Microsoft Entra Documentation Changes

MODIFIED docs/architecture/deployment-external-operations.md

Modified by Ed McKillop on May 23, 2025 12:58 AM
📖 View on learn.microsoft.com

+188 / -41 lines changed

Commit: Update deployment-external-operations.md

Changes:

Before

After

---
title: Microsoft Entra External ID deployment guide for operations
description: Learn about subscriptions, consumer app security, and fraud tactics in operations for Microsoft Entra External ID.
author: gargi-sinha
manager: martinco
ms.service: entra-external-id
#customer intent: I need to understand subscriptions and billing, consumer app security, and how to prevent fraud tactics in Microsoft Entra External ID. 
---

# Microsoft Entra External ID deployment guide for operations

Many deployments include a production and at least one nonproduction environment. The nonproduction environments enable validation of the configuration changes without affecting the production tenant. 

## Deployment plans: Microsoft Entra External ID environment

The deployments typically include production, development, staging, or development tenants, etc. Tenants are attached to subscriptions for billing. In certain cases, customers prefer the nonproduction billing separate from production billing. Subscription choice affects billing. Use the following job aid to document this tenant information. 

|Use|Tenant name|Billing subscription
|---|---|---|
|Production|||

---
title: Microsoft Entra External ID deployment guide for security operations
description: Learn about edge protection, domains, subscriptions, consumer app security, and fraud tactics in security operations for Microsoft Entra External ID.
author: gargi-sinha
manager: martinco
ms.service: entra-external-id
#customer intent: I need to understand subscriptions and billing, consumer app security, and how to prevent fraud tactics in Microsoft Entra External ID. 
---

# Microsoft Entra External ID deployment guide for security operations

This document outlines security operations considerations to deploy [Microsoft Entra External ID](/entra/external-id/external-identities-overview), an extensible solution to add customer identity and access management (CIAM) solutions to your apps. This document emphasizes edge-based attacks, particularly bots targeting sign-up and sign-in endpoints. These vectors are commonly exploited in external identity systems and demand layered, proactive, defense strategies. 

Key topics covered include:  

* Tenant protection
* Web application firewall (WAF) integration
* Bot mitigation
* Credential and token hygiene
* Geography-based access control

MODIFIED docs/id-governance/entitlement-management-access-package-eligible.md

Modified by Ortagus Winfrey on May 23, 2025 2:55 AM
📖 View on learn.microsoft.com

+4 / -44 lines changed

Commit: Updates

Changes:

Before

After

ms.topic: how-to #Required; leave this attribute/value as-is
ms.date: 05/21/2025
 
#CustomerIntent: As a < type of user >, I want < what? > so that < why? >.
---
 
<!--
Remove all the comments in this template before you sign-off or merge to the main branch.
 
This template provides the basic structure of a How-to article pattern. See the
[instructions - How-to](../level4/article-how-to-guide.md) in the pattern library.
 
You can provide feedback about this template at: https://aka.ms/patterns-feedback
 
How-to is a procedure-based article pattern that show the user how to complete a task in their own environment. A task is a work activity that has a definite beginning and ending, is observable, consist of two or more definite steps, and leads to a product, service, or decision.
 
 
<!-- 1. H1 -----------------------------------------------------------------------------
 
Required: Use a "<verb> * <noun>" format for your H1. Pick an H1 that clearly conveys the task the user will complete.

ms.topic: how-to #Required; leave this attribute/value as-is
ms.date: 05/21/2025
 
#CustomerIntent: As an IT Administrator I want to assign eligible roles for a group within an access package.
---
 
# Assign eligible group membership and ownership in access packages via PIM for Groups
 
As an access package manager, you can assign which role you want to provide a user for a group within an access package. By [managing groups with Privileged Identity Management](../id-governance/privileged-identity-management/groups-discover-groups.md), you're able to enhance security by designating that group access happens just-in-time. This article describes how to enable pim for a group, adding the group to an access package, and verifying eligible assignments are available.
 
<!---Avoid notes, tips, and important boxes. Readers tend to skip over them. Better to put that info directly into the article text.
 
[!INCLUDE [Microsoft Entra ID Governance license](../includes/entra-entra-governance-license.md)]
 
## Create a group
 
The following steps walk you through creating the group that you will enable to be managed by PIM. If you have already created the group you want to manage with PIM, skip to [Enable management of group with PIM](entitlement-management-access-package-eligible.md#enable-management-of-group-with-pim).
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [User Administrator](~/identity/role-based-access-control/permissions-reference.md#user-administrator).

