Microsoft Entra Documentation Changes

📝 Modified Documentation Files

MODIFIED docs/identity-platform/custom-claims-provider-reference.md

Modified by Yoel Horvitz on May 25, 2025 4:51 PM
📖 View on learn.microsoft.com

+19 / -17 lines changed

Commit: Update custom-claims-provider-reference.md

Changes:

Before

After

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 25/05/2025
ms.reviewer: jassuri
ms.service: identity-platform
 
 
The REST API returns an HTTP response to Microsoft Entra ID containing the attributes. Attributes that return by your REST API aren't automatically added into a token. Instead, an application's claims mapping policy must be configured for any attribute to be included in the token. In Microsoft Entra ID, a claims mapping policy modifies the claims emitted in tokens issued for specific applications.
 
### REST API schema
 
To develop your own REST API for the token issuance start event, use the following REST API data contract. The schema describes the contract to design the request and response handler.
 
}
```
 
Microsoft Entra ID expects a REST API response in the following HTTP.
 
```http

manager: CelesteDG
ms.author: cwerner
ms.custom: 
ms.date: 05/25/2025
ms.reviewer: jassuri
ms.service: identity-platform
 
 
The REST API returns an HTTP response to Microsoft Entra ID containing the attributes. Attributes that return by your REST API aren't automatically added into a token. Instead, an application's claims mapping policy must be configured for any attribute to be included in the token. In Microsoft Entra ID, a claims mapping policy modifies the claims emitted in tokens issued for specific applications.
 
### Request to the REST API
 
To develop your own REST API for the token issuance start event, use the following REST API data contract. The schema describes the contract to design the request and response handler.
 
}
```
 
When a B2B user from Fabrikam organization authenticates to Contoso's organization, the request payload sent to the REST API has the `user` element in the following format:
 
```json

MODIFIED docs/identity/role-based-access-control/groups-remove-assignment.md

Modified by rolyon on May 25, 2025 4:34 AM
📖 View on learn.microsoft.com

+7 / -3 lines changed

Commit: List role assignment ID to remove role assignment

Changes:

Before

After

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: how-to
ms.date: 01/03/2025
ms.author: rolyon
ms.reviewer: vincesm
ms.custom: it-pro, has-azure-ad-ps-ref, azure-ad-ref-level-one-done
 
# [PowerShell](#tab/ms-powershell)
 
Use the [Remove-MgRoleManagementDirectoryRoleAssignment](/powershell/module/microsoft.graph.identity.governance/remove-mgrolemanagementdirectoryroleassignment) command to remove role assignments.
 
```powershell
Remove-MgRoleManagementDirectoryRoleAssignment -UnifiedRoleAssignmentId $roleAssignment.Id
 
# [Graph API](#tab/ms-graph)
 
Use the [Delete unifiedRoleAssignment](/graph/api/unifiedroleassignment-delete) API to remove role assignments.
 
### Remove a role assignment for a user

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: how-to
ms.date: 05/25/2025
ms.author: rolyon
ms.reviewer: vincesm
ms.custom: it-pro, has-azure-ad-ps-ref, azure-ad-ref-level-one-done
 
# [PowerShell](#tab/ms-powershell)
 
Use the [Get-MgRoleManagementDirectoryRoleAssignment](/powershell/module/microsoft.graph.identity.governance/get-mgrolemanagementdirectoryroleassignment) command to list the role assignment ID you want to remove. For examples, see [List Microsoft Entra role assignments](view-assignments.md?tabs=ms-powershell).
 
With the role assignment ID, use the [Remove-MgRoleManagementDirectoryRoleAssignment](/powershell/module/microsoft.graph.identity.governance/remove-mgrolemanagementdirectoryroleassignment) command to remove the role assignment.
 
```powershell
Remove-MgRoleManagementDirectoryRoleAssignment -UnifiedRoleAssignmentId $roleAssignment.Id
 
# [Graph API](#tab/ms-graph)
 
Use the [List unifiedRoleAssignments](/graph/api/rbacapplication-list-roleassignments) API to list the role assignment ID you want to remove. For examples, see [List Microsoft Entra role assignments](view-assignments.md?tabs=ms-graph).

