Microsoft Entra Documentation Changes

MODIFIED docs/identity-platform/how-to-native-authentication-cors-solution-test-environment.md

Modified by yongdiw on May 22, 2025 5:38 AM
📖 View on learn.microsoft.com

+18 / -54 lines changed

Commit: Update Native Auth cors proxy docs

Changes:

Before

After

## Prerequisites
 
- An Azure subscription. [Create an account for free](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
- [Azure Developer CLI](/cli/azure/install-azure-cli). After you install it, sign into it for the first time. For more information, see [Sign into the Azure CLI](/cli/azure/get-started-with-azure-cli#sign-into-the-azure-cli).
- A sample SPA that you can access via a URL such as `http://www.contoso.com`:
    - You can use the React app described in [Quickstart: Sign in users into a sample React SPA by using native authentication API](quickstart-native-authentication-single-page-app-react-sign-in.md). However, don't configure or run the proxy server, as this guide covers that setup.
    - Once you run the app, record the app URL for later use in this guide.
 
## Create reverse proxy in an Azure function app by using Azure Resource Manager template
 
1. [Create a Resource Group](/azure/azure-resource-manager/management/manage-resource-groups-cli#create-resource-groups) using `az group create`
 
    ```console
    az group create --name Enter_Resource_Group_Name_Here --location Enter_Location_Name_Here
    ```
 
    Replace the placeholder:
    - `Enter_Resource_Group_Name_Here` with the name of the new resource group.
    - `Enter_Location_Name_Here` with the geographical region where the resource group is created. 
 

## Prerequisites
 
- An Azure subscription. [Create an account for free](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
- Register `Microsoft.App` resource provider, see [How to register resource provider](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types#register-resource-provider-1). This step only needs to be done once with newly created subscription.
- Install [Azure Developer CLI (azd)](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/install-azd?tabs=winget-windows%2Cbrew-mac%2Cscript-linux&pivots=os-windows).
- A sample SPA that you can access via a URL such as `http://www.contoso.com`:
    - You can use the React app described in [Quickstart: Sign in users into a sample React SPA by using native authentication API](quickstart-native-authentication-single-page-app-react-sign-in.md). However, don't configure or run the proxy server, as this guide covers that setup.
    - Once you run the app, record the app URL for later use in this guide.
 
## Create reverse proxy in an Azure function app by using Azure Developer CLI (azd) template
 
1. Initialize the azd template
 
    ```console
    azd init --template https://github.com/azure-samples/ms-identity-extid-cors-proxy-function
    ```
 
    When prompted, enter a name for the azd environment. This name will be used as a prefix for the resource group so it should be unique within your Azure subscription.
 
1. Sign in to Azure

MODIFIED docs/global-secure-access/how-to-transport-layer-security.md

Modified by jayrusso on May 22, 2025 10:48 AM
📖 View on learn.microsoft.com

+37 / -30 lines changed

Commit: May 21 edits per PM feedback

Changes:

Before

After

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 05/20/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (Preview)
Because most internet traffic is encrypted, terminating Transport Layer Security (TLS) at the edge allows Global Secure Access to decrypt and inspect traffic. This inspection enables Global Secure Access to enforce security policies such as threat detection, content filtering, and fine-grained access controls, which enhances protection against threats concealed within encrypted communications.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
 
## Create a context-aware TLS inspection policy
To create a context-aware Transport Layer Security inspection policy and assign the policy to users in your organization, complete the following steps:
1. [Create a CSR and upload the signed certificate for TLS termination](#step-1-global-secure-access-admin-create-a-certificate-signing-request-csr-and-upload-the-signed-certificate-for-tls-termination)
1. [Create a TLS inspection policy](#step-2-global-secure-access-admin-create-a-tls-inspection-policy)
1. [Assign the TLS inspection policy](#step-3-global-secure-access-admin-assign-the-tls-inspection-policy)

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 05/21/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (Preview)
Transport Layer Security (TLS) inspection allows Global Secure Access to decrypt and inspect traffic at edge locations. This inspection enables Global Secure Access to enforce security policies such as threat detection, content filtering, and fine-grained access controls, which enhances protection against threats concealed within encrypted communications.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
 
## Create a context-aware TLS inspection policy
To create a context-aware Transport Layer Security inspection policy and assign the policy to users in your organization, complete the following steps:
1. [Create a CSR and upload the signed certificate for TLS termination](#step-1-global-secure-access-admin-create-a-csr-and-upload-the-signed-certificate-for-tls-termination)
1. [Create a TLS inspection policy](#step-2-global-secure-access-admin-create-a-tls-inspection-policy)
1. [Link the TLS inspection policy to a security profile](#step-3-global-secure-access-admin-link-the-tls-inspection-policy-to-a-security-profile)

