).

MODIFIED docs/external-id/identity-providers.md

Modified by Michele Martin on May 21, 2025 8:50 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: update author metadata

Changes:

Before

After

ms.service: entra-external-id
ms.topic: concept-article
ms.date: 04/16/2025
 
ms.author: mimart
author: msmimart
manager: celestedg
 
ms.collection: M365-identity-device-management

ms.service: entra-external-id
ms.topic: concept-article
ms.date: 04/16/2025
ms.author: cmulligan
author: csmulligan
manager: celestedg
 
ms.collection: M365-identity-device-management
 

MODIFIED docs/external-id/self-service-portal.md

Modified by Michele Martin on May 21, 2025 8:50 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: update author metadata

Changes:

Before

After

ms.service: entra-external-id
ms.topic: concept-article
ms.date: 04/15/2025
 
ms.author: mimart
author: msmimart
manager: celestedg
 
ms.collection: M365-identity-device-management

ms.service: entra-external-id
ms.topic: concept-article
ms.date: 04/15/2025
ms.author: cmulligan
author: csmulligan
manager: celestedg
 
ms.collection: M365-identity-device-management
 

MODIFIED docs/external-id/self-service-sign-up-add-api-connector.md

Modified by Michele Martin on May 21, 2025 8:50 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: update author metadata

Changes:

Before

After

ms.service: entra-external-id
ms.topic: how-to
ms.date: 04/15/2025
 
ms.author: mimart
author: msmimart
manager: celestedg
ms.custom: "it-pro"
ms.collection: M365-identity-device-management

ms.service: entra-external-id
ms.topic: how-to
ms.date: 04/15/2025
ms.author: cmulligan
author: csmulligan
manager: celestedg
ms.custom: "it-pro"
ms.collection: M365-identity-device-management
 

MODIFIED docs/external-id/self-service-sign-up-add-approvals.md

Modified by Michele Martin on May 21, 2025 8:50 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: update author metadata

Changes:

Before

After

ms.service: entra-external-id
ms.topic: how-to
ms.date: 05/20/2025
 
ms.author: mimart
author: msmimart
manager: celestedg
ms.custom: "it-pro"
ms.collection: M365-identity-device-management

ms.service: entra-external-id
ms.topic: how-to
ms.date: 05/20/2025
ms.author: cmulligan
author: csmulligan
manager: celestedg
ms.custom: "it-pro"
ms.collection: M365-identity-device-management
 

MODIFIED docs/external-id/self-service-sign-up-overview.md

Modified by Michele Martin on May 21, 2025 8:50 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: update author metadata

Changes:

Before

After

ms.service: entra-external-id
ms.topic: concept-article
ms.date: 10/21/2024
 
ms.author: mimart
author: msmimart
manager: celestedg
 
ms.collection: M365-identity-device-management

ms.service: entra-external-id
ms.topic: concept-article
ms.date: 10/21/2024
ms.author: cmulligan
author: csmulligan
manager: celestedg
 
ms.collection: M365-identity-device-management
 

MODIFIED docs/external-id/self-service-sign-up-secure-api-connector.md

Modified by Michele Martin on May 21, 2025 8:50 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: update author metadata

Changes:

Before

After

ms.service: entra-external-id
ms.topic: how-to
ms.date: 04/15/2025
 
ms.author: mimart
author: msmimart
manager: celestedg
ms.custom: "it-pro"
ms.collection: M365-identity-device-management

ms.service: entra-external-id
ms.topic: how-to
ms.date: 04/15/2025
ms.author: cmulligan
author: csmulligan
manager: celestedg
ms.custom: "it-pro"
ms.collection: M365-identity-device-management
 

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files