📋 Microsoft Entra Documentation Changes

description: Learn how an administrator create a list to allow or block B2B collaboration with specific domains by using the Microsoft Entra admin center.

Recommendations in Microsoft Entra help you improve the security posture of your tenant by providing actionable insights and guidance. These recommendations cover the many features, best practices, and settings of Microsoft Entra, such as using least privileged administrator roles, configuring Self-Service Password Reset, and protecting your tenant with Conditional Access policies. Some recommendations factor into your Identity Secure Score, which can help you monitor and improve the security of your tenant. Using the capabilities of Microsoft Security Copilot, you can now interact with these recommendations using natural language, enabling your security team to quickly investigate how to evolve your tenant to a secure and healthy state.

1. Browse to **Entra ID** > **Overview** > **Recommendations**.

1. {Copilot steps}.

 

 

## Expanding Ephemeral Port Range

 

Private Network connectors initiate TCP/UDP connections to designated destination endpoints, requiring available source ports on the connector host machine. Expanding the ephemeral port range can improve the availability of source ports, particularly when managing a high volume of concurrent connections.

 

To view the current dynamic port range on a system, use the following netsh commands:

- netsh int ipv4 show dynamicport tcp

- netsh int ipv4 show dynamicport udp

- netsh int ipv6 show dynamicport tcp

- netsh int ipv6 show dynamicport udp

Sample netsh commands to increase the ports

- netsh int ipv4 set dynamicport tcp start=1025 num=64511

- netsh int ipv4 set dynamicport udp start=1025 num=64511

- netsh int ipv6 set dynamicport tcp start=1025 num=64511

- netsh int ipv6 set dynamicport udp start=1025 num=64511

 

These commands set the dynamic port range from 1025 to the maximum of 65535. The minimum start port is 1025.

ms.date: 06/04/2025

| **Certificates & secrets** | Multiple credentials enable rotation with minimum downtime, easy migration from secrets to certificates (Microsoft recommends that you use certificates), and fallback options if a credential is compromised or expires: <ul><li>[Certificate](../../identity-platform/how-to-add-credentials.md?tabs=certificate)</li><li>[Client secrets](../../identity-platform/how-to-add-credentials.md?tabs=client-secret)</li><li>[Federated credentials](../../identity-platform/how-to-add-credentials.md?tabs=federated-credential)</li></ul> | Same as workforce.|

 

### Application authorization

 

ms.date: 06/03/2025

> The date of enforcement for Phase 2 has changed to September 1, 2025.

| [Azure command-line interface (Azure CLI)](/cli/azure/) | 04b07795-8ddb-461a-bbee-02f9e1bf7b46 | September 1, 2025 |

| [Azure PowerShell](/powershell/azure/) | 1950a258-227b-4e31-a9cf-717495945fc2 | September 1, 2025 |

| [Azure mobile app](/azure/azure-portal/mobile-app/overview) | 0c1307d4-29d6-4389-a11c-5cbe7f65d7fa | September 1, 2025 |

ms.date: 06/03/2025

Administrators can assign a Conditional Access policy to cloud apps from Microsoft as long as the service principal appears in their tenant. Some apps like [Office 365](#office-365) and [Windows Azure Service Management API](#windows-azure-service-management-api) include multiple related child apps or services. When new supported Microsoft cloud applications are created, they appear in the app picker list.

> Applications that are available to Conditional Access have gone through an onboarding and validation process. This list doesn't include some backend services not meant to have policy directly applied to them. If you're looking for an application that is missing, you can contact the specific application team or make a request on [UserVoice](https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789).

Access reviews in Microsoft Entra ID help organizations to more effectively manage group memberships, application access, and role assignments. Using the capabilities of Microsoft Security Copilot, administrators can now interact with access review data using natural language, enabling fast and actionable insights that reduce manual effort and enhance governance. This integration allows admins to explore, track, and analyze access reviews at scale by asking questions.

