Microsoft Entra Documentation Changes

MODIFIED docs/identity/monitoring-health/concept-identity-secure-score.md

Modified by shlipsey3 on May 31, 2025 6:51 AM
📖 View on learn.microsoft.com

+21 / -10 lines changed

Commit: list-cleanup

Changes:

Before

After

ms.service: entra-id
ms.subservice: monitoring-health
ms.topic: conceptual
ms.date: 05/27/2025
 
ms.author: sarahlipsey
author: shlipsey3
manager: femila
ms.reviewer: guptashi
 
# Customer intent: As an IT admin, I want to know how to use the Identity Secure Score and related recommendations to improve the security posture of my Microsoft Entra tenant.
 
 
The following recommendations are included in the Identity Secure Score:
 
- Require multifactor authentication (MFA) for administrative roles
- Ensure all users can complete MFA
- Enable policy to block legacy authentication
- Do not expire passwords
- Protect all users with a user risk policy

ms.service: entra-id
ms.subservice: monitoring-health
ms.topic: conceptual
ms.date: 05/30/2025
 
ms.author: sarahlipsey
author: shlipsey3
manager: femila
ms.reviewer: jadedsouza
 
# Customer intent: As an IT admin, I want to know how to use the Identity Secure Score and related recommendations to improve the security posture of my Microsoft Entra tenant.
 
 
The following recommendations are included in the Identity Secure Score:
 
- Configure VPN integration
- Designate more than one Global Administrator
- Do not allow users to grant consent to unreliable applications
- Do not expire passwords
- Edit misconfigured certificate templates ACL

MODIFIED docs/global-secure-access/troubleshoot-connectors.md

Modified by Regan Downer on May 31, 2025 1:45 AM
📖 View on learn.microsoft.com

+17 / -14 lines changed

Commit: Update troubleshoot-connectors.md

Changes:

Before

After

> [!NOTE]
> The connector installation logs can be found in the `%TEMP%` folder and can help provide additional information on what is causing an installation failure.
 
## Use Connector Diagnostics tool to identity connector installation and network problems
The connector diagnostics tool is an exe command-line application that is included in connector package. This tool is designed to diagnose common connector setup and runtime errors to identify installation or network problems. Currently, the tool supports the following checks:
  1.	Certificate validity
  2.	Ports 80/443 accessibility
  3.	Outbound proxy configuration
  4.	CRL accessibility
  5.	Connector service running
  6.	Backend service endpoint accessibility
 
The tool also provides additional information, such as certificate details (if the cert is valid), tenant and connector ID, and TLS versions. To ensure that no checks are missed due to network / intermittent issues, the tool contains retries and prints out exception messages for any connectivity failures.
 
**How to Get the tool:** Connector diagnostics tool is available in connector installation package starting version 1.5.4287.0. Previous versions don't contain the tool. A new connector installation is needed to get the tool if you are using previous version. 
 
**How to Use the tool:** After verifying successful installation, the tool can be found in the connector installation folder, located by default in C:/Program Files/Microsoft Entra Private Network Connector. Double click the application "ConnectorDiagnosticsTool" to launch the tool. 
 
![image](https://github.com/user-attachments/assets/76feaf98-9f2c-492c-bb66-7d65fa4dc576)
 

> [!NOTE]
> The connector installation logs can be found in the `%TEMP%` folder and can help provide additional information on what is causing an installation failure.
 
## Use the Connector Diagnostics tool to identity connector installation and network problems
 
The connector diagnostics tool is an exe command-line application that is included in the connector package. This tool is designed to diagnose common connector setup and runtime errors to identify installation or network problems. Currently, the tool supports the following checks:
 
- Certificate validity
- Ports 80/443 accessibility
- Outbound proxy configuration
- CRL accessibility
- Connector service running
- Backend service endpoint accessibility
 
The tool also provides additional information, such as certificate details (if the cert is valid), tenant and connector ID, and TLS versions. To ensure that no checks are missed due to network or intermittent issues, the tool contains retries and prints out exception messages for any connectivity failures.
 
**How to get the tool:** The connector diagnostics tool is available in the connector installation package starting version 1.5.4287.0. Previous versions don't contain the tool. A new connector installation is needed to get the tool if you are using the previous version. 
 
**How to use the tool:** After verifying successful installation, the tool can be found in the connector installation folder, located by default in C:/Program Files/Microsoft Entra Private Network Connector. Double click the application "ConnectorDiagnosticsTool" to launch the tool. 
 