MODIFIED docs/global-secure-access/how-to-transport-layer-security.md

Modified by jayrusso on May 23, 2025 8:25 AM
📖 View on learn.microsoft.com

+21 / -21 lines changed

Commit: May 22 updates per PM feedback

Changes:

Before

After

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 05/21/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (Preview)
Transport Layer Security (TLS) inspection allows Global Secure Access to decrypt and inspect traffic at edge locations. This inspection enables Global Secure Access to enforce security policies such as threat detection, content filtering, and fine-grained access controls, which enhances protection against threats concealed within encrypted communications.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
## Prerequisites   
To complete the steps in this process, you must have the following prerequisites in place:      
- A Public Key Infrastructure (PKI) service to sign the Certificate Signing Request (CSR) and generate an intermediate certificate for TLS inspection. For testing scenarios, you can also use a self-signed root certificate created with OpenSSL.   
- Test devices or virtual machines, running Windows, that are either Microsoft Entra joined or hybrid joined to your organization's Microsoft Entra ID.  
- A trial license for Microsoft Entra Internet Access.  
- [Global Secure Access prerequisites](how-to-configure-web-content-filtering.md). 

ms.service: global-secure-access
ms.topic: how-to 
ms.reviewer: teresayao
ms.date: 05/22/2025
 
 
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.   
---
 
# Configure Transport Layer Security inspection (Preview)
Transport Layer Security (TLS) inspection in Microsoft Entra Internet Access enables decryption and inspection of encrypted traffic at service edge locations. This capability lets Global Secure Access apply advanced security controls like threat detection, content filtering, and granular access policies. Organizations use these access policies to protect against threats that might be hidden in encrypted communications.
 
> [!IMPORTANT]
> The Transport Layer Security inspection feature is currently in PREVIEW.   
## Prerequisites   
To complete the steps in this process, you must have the following prerequisites in place:      
- A Public Key Infrastructure (PKI) service to sign the Certificate Signing Request (CSR) and generate an intermediate certificate for TLS inspection. For testing scenarios, you can also use a self-signed root certificate created with OpenSSL.   
- Test devices or virtual machines running Windows that are either Microsoft Entra joined or hybrid joined to your organization's Microsoft Entra ID.  
- A trial license for Microsoft Entra Internet Access.  
- [Global Secure Access prerequisites](how-to-configure-web-content-filtering.md) 

MODIFIED docs/architecture/gsa-poc-internet-access.md

Modified by Janice Ricketts on May 23, 2025 5:12 AM
📖 View on learn.microsoft.com

+18 / -0 lines changed

Commit: Update gsa-poc-internet-access.md

Changes:

Before

After

 
1. View activity in the [traffic log](../global-secure-access/how-to-view-traffic-logs.md) to confirm that Global Secure Access enabled access. Verify in the sign-in logs that **Through Global Secure Access** shows as **Yes**.
 
## Troubleshoot
 
If you have problems with your PoC, these articles can help you with troubleshooting, logging, and monitoring:

 
1. View activity in the [traffic log](../global-secure-access/how-to-view-traffic-logs.md) to confirm that Global Secure Access enabled access. Verify in the sign-in logs that **Through Global Secure Access** shows as **Yes**.
 
### Implement universal tenant restrictions
 
[Universal tenant restrictions](../global-secure-access/how-to-universal-tenant-restrictions.md) enable you to control access to external tenants by unmanaged identities on company-managed devices and networks. You can enforce this restriction at the authentication plane with tenant restrictions v1, by either blocking or allowing all traffic to an external tenant.
 
This scenario usually requires hair-pinning traffic to a corporate network proxy. With universal tenant restrictions, organizations can restrict access on a per-application level, extend protection to the data plane (in addition to the authentication plane), and eliminate the need to hair-pin traffic to reduce network latency.
 
After you enable the Microsoft traffic profile, follow these steps to implement universal tenant restrictions:
 
1. [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2). If your organization currently uses tenant restrictions v1, review the [guide for migrating to tenant restrictions v2](https://aka.ms/trv2migration).
 
1. [Enable Global Secure Access signaling for tenant restrictions](../global-secure-access/how-to-universal-tenant-restrictions.md#enable-global-secure-access-signaling-for-tenant-restrictions).
 
