📋 Microsoft Entra Documentation Changes

- [Domains](#domains): Simplify domain management by accessing domain information, verifying DNS records, and managing domain settings using natural language queries.

- [Tenants](#tenants): Get quick access to your Microsoft Entra ID organization information, including tenant ID, display name, active licenses, and contacts.

- Application Administrator

- IT Governance Administrator

- Privileged Role Administrator

- Identity Governance Administrator

- Conditional Access Administrator

- Security Administrator

- Hybrid Identity Administrator

- Authentication Policy Administrator

- Authentication Administrator

Under the guest billing model, guests are identified by a userType of **Guest** regardless of where the user authenticates. A userType of **Guest** is the default userType for all B2B invitation methods and can also be set by an Identity administrator. The bill for each month will include a record for each guest user with one or more governance actions in that month. See the Azure pricing page for pricing details.

Guest users are only billed when they actively use features that are exclusive to Microsoft Entra ID Governance. Features included with Microsoft Entra P2 are not billed. Additionally, if a guest does not take any active governance-related action during a month—such as in cases where access was auto-assigned in a prior month—they will not be billed for that month.

You can identify actions that will be billed to the Microsoft Entra ID Governance for guests add-on by looking at your audit logs. Specifically, each billable action will have these properties included:

Below is a list of currently billable actions for **guest users**. Note that this list may change as additional features are added to Microsoft Entra ID Governance.

## Certificates and secrets

 

Certificates and secrets, also known as credentials, are a vital part of an application when it's used as a confidential client. Under **Certificates and secrets** for the application in the Azure portal, certificates and secrets can be added or removed.

 

:::image type="content" source="./media/application-registration-best-practices/credentials.png" alt-text="Screenshot that shows where the certificates and secrets are located.":::

 

Consider the following guidance related to certificates and secrets:

 

- Always use [certificate credentials](./certificate-credentials.md) whenever possible and don't use password credentials, also known as *secrets*. While it's convenient to use password secrets as a credential, when possible use x509 certificates as the only credential type for getting tokens for an application.

- Configure [application authentication method policies](/graph/api/resources/applicationauthenticationmethodpolicy) to govern the use of secrets by limiting their lifetimes or blocking their use altogether.

- Use Key Vault with [managed identities](~/identity/managed-identities-azure-resources/overview.md) to manage credentials for an application.

title: Troubleshooting Conditional Access policies and Security Copilot

description:

# Troubleshooting Conditional Access policies and Security Copilot

[Generative Artificial Intelligence (AI)](/ai/playbook/technology-guidance/generative-ai/) services like [Microsoft Security Copilot](/copilot/security/microsoft-security-copilot) when used appropriately bring value to your organization.

Applying Conditional Access policy to these Generative AI services can be accomplished through [our recomendation to target all resources](concept-conditional-access-cloud-apps.md#all-resources). These policies might include those for [all users](policy-all-users-mfa-strength.md), risky [users](policy-risk-based-user.md) or [sign-ins](policy-risk-based-sign-in.md), and users with [insider risk](policy-risk-based-insider-block.md).

Some organizations target the following services directly using the underlying service principals and custom security attributes in their Conditional Access policies:

:::image type="content" source="media/entitlement-management-dynamic-approval/native-support-diagram.png" alt-text="Screenshot of native support of approvers in Entitlement management.":::

:::image type="content" source="media/entitlement-management-dynamic-approval/dynamic-extensibility-diagram.png" alt-text="Screenshot of example of determining approvers using custom extensions.":::

ms.date: 03/04/2025

| May | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|

Organizations without proper activation alerts for highly privileged roles lack visibility into when these critical permissions are exercised. Threat actors can exploit this monitoring gap to perform privilege escalation by activating highly privileged roles without detection, then establish persistence through administrative account creation or security policy modifications. The absence of real-time alerting enables attackers to conduct lateral movement, modify audit configurations, and disable security controls without triggering immediate response procedures.

Azure Logic Apps integrated with Microsoft Entra Identity Governance create a significant attack surface when access controls are inadequate. Threat actors can exploit misaligned permissions between Logic Apps management roles and Entra directory roles to gain initial access through compromised accounts with excessive Azure RBAC permissions. Once accessed, threat actors can modify workflow logic to insert malicious automation into provisioning processes, then use managed identities and existing connections for lateral movement across connected systems.

- If an organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting **Add other applications** and providing the app ID. Due to a current user interface (UI) limitation the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).

1. Under **Supported account types**, select _Personal Microsoft accounts only_.