MODIFIED docs/identity-platform/consent-types-developer.md

Modified by omondiatieno on May 22, 2025 1:03 AM
📖 View on learn.microsoft.com

+34 / -28 lines changed

Commit: Review content for technical accuracy and clarity

Changes:

Before

After

---
title: Microsoft identity platform developers' guide to requesting permissions through consent
description: Learn how developers can request for permissions through consent in the Microsoft identity platform endpoint.
author: omondiatieno
manager: celesteDG
ms.author: jomondi
ms.date: 04/10/2024
ms.reviewer: jawoods, ludwignick, phsignor
ms.service: identity-platform
 
 
#Customer intent: As a developer building an application that requires user consent for accessing resources or APIs, I want to understand the different types of consent available (static, incremental, dynamic) and how to request permissions through consent, so that I can implement the appropriate consent approach in my application and provide a better user experience.
---
# Requesting permissions through consent
 
Applications in the Microsoft identity platform rely on consent in order to gain access to necessary resources or APIs. Different types of consent are better for different application scenarios. Choosing the best approach to consent for your app will help it be more successful with users and organizations.
 
In this article, you'll learn about the different types of consent and how to request permissions for your application through consent.
 
## Static user consent

---
title: Developer’s Guide to Requesting Permissions and Consent in Microsoft Identity Platform
description: Learn how developers can request for permissions through consent in the Microsoft identity platform endpoint.
author: omondiatieno
manager: celesteDG
ms.author: jomondi
ms.date: 05/21/2025
ms.reviewer: jawoods, ludwignick, phsignor
ms.service: identity-platform
 
 
#Customer intent: As a developer building an application that requires user consent for accessing resources or APIs, I want to understand the different types of consent available (static, incremental, dynamic) and how to request permissions through consent, so that I can implement the appropriate consent approach in my application and provide a better user experience.
---
# Developer’s guide to requesting permissions and consent in Microsoft Identity Platform
 
Applications in the Microsoft identity platform rely on consent in order to gain access to necessary resources or APIs. Different types of consent are better for different application scenarios. Choosing the best approach to consent for your app enables it to be more successful with users and organizations.
 
In this article, you learn about the different types of consent and how to request permissions for your application through consent.
 
## Static user consent

MODIFIED docs/identity-platform/how-to-native-authentication-cors-solution-production-environment.md

Modified by yongdiw on May 22, 2025 5:38 AM
📖 View on learn.microsoft.com

+32 / -1 lines changed

Commit: Update Native Auth cors proxy docs

Changes:

Before

After

- A sample SPA that you can access via a URL such as `http://www.contoso.com`:
    - You can use the React app described in [Quickstart: Sign in users into a sample React SPA by using native authentication API](quickstart-native-authentication-single-page-app-react-sign-in.md). However, don't configure or run the proxy server, as this guide covers that setup.
    - Once you run the app, record the app URL for later use in this guide. In production, this URL contains the domain that you want to use as a custom domain URL, such as `http://www.contoso.com`
 
## Set up Azure Front Door as a reverse proxy
 
1. Familiarize yourself how to use Azure Front Door with CORS by reading through the article at [Using Azure Front Door Standard/Premium with CORS](/azure/frontdoor/standard-premium/troubleshoot-cross-origin-resources).
1. Use the instructions in [Enable custom URL domains for apps in external tenants](../external-id/customers/how-to-custom-url-domain.md) to add a custom domain name to your external tenant and create an Azure Front Door.
1. In your sample SPA, open the *API\React\ReactAuthSimple\src\config.ts* file, then replace the value of `BASE_API_URL`, *http://localhost:3001/api*, with `https://Enter_Custom_Domain_URL/Enter_the_Tenant_ID_Here`. Replace the placeholder:
    1. `Enter_Custom_Domain_URL` with your custom domain url, such as `contoso.com`.
    1. `Enter_the_Tenant_ID_Here` with your Directory (tenant) ID. If you don't have your tenant ID, learn how to [read your tenant details](../external-id/customers/how-to-create-external-tenant-portal.md#get-the-external-tenant-details).
1. If necessary, rerun your sample SPA. 
 
## Guidelines for using Azure Front Door as a reverse proxy

- A sample SPA that you can access via a URL such as `http://www.contoso.com`:
    - You can use the React app described in [Quickstart: Sign in users into a sample React SPA by using native authentication API](quickstart-native-authentication-single-page-app-react-sign-in.md). However, don't configure or run the proxy server, as this guide covers that setup.
    - Once you run the app, record the app URL for later use in this guide. In production, this URL contains the domain that you want to use as a custom domain URL, such as `http://www.contoso.com`
- Install [Azure Developer CLI (azd)](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/install-azd?tabs=winget-windows%2Cbrew-mac%2Cscript-linux&pivots=os-windows).
 