1. Sign in to your test device and try to access a different tenant's SharePoint Online or Exchange Online resource for which you have valid credentials.
 
1. [Validate authentication plane protection](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-the-authentication-plane-protection).
 
1. [Validate data plane protection](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-the-data-plane-protection).

MODIFIED docs/identity-platform/how-to-add-redirect-uri.md

Modified by Derdus Kenga on May 23, 2025 4:59 PM
📖 View on learn.microsoft.com

+8 / -6 lines changed

Commit: pr review comments

Changes:

Before

After

 
The Microsoft identity platform supports authentication for modern application types such as web applications, single-page applications (SPA) and mobile and desktop apps. Once you register your app in the Microsoft Entra admin center, you need to specify the app type by configuring an app platform along with other authentication settings specific to each platform.
 
## Prerequisites
 
* [Quickstart: Register an app in Microsoft Entra ID](quickstart-register-app.md).
 
## Add a platform to your app
 
Follow these steps to specify your app type to your app registration:
 
1. In the Microsoft Entra admin center, in **App registrations**, select your application.
1. Under **Manage**, select **Authentication**.
 
   :::image type="content" source="./media/quickstart-register-app/portal-04-app-reg-03-platform-config.png" alt-text="Screenshot of the platform configuration pane in the Azure portal." border="false":::
 
1. Enter the configuration settings as shown in the following table:
 
   | Platform  | Configuration settings | Example |
   | --------- |------------------------|---------|

 
The Microsoft identity platform supports authentication for modern application types such as web applications, single-page applications (SPA) and mobile and desktop apps. Once you register your app in the Microsoft Entra admin center, you need to specify the app type by configuring an app platform along with other authentication settings specific to each platform.
 
When you add a platform to your app registration, you must specify a redirect URI. The redirect URI is the endpoint where the Microsoft identity platform sends security tokens after a user successfully authenticates. This URI is a key security measure, which ensures that security tokens are only sent to to the intended recipient.
 
## Prerequisites
 
* [Quickstart: Register an app in Microsoft Entra ID](quickstart-register-app.md).
 
## Add a platform to your app
 
Follow these steps to configure settings based on your target platform or device:
 
1. In the Microsoft Entra admin center, in **App registrations**, select your application.
1. Under **Manage**, select **Authentication**.
 
   :::image type="content" source="./media/quickstart-register-app/portal-04-app-reg-03-platform-config.png" alt-text="Screenshot of the platform configuration pane in the Azure portal." border="false":::
 
   | Platform  | Configuration settings | Example |

MODIFIED docs/global-secure-access/reference-version-history.md

Modified by Sumeet Mittal on May 23, 2025 8:13 AM
📖 View on learn.microsoft.com

+0 / -12 lines changed

Commit: Update reference-version-history.md

Changes:

Before

After

| Understand Microsoft Entra private network connectors | Find out more about [connector management](../identity/app-proxy/application-proxy-connectors.md) and how connectors [autoupgrade](../identity/app-proxy/application-proxy-connectors.md#automatic-updates). |
| Microsoft Entra private network connector Download    | [Download the latest connector](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download). |
 
## Version 1.5.4279.0
 
### Release status
 
May 20, 2025: Released for download. This version is only available for install via the download page in the Microsoft Entra admin center. 
 
### New features and improvements
 
- The connector now supports routing outbound traffic to destinations in Microsoft Entra Private Access through a forward proxy, enhancing network control.
- A new diagnostics tool to assist with troubleshooting setup issues. 
- Bug fixes and minor improvements.
 
## Version 1.5.3925.0
 
### Release status

| Understand Microsoft Entra private network connectors | Find out more about [connector management](../identity/app-proxy/application-proxy-connectors.md) and how connectors [autoupgrade](../identity/app-proxy/application-proxy-connectors.md#automatic-updates). |
| Microsoft Entra private network connector Download    | [Download the latest connector](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download). |
 
## Version 1.5.3925.0
 
### Release status

MODIFIED docs/identity/devices/sso-linux.md

Modified by Justin on May 23, 2025 2:30 AM
📖 View on learn.microsoft.com

+6 / -4 lines changed

Commit: updated metadata

Changes:

