📋 Microsoft Entra Documentation Changes

ms.date: 10/15/2024

1. In the owner tenant, use the [Update-MgBetaTenantRelationshipMultiTenantOrganization](/powershell/module/microsoft.graph.beta.identity.signins/update-mgbetatenantrelationshipmultitenantorganization) command to create your multitenant organization. This operation can take a few minutes.

Update-MgBetaTenantRelationshipMultiTenantOrganization -DisplayName "Cairo"

1. Use the [Get-MgBetaTenantRelationshipMultiTenantOrganization](/powershell/module/microsoft.graph.beta.identity.signins/get-mgbetatenantrelationshipmultitenantorganization) command to check that the operation has completed before proceeding.

Get-MgBetaTenantRelationshipMultiTenantOrganization | Format-List

 

## November 2024

 

### Public Preview - Universal Continuous Access Evaluation

 

**Type:** New feature

**Service category:** Provisioning

**Product capability:** Network Access

 

Continuous Access Evaluation (CAE) revokes, and revalidates, network access in near real-time whenever Microsoft Entra ID detects changes to the identity. For more information, see: [Universal Continuous Access Evaluation (Preview)](../global-secure-access/concept-universal-continuous-access-evaluation.md).

 

 

### Public Preview - Microsoft Entra new store for certificate-based authentication

 

**Type:** New feature

**Service category:** Authentications (Logins)

**Product capability:** User Authentication

## Linkable identifiers in Microsoft SharePoint Online audit logs

 

Microsoft SharePoint Online audit logs provide a comprehensive audit trail of all requests processed by the SharePoint Online service for a tenant. These logs capture a wide range of user activities, including operations such as file and folder creation, updates, deletions, and list modifications. For a detailed overview of SharePoint Online audit logging, see [SharePoint Online Audit Logs](/purview/audit-log-sharing?tabs=microsoft-purview-portal).

 

**Investigation Scenarios Using Linkable Identifiers**

 

For scenarios involving SharePoint Online activity, you can:

 

- Start with linkable identifiers from Microsoft Entra sign-in logs, such as SID or UTI.

- Use these identifiers to search Microsoft Purview Audit (Standard) or Audit (Premium) logs.

- Track all user actions performed within SharePoint Online during a specific session or by a specific token.

 

This approach enables security analysts to correlate authentication events with SharePoint activity, supporting effective investigation and response to potential threats.

 

For guidance on searching SharePoint Online audit logs, see [Search the audit log | Microsoft Learn](/purview/audit-search).

 

The table below shows the mapping between linkable identifier claims and Microsoft SharePoint Online audit log attribute.

ms.date: 05/16/2025

| [Canadian Privacy Laws](https://global.azure.com/auditmanager/certificates/views/cert/217) | Canadian privacy laws aim to protect the privacy of individuals and give them the right to access information gathered about them. These privacy laws include the Privacy Act, Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta Personal Information Protection Act (PIPA), and British Columbia Freedom of Information and Protection of Privacy Act (BC FIPPA). For more information, see [Canada privacy laws](/azure/compliance/offerings/offering-canada-privacy-laws). | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | |

| [CDSA](https://global.azure.com/auditmanager/certificates/views/cert/94) | The Content Delivery & Security Association (CDSA) Content Protection & Security (CPS) standard provides guidance and requirements for securing media assets within a Content Security Management System (CSMS). The standard includes controls to protect intellectual property and keep media assets secure and confidential throughout the digital media supply chain. For more information, see [CDSA](/azure/compliance/offerings/offering-cdsa). | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | Certification available |

| [CSA STAR](https://global.azure.com/auditmanager/certificates/views/cert/132) | Cloud Security Alliance (CSA) STAR certification is based on achieving ISO 27001 certification and meeting criteria in the Cloud Controls Matrix (CCM). It shows that a cloud service provider meets ISO 27001 requirements, addresses key cloud security issues in the CCM, and is assessed against the STAR Capability Maturity Model for managing activities in CCM control areas. For more information, see [Cloud Security Alliance (CSA) STAR Certification](/azure/compliance/offerings/offering-csa-star-certification). | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | |

| [DoD DISA SRG Level 2](https://global.azure.com/auditmanager/certificates/views/cert/122) | The Defense Information Systems Agency (DISA) is an agency of the US Department of Defense (DoD) that is responsible for developing and maintaining the DoD Cloud Computing Security Requirements Guide (SRG). The SRG defines the baseline security requirements used by DoD to assess the security posture of a cloud service provider (CSP), supporting the decision to grant a DoD Provisional Authorization (PA) that allows a CSP to host DoD missions. It incorporates, supersedes, and rescinds the previously published DoD Cloud Security Model (CSM). For more information, see [Department of Defense (DoD) Impact Level 2 (IL2)](/azure/compliance/offerings/offering-dod-il2). | [FedRAMP High](https://global.azure.com/auditmanager/certificates/views/cert/139) | |

| [EAR](https://global.azure.com/auditmanager/certificates/views/cert/191) | The US Department of Commerce is responsible for enforcing the Export Administration Regulations (EAR) through the Bureau of Industry and Security (BIS). According to BIS definitions, Export is the transfer of protected technology or information to a foreign destination or release of protected technology or information to a foreign person in the United States (also known as Deemed Export). For more information, see [Export Administration Regulations (EAR)](/azure/compliance/offerings/offering-ear). | [FedRAMP High](https://global.azure.com/auditmanager/certificates/views/cert/139) | |

| [FedRAMP High](https://global.azure.com/auditmanager/certificates/views/cert/139) | The US Federal Risk and Authorization Management Program (FedRAMP) was established in December 2011 to provide a standardized approach for assessing, monitoring, and authorizing cloud service providers (CSPs). For more information, see [Federal Risk and Authorization Management Program (FedRAMP)](/azure/compliance/offerings/offering-fedramp). | NA | |

| [FIPS 140-2](https://global.azure.com/auditmanager/certificates/views/cert/147) | The Federal Information Processing Standard (FIPS) Publication 140-2 is a US government standard that defines minimum security requirements for cryptographic modules in products and systems. Validation against the FIPS 140-2 standard is required for all US federal government agencies that use cryptography-based security systems to protect sensitive but unclassified information stored digitally. For more information, see [Federal Information Processing Standard (FIPS) 140](/azure/compliance/offerings/offering-fips-140-2). | [FedRAMP High](https://global.azure.com/auditmanager/certificates/views/cert/139) | |

| [GDPR](https://global.azure.com/auditmanager/certificates/views/cert/218) | The General Data Protection Regulation (GDPR) is a European privacy law that became effective in May 2018. It imposes new rules on organizations that offer goods and services to people in the European Union (EU) or that collect and analyze data belonging to EU individuals. The GDPR requires that data controllers, such as organizations using Azure, only use data processors, such as Microsoft, that provide sufficient guarantees to meet key requirements of the GDPR. For more information, see [General Data Protection Regulation summary](/compliance/regulatory/gdpr). | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | |

| [GxP (FDA 21 CFR Part 11)](https://global.azure.com/auditmanager/certificates/views/cert/156) | Azure can help customers meet their requirements under Good Clinical, Laboratory, and Manufacturing Practices (GxP), as well as regulations enforced by the US Food and Drug Administration (FDA) under 21 CFR Part 11. For more information, see [GxP (FDA 21 CFR Part 11)](/azure/compliance/offerings/offering-gxp). | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | |

| [HDS (France)](https://global.azure.com/auditmanager/certificates/views/cert/209) | Microsoft Azure has the Health Data Hosting (Hébergeurs de Données de Santé, HDS) certification, which is required for all entities that host personal health data governed by French law. Microsoft is the first major cloud service provider to meet the strict French standards for storing and processing health data. For more information, see [Health Data Hosting (HDS) France](/compliance/regulatory/offering-hds-france). | [ISO 27001:2013](https://global.azure.com/auditmanager/certificates/views/cert/95) | |

>[!NOTE]

>If you retry CBA in a browser, it'll keep failing due to the browser caching issue. Users need to open a new browser session and sign in again.

 

ms.date: 01/16/2024

> ID Protection detects risk on single tenant, third party SaaS, and multitenant apps. Managed Identities aren't currently in scope.

To make use of workload identity risk reports, including the **Risky workload identities** blade and the **Workload identity detections** tab in the **Risk detections** blade in the portal, you must have the following.