## Set up Azure Front Door as a reverse proxy
 
1. Familiarize yourself how to use Azure Front Door with CORS by reading through the article at [Using Azure Front Door Standard/Premium with CORS](/azure/frontdoor/standard-premium/troubleshoot-cross-origin-resources).
1. Use the instructions in [Enable custom URL domains for apps in external tenants](../external-id/customers/how-to-custom-url-domain.md) to add a custom domain name to your external tenant.
    - For creating an Azure Front Door, [use azd template](#create-azure-front-door-as-a-reverse-proxy-using-an-azure-developer-cli-azd-template).
1. In your sample SPA, open the *API\React\ReactAuthSimple\src\config.ts* file, then replace the value of `BASE_API_URL`, *http://localhost:3001/api*, with `https://Enter_Custom_Domain_URL/Enter_the_Tenant_ID_Here`. Replace the placeholder:
    1. `Enter_Custom_Domain_URL` with your custom domain url, such as `contoso.com`.
    1. `Enter_the_Tenant_ID_Here` with your Directory (tenant) ID. If you don't have your tenant ID, learn how to [read your tenant details](../external-id/customers/how-to-create-external-tenant-portal.md#get-the-external-tenant-details).
1. If necessary, rerun your sample SPA. 
 
## Create Azure Front Door as a Reverse Proxy using an Azure Developer CLI (azd) template
 
1. Initialize the azd template
 
    ```console

MODIFIED docs/id-governance/entitlement-management-access-package-eligible.md

Modified by Ortagus Winfrey on May 22, 2025 1:31 AM
📖 View on learn.microsoft.com

+28 / -0 lines changed

Commit: Updates

Changes:

Before

After

 
## Create a group
 
## Enable management of group with PIM
 
## Add the resource to an access package
TODO: Add introduction sentence(s)

 
## Create a group
 
These steps walk you through creating the group that you will enable to be managed by PIM. 
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [User Administrator](~/identity/role-based-access-control/permissions-reference.md#user-administrator).
 
1. Browse to **Entra ID** > **Groups** > **All groups**.
 
1. Select **New group**.
 
1. Give the group a name and description and then complete the other required options:
   - **Group Type:** Security
   - **Membership type:** Select *Assigned*.
   :::image type="content" source="media/entitlement-management-access-package-eligible/create-group-eligible.png" alt-text="Picture of creating the group for the access package.":::
1. Select **Create**.
 
## Enable management of group with PIM

MODIFIED docs/identity/authentication/howto-mfa-mfasettings.md

Modified by Justinha on May 22, 2025 7:03 AM
📖 View on learn.microsoft.com

+1 / -24 lines changed

Commit: removed account lockout section for deprecated MFA server

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/19/2025
 
ms.author: justinha
author: justinha
 
| Feature | Description |
| ------- | ----------- |
| [Account lockout (MFA Server only)](#account-lockout-mfa-server-only) | Temporarily lock accounts from using Microsoft Entra MFA if there are too many denied authentication attempts in a row. This feature applies only to users who use MFA Server to enter a PIN to authenticate. |
| [Report suspicious activity](#report-suspicious-activity) | Configure settings that allow users to report fraudulent verification requests. |
| [OATH tokens](concept-authentication-oath-tokens.md) | Used in cloud-based Microsoft Entra MFA environments to manage OATH tokens for users. |
| [Phone call settings](#phone-call-settings) | Configure settings related to phone calls and greetings for cloud and on-premises environments. |
| Providers | This will show any existing authentication providers that you've associated with your account. Adding new providers is disabled as of September 1, 2018. |
 
## Account lockout (MFA Server only)
 
 
>[!NOTE]

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/21/2025
 
ms.author: justinha
author: justinha
 
| Feature | Description |
| ------- | ----------- |
| [Report suspicious activity](#report-suspicious-activity) | Configure settings that allow users to report fraudulent verification requests. |
| [OATH tokens](concept-authentication-oath-tokens.md) | Used in cloud-based Microsoft Entra MFA environments to manage OATH tokens for users. |
| [Phone call settings](#phone-call-settings) | Configure settings related to phone calls and greetings for cloud and on-premises environments. |
| Providers | This will show any existing authentication providers that you've associated with your account. Adding new providers is disabled as of September 1, 2018. |
 
## Report suspicious activity
 
When an unknown and suspicious MFA prompt is received, users can report the activity by using Microsoft Authenticator or through their phone. **Report suspicious activity** is integrated with [Microsoft Entra ID Protection](~/id-protection/overview-identity-protection.md) for risk-driven remediation, reporting, and least-privileged administration. 
 
 

MODIFIED docs/identity/monitoring-health/concept-sign-ins.md

Modified by shlipsey3 on May 22, 2025 10:01 AM
📖 View on learn.microsoft.com

+13 / -11 lines changed

Commit: cleanup

Changes:

Before

After

- **How** – The client (Application) used for the sign-in.  
- **What** – The target (Resource) accessed by the identity.
 