Before

After

---
# Required metadata
# For more information, see https://review.learn.microsoft.com/en-us/help/platform/learn-editor-add-metadata?branch=main
# For valid values of ms.service, ms.prod, and ms.topic, see https://review.learn.microsoft.com/en-us/help/platform/metadata-taxonomies?branch=main
 
title: Microsoft single sign-on For Linux
description: Overview of Single Sign-on for Linux for Microsoft Entra ID registered devices.
author:      ploegert # GitHub alias
You can find more information and instructions on how to configure in these articles:
- [Configure Platform SSO for macOS devices in Microsoft Intune](/mem/intune/configuration/platform-sso-macos)
 
## Deployment
 
### Installation
 
 

---
title: Microsoft single sign-on For Linux
description: Overview of Single Sign-on for Linux for Microsoft Entra ID registered devices.
author:      ploegert # GitHub alias
You can find more information and instructions on how to configure in these articles:
- [Configure Platform SSO for macOS devices in Microsoft Intune](/mem/intune/configuration/platform-sso-macos)
 
## SSO experience
 
This video demonstrates the sign-in experience on brokered flows on Linux
 
![Demo of the Linux Login component component](./media/sso-linux/linux-entra-login.gif)
 
## Deployment
 
### Installation

MODIFIED docs/architecture/deployment-external-authentication-access-control.md

Modified by Ed McKillop on May 23, 2025 2:14 AM
📖 View on learn.microsoft.com

+3 / -4 lines changed

Commit: Update deployment-external-authentication-access-control.md

Changes:

Before

After

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 03/10/2025
ms.author: gasinh

#customer intent: I need to understand authentication protocol endpoints, custom authentication extension design, also API and event handler details in Microsoft Entra External ID.

Microsoft provides a [NuGet package for .NET developers]() building [Azure Functions](/azure/azure-functions/) apps. This solution handles the back-end processing for incoming HTTP requests for Microsoft Entra authentication events. Find token validation to secure the API call, object model, type with IDE IntelliSense. Also find inbound and outbound validation of the API request and response schemas. 

Authentication extensions are executed in-line with sign-in and sign-up flows. Ensure the scenario is highly performant, robust, and secure. Azure Functions offers secure infrastructure, including libraries, [Azure Key Vault](/azure/key-vault/general/basic-concepts) for secret storage, caching, autoscaling, and monitoring. There are more recommendations in [Auditing and monitoring](deployment-external-audit-monitor.md).  

## Next steps

* [Introduction to Microsoft Entra External ID deployment guide](deployment-external-intro.md)
* [Tenant design](deployment-external-tenant-design.md)
* [Customer authentication experience](deployment-external-customer-authentication.md)
* [Operations](deployment-external-operations.md)
* Authentication and access control architecture
* [Auditing and monitoring](deployment-external-audit-monitor.md)

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 05/22/2025
ms.author: gasinh

#customer intent: I need to understand authentication protocol endpoints, custom authentication extension design, also API and event handler details in Microsoft Entra External ID.

Microsoft provides a [NuGet package for .NET developers]() building [Azure Functions](/azure/azure-functions/) apps. This solution handles the back-end processing for incoming HTTP requests for Microsoft Entra authentication events. Find token validation to secure the API call, object model, type with IDE IntelliSense. Also find inbound and outbound validation of the API request and response schemas. 

Authentication extensions are executed in-line with sign-in and sign-up flows. Ensure the scenario is highly performant, robust, and secure. Azure Functions offers secure infrastructure, including libraries, [Azure Key Vault](/azure/key-vault/general/basic-concepts) for secret storage, caching, autoscaling, and monitoring. There are more recommendations in [Security operations](deployment-external-operations.md).  

## Next steps

* [Introduction to Microsoft Entra External ID deployment guide](deployment-external-intro.md)
* [Tenant design](deployment-external-tenant-design.md)
* [Customer authentication experience](deployment-external-customer-authentication.md)
* [Security operations](deployment-external-operations.md)
* Authentication and access control architecture
 

MODIFIED docs/architecture/deployment-external-tenant-design.md

Modified by Ed McKillop on May 23, 2025 2:11 AM
📖 View on learn.microsoft.com

+3 / -4 lines changed

Commit: Update deployment-external-tenant-design.md

Changes:

Before

After

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 03/10/2025
ms.author: gasinh

#customer intent: I need to design a tenant, manage data residency, and know compliance requirements in Microsoft Entra External ID.
* Boolean 
* Integer (32-bit value) 

Manage directory extensions through the [Microsoft Entra admin portal](https://entra.microsoft.com), or with the Microsoft Graph API. 