MODIFIED docs/identity/monitoring-health/overview-recommendations.md

Modified by shlipsey3 on May 31, 2025 6:51 AM
📖 View on learn.microsoft.com

+15 / -3 lines changed

Commit: list-cleanup

Changes:

Before

After

ms.service: entra-id
ms.topic: overview
ms.subservice: monitoring-health
ms.date: 04/15/2025
ms.author: sarahlipsey
ms.reviewer: deawari
ms.custom: sfi-ga-nochange
# Customer intent: As a Microsoft Entra administrator, I want guidance to so that I can keep my Microsoft Entra tenant in a healthy state.
---
 
All these Microsoft Entra recommendations provide you with personalized insights with actionable guidance to:
 
- Help you identify opportunities to implement best practices for Microsoft Entra related features.
- Improve the state of your Microsoft Entra tenant.
- Optimize the configurations for your scenarios.
 
| Recommendation | Impacted resources | Availability | Identity Secure Score | Target roles for email notifications |
| --- | --- | --- | --- | --- |
| AAD Connect Deprecated | Tenant | Preview | No | Hybrid Identity Administrator |
| [Convert per-user MFA to Conditional Access MFA](recommendation-turn-off-per-user-mfa.md) | Users | Generally available | No | Security Administrator |

ms.service: entra-id
ms.topic: overview
ms.subservice: monitoring-health
ms.date: 05/30/2025
ms.author: sarahlipsey
ms.reviewer: jadedsouza 
ms.custom: sfi-ga-nochange
# Customer intent: As a Microsoft Entra administrator, I want guidance to so that I can keep my Microsoft Entra tenant in a healthy state.
---
 
All these Microsoft Entra recommendations provide you with personalized insights with actionable guidance to:
 
- Help you identify opportunities to implement identity best practices.
- Improve the state of your Microsoft Entra tenant.
- Optimize the configurations for your scenarios.
 
| Recommendation | Impacted resources | Availability | Identity Secure Score | Target roles for email notifications |
| --- | --- | --- | --- | --- |
| AAD Connect Deprecated | Tenant | Preview | No | Hybrid Identity Administrator |
| Configure VPN integration | | Tenant | Preview | Yes | |

MODIFIED docs/identity-platform/identifier-uri-restrictions.md

Modified by Ari Crowe on May 31, 2025 8:16 AM
📖 View on learn.microsoft.com

+3 / -5 lines changed

Commit: Addressing feedback

Changes:

Before

After

 
Existing identifier URIs already configured on the app won't be affected, and all apps will continue to function as normal. This will only affect new updates to Microsoft Entra app configurations.
 
When it isn't enabled, some insecure patterns can still be used. For example, URIs of the format `api://{string}` can still be added.
 
### Enabling and managing the policy
 
## FAQ
 
## What are identifier URIs?
 
Identifier URIs (also called 'App ID URIs') allow a resource (API) developer to specify a string value for their application as its identifier. Clients who acquire a token for the API can use this string value during an OAuth request. For example, if an API had configured an identifier URI of `https://api.contoso.com`, then clients of the API could specify that value in OAuth requests to Microsoft Entra. This identifier URI is used as the audience claim in v1.0 access tokens.
 
### How do these policies work?
 
The enforcements are turned on by configuring an organization's [app management policies](https://learn.microsoft.com/graph/api/resources/applicationauthenticationmethodpolicy?view=graph-rest-beta). A tenant administrator can turn it on or off. 
 
Because the setting requiring [secure identifier URI formats](#secure-patterns) is an important security protection, Microsoft is enabling it in customer tenants during the months of June and July 2025.

 
Existing identifier URIs already configured on the app won't be affected, and all apps will continue to function as normal. This will only affect new updates to Microsoft Entra app configurations.
 
When it isn't enabled, some insecure patterns can still be used. For example, URIs of the format `api://{string}` can still be added.  However, even when the setting is disabled, a tenant verified or initial domain may still be required in some scenarios - for example, when using the `https://` scheme.
 
### Enabling and managing the policy
 
## FAQ
 
### What are identifier URIs?
 
Identifier URIs (also called 'App ID URIs') allow a resource (API) developer to specify a string value for their application as its identifier. Clients who acquire a token for the API can use this string value during an OAuth request. For example, if an API had configured an identifier URI of `https://api.contoso.com`, then clients of the API could specify that value in OAuth requests to Microsoft Entra. This identifier URI is used as the audience claim in v1.0 access tokens.
 