## How do you access the sign-in logs?
 
There are several ways to access the logs, depending on your needs. For more information, see [How to access activity logs](howto-access-activity-logs.md).
 
The classic sign-in logs only include interactive user sign-ins.
 
> [!NOTE]
> Entries in the sign-in logs are system generated and can't be changed or deleted.
 
## Sign-in data used by other services
 
Sign-in data is used by several services in Azure and Microsoft Entra to monitor risky sign-ins, provide insight into application usage, and more. 
 
### Microsoft Entra Agent ID
 
The Microsoft Entra Agent ID was launched at Microsoft Build 2025 and provides a unified directory of all agent identities created across Microsoft Copilot Studio and Azure AI Foundry. With this initial release, IT administrators can view and manage agent identities directly in the Microsoft Entra admin center, including updated sign-in logs. For more information, see the [Microsoft Entra Blog](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/announcing-microsoft-entra-agent-id-secure-and-manage-your-ai-agents/3827392) announcement.

- **How** – The client (Application) used for the sign-in.  
- **What** – The target (Resource) accessed by the identity.
 
> [!NOTE]
> Entries in the sign-in logs are system generated and can't be changed or deleted.
 
## How do you access the sign-in logs?
 
There are several ways to access the logs, depending on your needs. For more information, see [How to access activity logs](howto-access-activity-logs.md).
 
The classic sign-in logs only include interactive user sign-ins.
 
### Microsoft Entra Agent ID
 
The Microsoft Entra Agent ID was launched at Microsoft Build 2025 and provides a unified directory of all agent identities created across Microsoft Copilot Studio and Azure AI Foundry. With this initial release, IT administrators can view and manage agent identities directly in the Microsoft Entra admin center, including updated sign-in logs. Because agents can operate with user-delegated or app-only permissions, their sign-ins might appear across each of the four sign-in log types.
 
A new complex sign-in log resource type, `agentSignIn`, was added to the Microsoft Entra sign-in logs. This resource type contains properties about the agent, such as if the agent is an app or an instance of an app. If the agent type is `agenticAppInstance`, the `parentID` property is included to provide traceability to the provisioning agent.
 
The new sign-in log resource type is available in the Microsoft Entra admin center and the Microsoft Graph API.

MODIFIED docs/identity-platform/app-only-access-primer.md

Modified by omondiatieno on May 22, 2025 1:03 AM
📖 View on learn.microsoft.com

+12 / -12 lines changed

Commit: Review content for technical accuracy and clarity

Changes:

Before

After

author: omondiatieno
manager: celesteDG
ms.author: jomondi
ms.date: 03/15/2023
ms.reviewer: jawoods, ludwignick, phsignor
ms.service: identity-platform
 
#Customer intent: As a developer, I want to understand how application-only access works and when to use it, so that I can configure the appropriate app roles and permissions for my application and ensure secure access to resources without user interaction.
---
 
# Understanding application-only access
 
When an application directly accesses a resource, like Microsoft Graph, its access isn't limited to the files or operations available to any single user. The app calls APIs directly using its own identity, and a user or app with admin rights must authorize it to access the resources. This scenario is application-only access.
 
 
For example, to read a list of all teams created in an organization, you need to assign your application the Microsoft Graph `Team.ReadBasic.All` app role. This app role grants the ability to read this data when Microsoft Graph is the resource app. This assignment doesn't assign your client application to a Teams role that might allow it to view this data through other services.
 
As a developer, you need to configure all required app-only permissions, also referred to as app roles on your application registration. You can configure your app's requested app-only permissions through the Azure portal or Microsoft Graph. App-only access doesn't support dynamic consent, so you can't request individual permissions or sets of permissions at runtime.
 
Once you've configured all the permissions your app needs, it must get [admin consent](~/identity/enterprise-apps/grant-admin-consent.md) for it to access the resources. For example, only users with at least the Privileged Role Administrator role can grant app-only permissions (app roles) for the Microsoft Graph API. Users with other admin roles, like Application Administrator and Cloud Application Administrator, can grant app-only permissions for other resources.

author: omondiatieno
manager: celesteDG
ms.author: jomondi
ms.date: 05/21/2025
ms.reviewer: jawoods, ludwignick, phsignor
ms.service: identity-platform
 
#Customer intent: As a developer, I want to understand how application-only access works and when to use it, so that I can configure the appropriate app roles and permissions for my application and ensure secure access to resources without user interaction.
---
 
# Microsoft identity platform app-only access scenario
 
When an application directly accesses a resource, like Microsoft Graph, its access isn't limited to the files or operations available to any single user. The app calls APIs directly using its own identity, and a user or app with admin rights must authorize it to access the resources. This scenario is application-only access.
 