## User data migration

* [Introduction to Microsoft Entra External ID deployment guide](deployment-external-intro.md)
* Tenant design
* [Customer authentication experience](deployment-external-customer-authentication.md)
* [Operations](deployment-external-operations.md)
* [Authentication and access control architecture](deployment-external-authentication-access-control.md)
* [Auditing and monitoring](deployment-external-audit-monitor.md)

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 05/22/2025
ms.author: gasinh

#customer intent: I need to design a tenant, manage data residency, and know compliance requirements in Microsoft Entra External ID.
* Boolean 
* Integer (32-bit value) 

Manage directory extensions through the [Microsoft Entra admin center](https://entra.microsoft.com), or with the Microsoft Graph API. 

## User data migration

* [Introduction to Microsoft Entra External ID deployment guide](deployment-external-intro.md)
* Tenant design
* [Customer authentication experience](deployment-external-customer-authentication.md)
* [Security operations](deployment-external-operations.md)
* [Authentication and access control architecture](deployment-external-authentication-access-control.md)
 

MODIFIED docs/architecture/deployment-external-intro.md

Modified by Ed McKillop on May 23, 2025 2:09 AM
📖 View on learn.microsoft.com

+3 / -4 lines changed

Commit: Update deployment-external-intro.md

Changes:

Before

After

These endpoints are the front door when authenticating to applications. Therefore, implement multiple layers of security controls to protect the endpoints.

* **Edge protection** - Use [Web Application Firewall](/azure/web-application-firewall/overview) (WAF) to protect endpoints from bot abuse
* **Sign up fraud prevention** - Integrate fraud prevention techniques such as email verification, short message service (SMS) verification, captcha controls, and fraud analysis techniques to help ensure bots can't sign up
* **Account takeover protection** - Integrate risk-based authentication solutions to detect sign-in risk, and prompt a stronger authentication factor, if necessary. Microsoft has a goal to add an integrated third-party account takeover protection solution.
* **Authorization** - Use Microsoft Entra groups and roles to determine which users have access to applications, and what they can access in the applications

The authentication journey is the front door to your services. Monitor it to determine its overall health: authentication journey success rates, multifactor authentication (MFA) rates, throttling, and logging. Use this data to evolve your authentication journeys for a balance between frictionless and security. To determine the balance between your deployment, present the collected data to the business. 

Microsoft Entra External ID has a user insights dashboard to generate analytics on users interacting with your authentication journeys. See more detailed authentication logs to analyze using the Microsoft Entra ID sign in and audit logs. Export them with [Microsoft Azure Monitor](/azure/azure-monitor/), or [Microsoft Graph](/graph/overview) API. With Azure Monitor, logs are retained in a log analytics workspace for up to two years. Log archival for longer periods is achieved with a storage account. See more in [Auditing and monitoring](deployment-external-audit-monitor.md).

## Next steps

* Introduction to Microsoft Entra External ID deployment guide
* [Tenant design](deployment-external-tenant-design.md)
* [Customer authentication experience](deployment-external-customer-authentication.md)
* [Operations](deployment-external-operations.md)
* [Authentication and access control architecture](deployment-external-authentication-access-control.md)
* [Auditing and monitoring](deployment-external-audit-monitor.md)

These endpoints are the front door when authenticating to applications. Therefore, implement multiple layers of security controls to protect the endpoints.

* **Edge protection** - Use [Azure Web Application Firewall](/azure/web-application-firewall/overview) (WAF) to protect endpoints from bot abuse
* **Sign up fraud prevention** - Integrate fraud prevention techniques such as email verification, short message service (SMS) verification, captcha controls, and fraud analysis techniques to help ensure bots can't sign up
* **Account takeover protection** - Integrate risk-based authentication solutions to detect sign-in risk, and prompt a stronger authentication factor, if necessary. Microsoft has a goal to add an integrated third-party account takeover protection solution.
* **Authorization** - Use Microsoft Entra groups and roles to determine which users have access to applications, and what they can access in the applications

The authentication journey is the front door to your services. Monitor it to determine its overall health: authentication journey success rates, multifactor authentication (MFA) rates, throttling, and logging. Use this data to evolve your authentication journeys for a balance between frictionless and security. To determine the balance between your deployment, present the collected data to the business. 