This feature helps administrators;:

| Get detailed info on a specific access review | *Get access review details for Finance Microsoft 365 Groups Q2* |

- [Prepare for an access review of users' access to an application](/entra/id-governance/access-reviews-application-preparation)

<!-- You configure and test Microsoft Entra single sign-on for my.sdworx.com in a test environment. my.sdworx.com supports **IDP** initiated single sign-on. -->

 

You configure and test Microsoft Entra single sign-on for my.sdworx.com in a test environment (my.acc.sdworx.com) but not by using this gallery app (import SP metadata, to be provided by your my.sdworx.com contact). my.sdworx.com supports **IDP** and **SP** initiated single sign-on.

When using **SP** initiated initiated single sign-on, only “email domain” realm discovery is supported, which means only company/enterprise email addresses are allowed (no private email addresses like hotmail.com, gmail.com, …)

<!--- Microsoft Entra agents work seamlessly with [Microsoft Security Copilot](/copilot/security/microsoft-security-copilot). Microsoft Security Copilot agents automate repetitive tasks and reduce manual workloads. They enhance security and IT operations across cloud, data security and privacy, identity, and network security. These agents handle high-volume, time-consuming tasks by pairing data and code with an AI language model. They respond to user requests and system events, helping teams work more efficiently and focus on higher-impact tasks.

Microsoft Security Copilot agents offer significant benefits for security teams and IT operations by automating routine tasks and freeing up valuable time for teams to concentrate on strategic initiatives and complex problem-solving. This leads to improved operational efficiency, enhanced security and giving teams the ability to respond more swiftly to emerging threats. With Security Copilot agents, organizations can achieve greater scalability and resilience in their security and IT processes. --->

 

[!INCLUDE [agents-overview](~/../security-copilot/securityopilot.md]

>For a multi-tenant model, IDV should explore setting up dedicated authorities if there is a 1:1 relationship required with the customer. Refer to the [Admin API](admin-api.md) section of the docs for creating authorities.

Note that the JWT token is signed with customer's relying party private key and the public key is shared with the IDV via an endpoint or via a scheduled process. The IDV needs to ensure that for the kickstart journey, it uses attributes from the JWT like org ID, request ID, mscv ID, and expiry. Note that [mscv](https://github.com/microsoft/CorrelationVector) is preferred for end-to-end troubleshooting. An example of the JWT could be as follows:

> IDV partner must provide or build the required web experience where the identity of the user can be proofed in any way necessary as agreed between the relying party application and IDV partner. When the process is completed a list of values are collected according to the Verified ID Credential Type. These values (as “claims” parameter) are passed as part of the Verified ID issuance request API call. If the IDV is building this journey on a webapp, IDV needs to render it as a QR code or deep link. For further details, refer to [Specify the Request Service REST API issuance request](issuance-request-api.md).

In entitlement management, approvers for access package requests can either be directly assigned, or determined dynamically. While entitlement management natively supports dynamic approvers such as the requestor's manager, second-level manager, or sponsor from a connected organization, these options don't cover all scenarios. With [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview), you're able to determine approval requirements for access packages at the time of request through an external system. For example, if the user requesting an access package is in a department where leadership has recently changed, dynamic approvals can query the system and assign the new department head as the approver. With this external call, you're able to determine approval requirements based on each of the [ApprovalStage properties](/graph/api/resources/approvalstage?view=graph-rest-beta#properties). This article walks you through making a custom extension, its underlying Azure Logic App, setting its system-assigned identity and role in the catalog, editing the logic app action to perform business logic, and testing to see if it runs successfully.

- If an organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting 'Add other applications' and providing the app ID. Due to a current user interface (UI) limitation the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).

| May | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|

>Microsoft Entra Connect Health now supports installation using the Hybrid Identity Administrator role. If you installed Microsoft Entra Connect Sync using an account with the role, the Entra Connect Health agent will automatically be in active state and you will not need to do a re-install using a Global Administrator account.

manager: pmwongera