MODIFIED docs/identity/hybrid/connect/authenticate-application-id.md

Modified by owinoakelo on May 25, 2025 7:36 PM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Update authenticate-application-id.md

Changes:

Before

After

 
 :::image type="content" source="media/authenticate-application-id/auth-1.png" alt-text="Diagram of authentication with application ID." lightbox="media/authenticate-application-id/auth-1.png":::
 
Microsoft recommends the Entra Connect certificate management option as we manage the keys and automatically rotate the certificate on expiry. This behavior is the default option in Entra Connect Sync versions equal to or higher than 2.5.2.0. 
 
> [!NOTE]
> We use the maintenance task to check if the certificate is due for rotation and automatically rotate the certificate, so if the scheduler is suspended or maintenance task is disabled, auto rotation won't happen even though the certificate is managed by Entra Connect Sync.
>
> Following up on our earlier [What’s New](../../../fundamentals/whats-new.md#general-availability---download-microsoft-entra-connect-sync-on-the-microsoft-entra-admin-center) communication, new versions of Microsoft Entra Connect Sync are only available on the [Microsoft Entra Connect blade](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/%7E/GetStarted) within Microsoft Entra Admin Center and will no longer be released to the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=47594).
 
- [Microsoft Entra Connect](https://www.microsoft.com/download/details.aspx?id=47594) version [2.5.2.0](reference-connect-version-history.md) or greater.
- Microsoft Entra account with at least a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role.
- On-premises Active Directory Domain Services environment with Windows Server 2016 operating system or later.
- Optional: TPM 2.0 present and ready to use (recommended for security)
 
### Onboarding to Application Based Authentication using PowerShell
This section is only relevant if using the BYOC or BYOA option. 
Microsoft Entra Connect versions lower than 2.5.2.0 use username and password by default for authenticating to Microsoft Entra ID. To onboard to Application Based Authentication, an administrator needs to perform the following steps on Microsoft Connect Sync version equal to or higher than 2.5.2.0.
 
> [!NOTE]

 
 :::image type="content" source="media/authenticate-application-id/auth-1.png" alt-text="Diagram of authentication with application ID." lightbox="media/authenticate-application-id/auth-1.png":::
 
Microsoft recommends the Entra Connect certificate management option as we manage the keys and automatically rotate the certificate on expiry. This behavior is the default option in Entra Connect Sync versions equal to or higher than 2.5.3.0. 
 
> [!NOTE]
> We use the maintenance task to check if the certificate is due for rotation and automatically rotate the certificate, so if the scheduler is suspended or maintenance task is disabled, auto rotation won't happen even though the certificate is managed by Entra Connect Sync.
>
> Following up on our earlier [What’s New](../../../fundamentals/whats-new.md#general-availability---download-microsoft-entra-connect-sync-on-the-microsoft-entra-admin-center) communication, new versions of Microsoft Entra Connect Sync are only available on the [Microsoft Entra Connect blade](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/%7E/GetStarted) within Microsoft Entra Admin Center and will no longer be released to the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=47594).
 
- [Microsoft Entra Connect](https://www.microsoft.com/download/details.aspx?id=47594) version [2.5.3.0](reference-connect-version-history.md) or greater.
- Microsoft Entra account with at least a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) role.
- On-premises Active Directory Domain Services environment with Windows Server 2016 operating system or later.
- Optional: TPM 2.0 present and ready to use (recommended for security)
 
### Onboarding to Application Based Authentication using PowerShell
This section is only relevant if using the BYOC or BYOA option. 
Microsoft Entra Connect versions lower than 2.5.3.0 use username and password by default for authenticating to Microsoft Entra ID. To onboard to Application Based Authentication, an administrator needs to perform the following steps on Microsoft Connect Sync version equal to or higher than 2.5.3.0.
 