Microsoft Entra External ID has a user insights dashboard to generate analytics on users interacting with your authentication journeys. See more detailed authentication logs to analyze using the Microsoft Entra ID sign in and audit logs. Export them with [Microsoft Azure Monitor](/azure/azure-monitor/), or [Microsoft Graph](/graph/overview) API. With Azure Monitor, logs are retained in a log analytics workspace for up to two years. Log archival for longer periods is achieved with a storage account. Learn more in [Security operations](deployment-external-operations.md).

## Next steps

* Introduction to Microsoft Entra External ID deployment guide
* [Tenant design](deployment-external-tenant-design.md)
* [Customer authentication experience](deployment-external-customer-authentication.md)
* [Security operations](deployment-external-operations.md)
* [Authentication and access control architecture](deployment-external-authentication-access-control.md)
 

MODIFIED docs/external-id/customers/how-to-facebook-federation-customers.md

Modified by bernawy on May 23, 2025 5:16 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update steps to use Microsoft Entra External ID tenant

Changes:

Before

After

ms.service: entra-external-id
ms.subservice: external
ms.topic: how-to
ms.date: 03/06/2025
ms.custom: it-pro, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
#Customer intent: As a developer or IT admin, I want to add Facebook as an identity provider for my external tenant so that customers can sign in to my applications using their Facebook accounts.
---
1. Select **Save changes**. 
1. Select **Use cases** on the left and select **Customize** next to **Authentication and account creation**.
1. Select **Go to settings** under **Facebook Login**.
1.  In **Valid OAuth Redirect URIs**, enter the following URIs, replacing `<tenant-ID>` with your Microsoft Entra tenant ID and `<tenant-name>` with your Microsoft Entra tenant name:
 
- `https://login.microsoftonline.com/te/<tenant-ID>/oauth2/authresp`
- `https://login.microsoftonline.com/te/<tenant-subdomain>.onmicrosoft.com/oauth2/authresp`
- `https://<tenant-name>.ciamlogin.com/<tenant-ID>/federation/oidc/www.facebook.com`
- `https://<tenant-name>.ciamlogin.com/<tenant-name>.onmicrosoft.com/federation/oidc/www.facebook.com`
- `https://<tenant-name>.ciamlogin.com/<tenant-ID>/federation/oauth2`

ms.service: entra-external-id
ms.subservice: external
ms.topic: how-to
ms.date: 05/22/2025
ms.custom: it-pro, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
#Customer intent: As a developer or IT admin, I want to add Facebook as an identity provider for my external tenant so that customers can sign in to my applications using their Facebook accounts.
---
1. Select **Save changes**. 
1. Select **Use cases** on the left and select **Customize** next to **Authentication and account creation**.
1. Select **Go to settings** under **Facebook Login**.
1.  In **Valid OAuth Redirect URIs**, enter the following URIs, replacing `<tenant-ID>` with your Microsoft Entra External ID tenant ID and `<tenant-name>` with your Microsoft Entra External ID tenant name:
 
- `https://login.microsoftonline.com/te/<tenant-ID>/oauth2/authresp`
- `https://login.microsoftonline.com/te/<tenant-name>.onmicrosoft.com/oauth2/authresp`
- `https://<tenant-name>.ciamlogin.com/<tenant-ID>/federation/oidc/www.facebook.com`
- `https://<tenant-name>.ciamlogin.com/<tenant-name>.onmicrosoft.com/federation/oidc/www.facebook.com`
- `https://<tenant-name>.ciamlogin.com/<tenant-ID>/federation/oauth2`

MODIFIED docs/architecture/deployment-external-customer-authentication.md

Modified by Ed McKillop on May 23, 2025 2:12 AM
📖 View on learn.microsoft.com

+2 / -3 lines changed

Commit: Update deployment-external-customer-authentication.md

Changes:

Before

After

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 03/10/2025
ms.author: gasinh

#customer intent: I need to understand self-service user flows, and other customer authentication experiences in Microsoft Entra External ID.
* [Introduction to Microsoft Entra External ID deployment guide](deployment-external-intro.md)
* [Tenant design](deployment-external-tenant-design.md)
* Customer authentication experience
* [Operations](deployment-external-operations.md)
* [Authentication and access control architecture](deployment-external-authentication-access-control.md)
* [Auditing and monitoring](deployment-external-audit-monitor.md)