 
For example, to read a list of all teams created in an organization, you need to assign your application the Microsoft Graph `Team.ReadBasic.All` app role. This app role grants the ability to read this data when Microsoft Graph is the resource app. This assignment doesn't assign your client application to a Teams role that might allow it to view this data through other services.
 
As a developer, you need to configure all required app-only permissions, also referred to as app roles on your application registration. You can configure app-only permissions requested by your app through the Azure portal or Microsoft Graph. App-only access doesn't support dynamic consent, so you can't request individual permissions or sets of permissions at runtime.
 
Once you configure all the permissions your app needs, it must get [admin consent](~/identity/enterprise-apps/grant-admin-consent.md) for it to access the resources. For example, only users with at least the Privileged Role Administrator role can grant app-only permissions (app roles) for the Microsoft Graph API. Users with other admin roles, like Application Administrator and Cloud Application Administrator, can grant app-only permissions for other resources.

MODIFIED docs/identity/authentication/concept-fido2-hardware-vendor.md

Modified by Justinha on May 22, 2025 7:17 AM
📖 View on learn.microsoft.com

+14 / -9 lines changed

Commit: Update concept-fido2-hardware-vendor.md

Changes:

Before

After

---
title: Microsoft Entra ID attestation for FIDO2 security key vendors
description: Explains requirements to prepare FIDO2 hardware for attestation with Microsoft Entra ID
ms.date: 05/13/2025
ms.service: entra-id
ms.subservice: authentication
author: justinha
 
| Enforce attestation set to Yes | Enforce attestation set to No |
|--------------------------------|-------------------------------|
|It must provide a valid *packed* attestation statement and a complete certificate that chains back to the attestation roots extracted from the FIDO Alliance MDS, so that Microsoft can validate the key's metadata.|It must provide a valid *packed* attestation statement (but Microsoft will ignore attestation verification results) and a complete certificate (which doesn't need to be associated with a particular certificate chain). |
 
>[!NOTE]
>Vendors are responsible to publish all root attestation certificates to the FIDO Alliance MDS; otherwise, attestation verification can fail.
 
## FIDO2 security keys eligible for attestation with Microsoft Entra ID
 
The following table includes each FIDO2 security key model listed in MDS version 156 that's eligible for attestation with Microsoft Entra ID. For each model, the table shows its Authenticator Attestation Globally Unique Identifier (AAGUID) and feature capabilities. 
 
Description|AAGUID|Bio|USB|NFC|BLE

---
title: Microsoft Entra ID attestation for FIDO2 security key vendors
description: Explains requirements to prepare FIDO2 hardware for attestation with Microsoft Entra ID
ms.date: 05/06/2025
ms.service: entra-id
ms.subservice: authentication
author: justinha
 
| Enforce attestation set to Yes | Enforce attestation set to No |
|--------------------------------|-------------------------------|
|It must provide a valid *packed* attestation statement and a complete certificate that chains back to the attestation roots extracted from the FIDO Alliance MDS, so that Microsoft can validate the key's metadata.|It must provide a valid *packed* attestation statement (but Microsoft will ignore attestation verification results) and a complete certificate (which doesn’t need to be associated with a particular certificate chain). |
 
>[!NOTE]
>Vendors are responsible to publish all root attestation certificates to the FIDO Alliance MDS; otherwise, attestation verification can fail.
 
## FIDO2 security keys eligible for attestation with Microsoft Entra ID
 
The following table includes each FIDO2 security key model listed in MDS version 163 that's eligible for attestation with Microsoft Entra ID. For each model, the table shows its Authenticator Attestation Globally Unique Identifier (AAGUID) and feature capabilities. 
 
Description|AAGUID|Bio|USB|NFC|BLE

MODIFIED docs/identity/devices/macos-psso.md

Modified by Michael Epping on May 22, 2025 9:06 AM
📖 View on learn.microsoft.com

+10 / -10 lines changed

Commit: Updates for acrolinx

Changes:

Before

After

 
There are three different authentication methods that determine the end-user experience;
 
* **Platform Credential for macOS**: Provisions a secure enclave backed hardware-bound cryptographic key that is used for SSO across apps that use Microsoft Entra ID for authentication. The user’s local account password is not affected and is required to log on to the Mac.
* **Smart card**: The user signs in to the machine using an external smart card, or smart card-compatible hard token (for example, Yubikey). Once the device is unlocked, the smart card is used with Microsoft Entra ID to grant SSO across apps that use Microsoft Entra ID for authentication.
* **Password as authentication method**: Syncs the user’s Microsoft Entra ID password with the local account and enables SSO across apps that use Microsoft Entra ID for authentication.
 
* Saves customer organizations money by removing the need for security keys.
* Advances Zero Trust objectives using integration with the Secure Enclave.
 
To enable it, an administrator needs to configure PSSO through Microsoft Intune or other supported MDM. Depending on the how the device is configured, the end-user can set up their device with PSSO via secure enclave, smart card or password based authentication method.
 