### How do these policies work?
 
The enforcements are turned on by configuring an organization's [app management policies](https://learn.microsoft.com/graph/api/resources/applicationauthenticationmethodpolicy?view=graph-rest-beta). A tenant administrator can turn it on or off.   Microsoft is enabling it by default in some organizations during the months of June and July 2025.  
 
[Learn how to check if the protection has been enabled in your organization](https://aka.ms/check-identifier-uri-protection-state)

MODIFIED docs/identity/hybrid/connect/reference-connect-version-history.md

Modified by owinoakelo on May 31, 2025 3:57 AM
📖 View on learn.microsoft.com

+2 / -4 lines changed

Commit: Update reference-connect-version-history.md

Changes:

Before

After

 
You can download the latest version from the [Microsoft Entra Admin Center](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) under **Manage**.
 
Or, you can download the latest version of Microsoft Entra Connect 2.x from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=47594). See the [release notes for the latest release](reference-connect-version-history.md#21200).
 
Get notified about when to revisit this page for updates by copying and pasting this URL: `https://aka.ms/aadconnectrss` into your ![RSS feed reader icon](media/reference-connect-version-history/feed-icon-16x16.png) feed reader.
 
The following table lists related topics:
|[2.4.21.0](#24210)|15 Nov 2025 (12 months after release of 2.4.27.0)|
|[2.4.27.0](#24270)|15 Jan 2026 (12 months after release of 2.4.129.0)|
|[2.4.129.0](#241290)|27 Mar 2026 (12 months after release of 2.4.131.0)|
|[2.4.131.0](#241310)|30 April 2026|(12 months after release of 2.5.2.0)|
|[2.5.3.0](#2530)||
 
**All other versions are not supported**
05/27/2025: Released for download via the Microsoft Entra admin center.
 
### Added Features
- Modern Authentication enabled allowing customers to configure application-based authentication for enhanced security (Public Preview).
 

 
You can download the latest version from the [Microsoft Entra Admin Center](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) under **Manage**.
 
Get notified about when to revisit this page for updates by copying and pasting this URL: `https://aka.ms/aadconnectrss` into your ![RSS feed reader icon](media/reference-connect-version-history/feed-icon-16x16.png) feed reader.
 
The following table lists related topics:
|[2.4.21.0](#24210)|15 Nov 2025 (12 months after release of 2.4.27.0)|
|[2.4.27.0](#24270)|15 Jan 2026 (12 months after release of 2.4.129.0)|
|[2.4.129.0](#241290)|27 Mar 2026 (12 months after release of 2.4.131.0)|
|[2.4.131.0](#241310)|26 May 2026|(12 months after release of 2.5.3.0)|
|[2.5.3.0](#2530)||
 
**All other versions are not supported**
05/27/2025: Released for download via the Microsoft Entra admin center.
 
### Added Features
- Modern Authentication enabled allowing customers to configure application-based authentication for enhanced security (Public Preview). More details [here](authenticate-application-id.md)
 
### Updated Features
- Upgraded the bundled health agent to version 4.5.2520.0

MODIFIED docs/global-secure-access/how-to-universal-tenant-restrictions.md

Modified by Kristine Toliver on May 31, 2025 1:26 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update how-to-universal-tenant-restrictions.md

Changes:

Before

After

 
The following diagram shows the steps that an example organization takes to help protect against malicious users by using tenant restrictions v2.
 
:::image type="content" source="media/how-to-universal-tenant-restrictions/tenant-restrictions-v-2-universal-tenant-restrictions-flow.png" alt-text="Diagram that shows how tenant restrictions v2 helps protect against malicious users." lightbox="media/how-to-universal-tenant-restrictions/tenant-restrictions-v-2-universal-tenant-restrictions-flow.png":::
 
| Step | Description |
| --- | --- |

 
The following diagram shows the steps that an example organization takes to help protect against malicious users by using tenant restrictions v2.
 
:::image type="content" source="./media/how-to-universal-tenant-restrictions/tenant-restrictions-v-2-universal-tenant-restrictions-flow.png" alt-text="Diagram that shows how tenant restrictions v2 helps protect against malicious users." lightbox="media/how-to-universal-tenant-restrictions/tenant-restrictions-v-2-universal-tenant-restrictions-flow.png":::
 
| Step | Description |
| --- | --- |

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files