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 05/22/2025
ms.author: gasinh

#customer intent: I need to understand self-service user flows, and other customer authentication experiences in Microsoft Entra External ID.
* [Introduction to Microsoft Entra External ID deployment guide](deployment-external-intro.md)
* [Tenant design](deployment-external-tenant-design.md)
* Customer authentication experience
* [Security operations](deployment-external-operations.md)
* [Authentication and access control architecture](deployment-external-authentication-access-control.md)
 

MODIFIED docs/external-id/google-federation.md

Modified by csmulligan on May 23, 2025 12:26 AM
📖 View on learn.microsoft.com

+5 / -0 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

> [!NOTE]
> Google federation is designed specifically for Gmail users. To federate with Google Workspace domains, use [SAML/WS-Fed identity provider federation](direct-federation.md).
 
## What is the experience for the Google user?
 
You can invite a Google user to B2B collaboration in various ways. For example, you can [add them to your directory via the Microsoft Entra admin center](b2b-quickstart-add-guest-users-portal.md). When they redeem your invitation, their experience varies depending on whether they're already signed in to Google:

> [!NOTE]
> Google federation is designed specifically for Gmail users. To federate with Google Workspace domains, use [SAML/WS-Fed identity provider federation](direct-federation.md).
 
> [!IMPORTANT]
>
> - **Starting July 12, 2021**, if Microsoft Entra B2B customers set up new Google integrations for use with self-service sign-up or for inviting external users for their custom or line-of-business applications, authentication could be blocked for Gmail users (with the error screen shown in [What to expect](#what-to-expect)). This issue occurs only if you create Google integration for self-service sign-up user flows or invitations after July 12, 2021 and Gmail authentications in your custom or line-of-business applications haven’t been moved to system web-views. Because system web-views are enabled by default, most apps will not be affected. To avoid the issue, we strongly advise you to move Gmail authentications to system browsers before creating any new Google integrations for self-service sign-up. Please refer to [Action needed for embedded web-views](#action-needed-for-embedded-frameworks).
> - **Starting September 30, 2021**, Google is [deprecating web-view sign-in support](https://developers.googleblog.com/2021/06/upcoming-security-changes-to-googles-oauth-2.0-authorization-endpoint.html). If your apps authenticate users with an embedded web-view and you're using Google federation with [Azure AD B2C](/azure/active-directory-b2c/identity-provider-google) or Microsoft Entra B2B for external user invitations or [self-service sign-up](identity-providers.md), Google Gmail users won't be able to authenticate. [Learn more](#deprecation-of-web-view-sign-in-support).
 
## What is the experience for the Google user?
 
You can invite a Google user to B2B collaboration in various ways. For example, you can [add them to your directory via the Microsoft Entra admin center](b2b-quickstart-add-guest-users-portal.md). When they redeem your invitation, their experience varies depending on whether they're already signed in to Google:

MODIFIED docs/external-id/identity-providers.md

Modified by csmulligan on May 23, 2025 12:26 AM
📖 View on learn.microsoft.com

+5 / -0 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

 
- **Google**: Google federation allows external users to redeem invitations from you by signing in to your apps with their own Gmail accounts. Google federation can also be used in your self-service sign-up user flows. See how to [add Google as an identity provider](google-federation.md).
 
- **Facebook**: When building an app, you can configure self-service sign-up and enable Facebook federation so that users can sign up for your app using their own Facebook accounts. Facebook can only be used for self-service sign-up user flows and isn't available as a sign-in option when users are redeeming  invitations from you. See how to [add Facebook as an identity provider](facebook-federation.md).
 
- **SAML/WS-Fed identity provider federation**: You can also set up federation with any external IdP that supports the SAML or WS-Fed protocols. SAML/WS-Fed IdP federation allows external users to use their own IdP-managed accounts to sign in to your apps or resources, without having to create new Microsoft Entra credentials. For more information, see [SAML/WS-Fed identity providers](direct-federation-overview.md). For detailed setup steps, see [Add federation with SAML/WS-Fed identity providers](direct-federation.md).

 
- **Google**: Google federation allows external users to redeem invitations from you by signing in to your apps with their own Gmail accounts. Google federation can also be used in your self-service sign-up user flows. See how to [add Google as an identity provider](google-federation.md).
 