## Requirements
 
* [Passwordless authentication options for Microsoft Entra ID](../../identity/authentication/concept-authentication-passwordless.md)
* [Plan a passwordless authentication deployment in Microsoft Entra ID](../../identity/authentication/howto-authentication-passwordless-deployment.md)
 
Platform Credential for macOS can also be used as a phishing resistant credential for use in WebAuthn challenges (including browser re-auth scenarios). Admins will need to enable the FIDO2 security key authentication method for this capability. If you leverage Key Restriction Policies in your FIDO policy then you will need to add the AAGUID for the macOS Platform Credential to your list of allowed AAGUIDs: `7FD635B3-2EF9-4542-8D9D-164F2C771EFC`
 
### Microsoft Platform SSO: UserSecureEnclaveKeyBiometricPolicy

 
There are three different authentication methods that determine the end-user experience;
 
* **Platform Credential for macOS**: Provisions a secure enclave backed hardware-bound cryptographic key that is used for SSO across apps that use Microsoft Entra ID for authentication. The user’s local account password isn't affected and is required to sign in to the Mac.
* **Smart card**: The user signs in to the machine using an external smart card, or smart card-compatible hard token (for example, Yubikey). Once the device is unlocked, the smart card is used with Microsoft Entra ID to grant SSO across apps that use Microsoft Entra ID for authentication.
* **Password as authentication method**: Syncs the user’s Microsoft Entra ID password with the local account and enables SSO across apps that use Microsoft Entra ID for authentication.
 
* Saves customer organizations money by removing the need for security keys.
* Advances Zero Trust objectives using integration with the Secure Enclave.
 
To enable it, an administrator needs to configure PSSO through Microsoft Intune or other supported MDM. Depending on how the device is configured, the end-user can set up their device with PSSO via secure enclave, smart card, or password based authentication method.
 
## Requirements
 
* [Passwordless authentication options for Microsoft Entra ID](../../identity/authentication/concept-authentication-passwordless.md)
* [Plan a passwordless authentication deployment in Microsoft Entra ID](../../identity/authentication/howto-authentication-passwordless-deployment.md)
 
Platform Credential for macOS can also be used as a phishing resistant credential for use in WebAuthn challenges (including browser re-authentication scenarios). Admins need to enable the FIDO2 security key authentication method for this capability. If you use key restrictions in your FIDO policy then you'll need to add the AAGUID for the macOS Platform Credential to your list of allowed AAGUIDs: `7FD635B3-2EF9-4542-8D9D-164F2C771EFC`
 
### Microsoft Platform SSO: UserSecureEnclaveKeyBiometricPolicy

MODIFIED docs/identity/enterprise-apps/application-management-certs-faq.md

Modified by omondiatieno on May 22, 2025 1:03 AM
📖 View on learn.microsoft.com

+7 / -7 lines changed

Commit: Review content for technical accuracy and clarity

Changes:

Before

After

ms.subservice: enterprise-apps
 
ms.topic: faq
ms.date: 05/17/2024
ms.author: jomondi
ms.reviewer: sureshja, saumadan
ms.custom: enterprise-apps
 
## How can I customize the expiration date for the certificates issued by Microsoft Entra ID?
 
By default, Microsoft Entra ID configures a certificate to expire after three years when it's created automatically during SAML single sign-on configuration. Because you can't change the date of a certificate after you save it, you need to create a new certificate. For steps on how to do so, refer [Customize the expiration date for your federation certificate and roll it over to a new certificate](./tutorial-manage-certificates-for-federated-single-sign-on.md#customize-the-expiration-date-for-your-federation-certificate-and-roll-it-over-to-a-new-certificate).
 
> [!NOTE]
> The recommended way to create SAML applications is through the Microsoft Entra Application Gallery, which will automatically create a three-year valid X509 certificate for you. 
 
## How can I automate the certificates expiration notifications?
 
Microsoft Entra ID sends an email notification 60, 30, and 7 days before the SAML certificate expires. You might add more than one email address to receive notifications.
 
> [!NOTE]

ms.subservice: enterprise-apps
 
ms.topic: faq
ms.date: 05/21/2025
ms.author: jomondi
ms.reviewer: sureshja, saumadan
ms.custom: enterprise-apps
 
## How can I customize the expiration date for the certificates issued by Microsoft Entra ID?
 
By default, Microsoft Entra ID configures a certificate to expire after three years after being created automatically during SAML single sign-on configuration. Because you can't change the date of a certificate after you save it, you need to create a new certificate. For steps on how to do so, refer [Customize the expiration date for your federation certificate and roll it over to a new certificate](./tutorial-manage-certificates-for-federated-single-sign-on.md#customize-the-expiration-date-for-your-federation-certificate-and-roll-it-over-to-a-new-certificate).
 