> [!NOTE]

MODIFIED docs/identity/role-based-access-control/delegate-by-task.md

Modified by rolyon on May 25, 2025 7:12 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Submit support ticket role update

Changes:

Before

After

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 03/12/2025
ms.author: rolyon
ms.custom: it-pro, sfi-ga-nochange
#Customer intent: As a Microsoft Entra administrator, I want to know which role has the least privilege for a given task to make my Microsoft Entra organization more secure.
> [!div class="mx-tableFixed"]
> | Task | Least privileged role | Additional roles |
> | ---- | --------------------- | ---------------- |
> | Submit support ticket | [Service Support Administrator](permissions-reference.md#service-support-administrator) | [Application Administrator](permissions-reference.md#application-administrator)<br/>[Azure Information Protection Administrator](permissions-reference.md#azure-information-protection-administrator)<br/>[Billing Administrator](permissions-reference.md#billing-administrator)<br/>[Cloud Application Administrator](permissions-reference.md#cloud-application-administrator)<br/>[Compliance Administrator](permissions-reference.md#compliance-administrator)<br/>[Dynamics 365 Administrator](permissions-reference.md#dynamics-365-administrator)<br/>[Desktop Analytics Administrator](permissions-reference.md#desktop-analytics-administrator)<br/>[Exchange Administrator](permissions-reference.md#exchange-administrator)<br/>[Intune Administrator](permissions-reference.md#intune-administrator)<br/>[Password Administrator](permissions-reference.md#password-administrator)<br/>[Fabric Administrator](permissions-reference.md#fabric-administrator)<br/>[Privileged Authentication Administrator](permissions-reference.md#privileged-authentication-administrator)<br/>[SharePoint Administrator](permissions-reference.md#sharepoint-administrator)<br/>[Skype for Business Administrator](permissions-reference.md#skype-for-business-administrator)<br/>[Teams Administrator](permissions-reference.md#teams-administrator)<br/>[Teams Communications Administrator](permissions-reference.md#teams-communications-administrator)<br/>[User Administrator](permissions-reference.md#user-administrator) |
 
## Next steps
 

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 05/25/2025
ms.author: rolyon
ms.custom: it-pro, sfi-ga-nochange
#Customer intent: As a Microsoft Entra administrator, I want to know which role has the least privilege for a given task to make my Microsoft Entra organization more secure.
> [!div class="mx-tableFixed"]
> | Task | Least privileged role | Additional roles |
> | ---- | --------------------- | ---------------- |
> | Submit support ticket | [Service Support Administrator](permissions-reference.md#service-support-administrator) | [Application Administrator](permissions-reference.md#application-administrator)<br/>[Azure Information Protection Administrator](permissions-reference.md#azure-information-protection-administrator)<br/>[Billing Administrator](permissions-reference.md#billing-administrator)<br/>[Cloud Application Administrator](permissions-reference.md#cloud-application-administrator)<br/>[Compliance Administrator](permissions-reference.md#compliance-administrator)<br/>[Dynamics 365 Administrator](permissions-reference.md#dynamics-365-administrator)<br/>[Desktop Analytics Administrator](permissions-reference.md#desktop-analytics-administrator)<br/>[Exchange Administrator](permissions-reference.md#exchange-administrator)<br/>[Helpdesk Administrator](permissions-reference.md#helpdesk-administrator)<br/>[Intune Administrator](permissions-reference.md#intune-administrator)<br/>[Password Administrator](permissions-reference.md#password-administrator)<br/>[Fabric Administrator](permissions-reference.md#fabric-administrator)<br/>[Privileged Authentication Administrator](permissions-reference.md#privileged-authentication-administrator)<br/>[SharePoint Administrator](permissions-reference.md#sharepoint-administrator)<br/>[Skype for Business Administrator](permissions-reference.md#skype-for-business-administrator)<br/>[Teams Administrator](permissions-reference.md#teams-administrator)<br/>[Teams Communications Administrator](permissions-reference.md#teams-communications-administrator)<br/>[User Administrator](permissions-reference.md#user-administrator) |
 
## Next steps
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files