   > [!IMPORTANT]
   >
   > - **As of July 12, 2021**, if Microsoft Entra B2B customers set up new Google integrations for use with self-service sign-up for their custom or line-of-business applications, authentication with Google identities won’t work until authentications are moved to system web-views. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).
   > - **On September 30, 2021**, Google [deprecated embedded web-view sign-in support](https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html). If your apps authenticate users with an embedded web-view and you're using Google federation with [Azure AD B2C](/azure/active-directory-b2c/identity-provider-google) or Microsoft Entra B2B for [external user invitations](google-federation.md) or self-service sign-up, Google Gmail users won't be able to authenticate. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).
 
- **Facebook**: When building an app, you can configure self-service sign-up and enable Facebook federation so that users can sign up for your app using their own Facebook accounts. Facebook can only be used for self-service sign-up user flows and isn't available as a sign-in option when users are redeeming  invitations from you. See how to [add Facebook as an identity provider](facebook-federation.md).
 
- **SAML/WS-Fed identity provider federation**: You can also set up federation with any external IdP that supports the SAML or WS-Fed protocols. SAML/WS-Fed IdP federation allows external users to use their own IdP-managed accounts to sign in to your apps or resources, without having to create new Microsoft Entra credentials. For more information, see [SAML/WS-Fed identity providers](direct-federation-overview.md). For detailed setup steps, see [Add federation with SAML/WS-Fed identity providers](direct-federation.md).

MODIFIED docs/external-id/redemption-experience.md

Modified by csmulligan on May 23, 2025 12:26 AM
📖 View on learn.microsoft.com

+5 / -0 lines changed

Commit: B2C end of sale updates.

Changes:

Before

After

 
When you add a guest user to your directory, the guest user account has a consent status (viewable in PowerShell) that’s initially set to **PendingAcceptance**. This setting remains until the guest accepts your invitation and agrees to your privacy policy and terms of use. After that, the consent status changes to **Accepted**, and the consent pages are no longer presented to the guest.
 
## Redemption process and sign-in through a common endpoint
 
Guest users can now sign in to your multitenant or Microsoft first-party apps through a common endpoint (URL), for example `https://myapps.microsoft.com`. Previously, a common URL would redirect a guest user to their home tenant instead of your resource tenant for authentication, so a tenant-specific link was required (for example `https://myapps.microsoft.com/?tenantid=<tenant id>`). Now the guest user can go to the application's common URL, choose **Sign-in options**, and then select **Sign in to an organization**. The user then types the domain name of your organization.

 
When you add a guest user to your directory, the guest user account has a consent status (viewable in PowerShell) that’s initially set to **PendingAcceptance**. This setting remains until the guest accepts your invitation and agrees to your privacy policy and terms of use. After that, the consent status changes to **Accepted**, and the consent pages are no longer presented to the guest.
 
> [!IMPORTANT]
> - **Starting July 12, 2021**,  if Microsoft Entra B2B customers set up new Google integrations for use with self-service sign-up for their custom or line-of-business applications, authentication with Google identities won’t work until authentications are moved to system web-views. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).
> - **Starting September 30, 2021**, Google is [deprecating embedded web-view sign-in support](https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html). If your apps authenticate users with an embedded web-view and you're using Google federation with [Azure AD B2C](/azure/active-directory-b2c/identity-provider-google) or Microsoft Entra B2B for [external user invitations](google-federation.md) or [self-service sign-up](identity-providers.md), Google Gmail users won't be able to authenticate. [Learn more](google-federation.md#deprecation-of-web-view-sign-in-support).
> - The [email one-time passcode feature](one-time-passcode.md) is now turned on by default for all new tenants and for any existing tenants where you haven't explicitly turned it off. When this feature is turned off, the fallback authentication method is to prompt invitees to create a Microsoft account.
 
## Redemption process and sign-in through a common endpoint
 
Guest users can now sign in to your multitenant or Microsoft first-party apps through a common endpoint (URL), for example `https://myapps.microsoft.com`. Previously, a common URL would redirect a guest user to their home tenant instead of your resource tenant for authentication, so a tenant-specific link was required (for example `https://myapps.microsoft.com/?tenantid=<tenant id>`). Now the guest user can go to the application's common URL, choose **Sign-in options**, and then select **Sign in to an organization**. The user then types the domain name of your organization.

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files

🗑️ Deleted Documentation Files