> [!NOTE]
> The recommended way to create SAML applications is through the Microsoft Entra Application Gallery, which automatically creates a three-year valid X509 certificate for you. 
 
## How can I automate the certificates expiration notifications?
 
Microsoft Entra ID sends an email notification 60, 30, and 7 days before the SAML certificate expires. You might add more than one email address to receive notifications.
 
> [!NOTE]

MODIFIED docs/identity/enterprise-apps/configure-risk-based-step-up-consent.md

Modified by omondiatieno on May 22, 2025 1:03 AM
📖 View on learn.microsoft.com

+7 / -7 lines changed

Commit: Review content for technical accuracy and clarity

Changes:

Before

After

ms.subservice: enterprise-apps
 
ms.topic: how-to
ms.date: 11/17/2021
ms.author: jomondi
ms.reviewer: phsignor
ms.custom: enterprise-apps, no-azure-ad-ps-ref, 
---
# Configure risk-based step-up consent using PowerShell
 
In this article, you'll learn how to configure risk-based step-up consent in Microsoft Entra ID. Risk-based step-up consent helps reduce user exposure to malicious apps that make [illicit consent requests](/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants). 
 
For example, consent requests for newly registered multitenant apps that are not [publisher verified](~/identity-platform/publisher-verification-overview.md) and require non-basic permissions are considered risky. If a risky user consent request is detected, the request requires a "step-up" to admin consent instead. This step-up capability is enabled by default, but it results in a behavior change only when user consent is enabled.
 
When a risky consent request is detected, the consent prompt displays a message that indicates that admin approval is needed. If the [admin consent request workflow](configure-admin-consent-workflow.md) is enabled, the user can send the request to an admin for further review directly from the consent prompt. If the admin consent request workflow isn't enabled, the following message is displayed:
 
> **AADSTS90094**: \<clientAppDisplayName> needs permission to access resources in your organization that only an admin can grant. Request an admin to grant permission to this app before you can use it.
 
In this case, an audit event is also logged with a category of "ApplicationManagement," an activity type of "Consent to application,"  and a status reason of "Risky application detected."
 

ms.subservice: enterprise-apps
 
ms.topic: how-to
ms.date: 05/21/2025
ms.author: jomondi
ms.reviewer: phsignor
ms.custom: enterprise-apps, no-azure-ad-ps-ref, 
---
# Configure risk-based step-up consent using PowerShell
 
In this article, you learn how to configure risk-based step-up consent in Microsoft Entra ID. Risk-based step-up consent helps reduce user exposure to malicious apps that make [illicit consent requests](/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants). 
 
For example, consent requests for newly registered multitenant apps that aren't [publisher verified](~/identity-platform/publisher-verification-overview.md) and require nonbasic permissions are considered risky. If a risky user consent request is detected, the request requires a "step-up" to admin consent instead. This step-up capability is enabled by default, but it results in a behavior change only when user consent is enabled.
 
When a risky consent request is detected, the consent prompt displays a message that indicates that admin approval is needed. If the [admin consent request workflow](configure-admin-consent-workflow.md) is enabled, the user can send the request to an admin for further review directly from the consent prompt. If the admin consent request workflow isn't enabled, the following message is displayed:
 
**AADSTS90094**: \<clientAppDisplayName> needs permission to access resources in your organization that only an admin can grant. Request an admin to grant permission to this app before you can use it.
 
In this case, an audit event is also logged with a category of "ApplicationManagement," an activity type of "Consent to application,"  and a status reason of "Risky application detected."
 

MODIFIED docs/external-id/customers/how-to-define-custom-attributes.md

Modified by Michele Martin on May 22, 2025 7:18 AM
📖 View on learn.microsoft.com

+6 / -6 lines changed

Commit: update the hidden editable flag descriptions

Changes:

Before

After

 
## Configure attribute visibility and editability with Microsoft Graph
 
You can control which attributes are shown or collected from users during sign-up by configuring the hidden and editable flags for each attribute. These settings are not currently available in the admin center UI, but you can configure them using Microsoft Graph.
 
Each attribute supports the following flags:
 
- `hidden`: Set this flag to `true` to hide the attribute from the sign-up page, or `false` to display the attribute.
- `editable`: Set this flag to `true` to allow users to edit the attribute, or `false` to make the attribute read-only.
 
Examples:
 
- Set `hidden` to `false` and `editable` to `false` to show the attribute on the page, but prevent users from editing it.
- Set `hidden` to `true` and `editable` to `true` to hide the attribute on the page, but still allow it to be set by the API. For example, you can configure a [custom authentication extension](concept-custom-extensions.md) and use the [OnAttributeCollectionSubmit](concept-custom-extensions.md#attribute-collection-start-and-submit-events) event to modify the value of the attribute.
 