- Security Administrator

- Security Operator

- Security Reader

ms.date: 01/16/2024

Microsoft Graph is the Microsoft unified API endpoint and the home of [Microsoft Entra ID Protection](./overview-identity-protection.md) APIs. This article shows you how to use the [Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/get-started) to manage risky users using PowerShell. Organizations that want to query the Microsoft Graph APIs directly can use the article, [Tutorial: Identify and remediate risks using Microsoft Graph APIs](/graph/tutorial-riskdetection-api) to begin that journey.

To successfully complete this tutorial, make sure you have the required prerequisites:

- Microsoft Graph PowerShell SDK is installed. For more information, see the article [Install the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/installation?view=graph-powershell-1.0&preserve-view=true).

- Microsoft Graph PowerShell using a [Security Administrator](~/identity/role-based-access-control/permissions-reference.md#security-administrator) role. The IdentityRiskEvent.Read.All, IdentityRiskyUser.ReadWrite.All Or IdentityRiskyUser.ReadWrite.All delegated permissions are required. To set the permissions to IdentityRiskEvent.Read.All and IdentityRiskyUser.ReadWrite.All, run:

title: Add a platform to your app registration

description: Learn how to add a platform to your app in Microsoft Entra to securely handle authentication tokens and enhance your application's security.

# Add a platform to your app registration

The Microsoft identity platform supports authentication for modern application types such as web applications, single-page applications (SPA) and mobile and desktop apps. After you register your app in the Microsoft Entra admin center, specify the app type by setting up an app platform and other authentication settings for your platform.

 

When you add a platform to your app registration, specify a redirect URI. The redirect URI is the endpoint where the Microsoft identity platform sends security tokens after a user authenticates. This URI is a key security measure that makes sure security tokens go only to the intended recipient.

## Add a platform to your app

ms.date: 05/06/2025

* A Microsoft Entra tenant

* A Microsoft Entra ID P1 or P2 license to view the sign-in data

* A user in the Reports Reader, Security Reader, or Security Administrator role.

Add the following query, then select the **Run query** button.

ms.date: 10/15/2024

PATCH https://graph.microsoft.com/beta/policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration

PATCH https://graph.microsoft.com/beta/policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration

ms.date: 07/16/2024

Microsoft Entra ID Protection allows you to give feedback on its risk assessment. The following document lists the scenarios where you would like to give feedback on Microsoft Entra ID Protection's risk assessment and how we incorporate it.

An ID Protection detection is an indicator of suspicious activity from an identity risk perspective. These suspicious activities are called risk detections. These identity-based detections can be based on heuristics, machine learning or can come from partner products. These detections are used to determine sign-in risk and user risk,

[Universal tenant restrictions](../global-secure-access/how-to-universal-tenant-restrictions.md) enable you to control access to external tenants by unmanaged identities on company-managed devices and networks. You can enforce this restriction at the authentication plane with tenant restrictions v1, by either blocking or allowing all traffic to an external tenant.

This scenario usually requires hair-pinning traffic to a corporate network proxy. With universal tenant restrictions, organizations can restrict access on a per-application level, extend protection to the data plane (in addition to the authentication plane), and eliminate the need to hair-pin traffic to reduce network latency.

1. Sign in to your test device and try to access a different tenant's SharePoint Online or Exchange Online resource for which you have valid credentials.

1. [Validate authentication plane protection](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-the-authentication-plane-protection).

 

1. [Validate data plane protection](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-the-data-plane-protection).

ms.date: 05/07/2025

The email notifications provide a basic summary of the specific recommendation with a link to the related area of the Microsoft Entra admin center. The email also includes a link to related documentation so you can learn more about the recommendation and how to resolve it. These emails are enabled by default, are not promotional or marketing emails, and do not contain any upsell content. They are purely informational and designed to help you act quickly when a new recommendation is available.

All email notifications for all Microsoft Entra recommendations are now blocked and are no longer sent to the tenant's administrative roles.

### Get diagnostic logs details

 

Finally, Natasha reviews the diagnostic logs to get more detailed information about the system’s operations during the times of the suspicious activities. She filters the logs by Karita’s user ID and the times of the unusual sign-ins.

 

She uses the following prompts to get the information she needs:

 

- *What are the diagnostics log configuration for the tenant that is [email protected] registered in?*

- *Which logs are being collected in this tenant?*