To configure these flags with Microsoft Graph, use the [authenticationAttributeCollectionInputConfiguration](/graph/api/resources/authenticationattributecollectioninputconfiguration) resource type. See also the example for [updating the page layout of a self-service sign up user flow](/graph/api/authenticationeventsflow-update#example-2-update-the-page-layout-of-a-self-service-sign-up-user-flow).
 
## Find the application ID for the extensions app

 
## Configure attribute visibility and editability with Microsoft Graph
 
You can control which attributes are shown or collected from users during sign-up by configuring the hidden and editable flags for each attribute. These settings aren't currently available in the admin center UI, but you can configure them using Microsoft Graph.
 
Each attribute supports the following flags:
 
- `hidden`: This flag is `false` by default so the attribute displays on the sign-up page, but you can set it to `true` to hide the attribute.
- `editable`: This flag is `true` by default to allow users to edit the attribute, but you can set it to `false` to make the attribute read-only.
 
Examples:
 
- To show the attribute on the page but prevent users from editing it, set `hidden` to `false` and `editable` to `false` .
- To hide the attribute from the page while still allowing it to be set programmatically, set `hidden` to `true` and `editable` to `true`. For example, you can assign a value to the attribute by [creating a custom authentication extension for an attribute collection submit event](~/identity-platform/custom-extension-attribute-collection?toc=/entra/external-id/toc.json&bc=/entra/external-id/breadcrumb/toc.json).
 
To set the hidden and editable flags using Microsoft Graph, use the [authenticationAttributeCollectionInputConfiguration](/graph/api/resources/authenticationattributecollectioninputconfiguration) resource type. For reference, see the example on [updating the page layout of a self-service sign up user flow](/graph/api/authenticationeventsflow-update#example-2-update-the-page-layout-of-a-self-service-sign-up-user-flow).
 
## Find the application ID for the extensions app

MODIFIED docs/identity/enterprise-apps/cloudflare-integration.md

Modified by omondiatieno on May 22, 2025 1:03 AM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Review content for technical accuracy and clarity

Changes:

Before

After

ms.subservice: enterprise-apps
ms.topic: how-to
 
ms.date: 05/02/2023
ms.author: gasinh
ms.collection: M365-identity-device-management
ms.custom: not-enterprise-apps
#customer intent:As an administrator configuring access policies in Cloudflare Access, I want to learn how to integrate Cloudflare with Microsoft Entra ID, so that I can enforce organizational policies and provide secure access to self-hosted, SaaS, or nonweb applications.
---
 
# Tutorial: Configure Cloudflare with Microsoft Entra ID for secure hybrid access
 
In this tutorial, learn to integrate Microsoft Entra ID with Cloudflare Zero Trust. Build rules based on user identity and group membership. Users authenticate with Microsoft Entra credentials and connect to Zero Trust protected applications.
 
Use the instructions in the following three sections to register Cloudflare with Microsoft Entra ID.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator). 
2. Browse to **Entra ID** > **App registrations**.
3. Select **New registration**.
4. Enter an application **Name**.

ms.subservice: enterprise-apps
ms.topic: how-to
 
ms.date: 05/21/2025
ms.author: gasinh
ms.collection: M365-identity-device-management
ms.custom: not-enterprise-apps
#customer intent:As an administrator configuring access policies in Cloudflare Access, I want to learn how to integrate Cloudflare with Microsoft Entra ID, so that I can enforce organizational policies and provide secure access to self-hosted, SaaS, or nonweb applications.
---
 
# Configure Cloudflare with Microsoft Entra ID for secure hybrid access
 
In this tutorial, learn to integrate Microsoft Entra ID with Cloudflare Zero Trust. Build rules based on user identity and group membership. Users authenticate with Microsoft Entra credentials and connect to Zero Trust protected applications.
 
Use the instructions in the following three sections to register Cloudflare with Microsoft Entra ID.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator). 
2. Navigate to **Entra ID** > **App registrations**.
3. Select **New registration**.
4. Enter an application **Name**.

MODIFIED docs/identity-platform/reference-native-authentication-api.md

Modified by Sherman Ouko on May 22, 2025 2:35 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: [ms-custom] Add MS Custom to entra-pr

Changes:

Before

After

author: kengaderdus
manager: mwongerapk
ms.author: kengaderdus
ms.service: entra-external-id 
ms.subservice: external
ms.topic: reference
ms.date:  09/30/2024
 
#Customer intent: As an identity developer, I want to learn how to integrate customer-facing apps with native authentication API so that I can sign in customer users into external tenant.
---
 

author: kengaderdus
manager: mwongerapk
ms.author: kengaderdus
ms.service: entra-external-id
ms.subservice: external
ms.topic: reference
ms.date: 09/30/2024
ms.custom: sfi-ropc-nochange
#Customer intent: As an identity developer, I want to learn how to integrate customer-facing apps with native authentication API so that I can sign in customer users into external tenant.
---
 

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files