Microsoft Entra Documentation Changes

MODIFIED docs/workload-id/workload-identity-federation-config-app-trust-managed-identity.md

Modified by Scott Addie on Jun 7, 2025 6:07 AM
📖 View on learn.microsoft.com

+206 / -51 lines changed

Commit: Update MI as FIC code samples

Changes:

Before

After

manager: CelesteDG
ms.service: entra-workload-id
ms.topic: how-to
ms.date: 12/3/2024
ms.author: cwerner
ms.reviewer: hosamsh
#Customer intent: As an application developer, I want to configure my application to trust a managed identity so that I can access Microsoft Entra protected resources without needing to use or manage application secrets or certificates.
 
The following code snippets demonstrate how to acquire a managed identity token and use it as a credential for your Entra application. The samples are valid in both cases where the target resource in the same tenant as the Entra application, or in a different tenant.
 
### Azure.Identity
 
This example demonstrates accessing an Azure storage container, but can be adapted to access any resource protected by Microsoft Entra.
 
```csharp
using Azure.Identity;
using Azure.Storage.Blobs;
 
internal class Program
{

manager: CelesteDG
ms.service: entra-workload-id
ms.topic: how-to
ms.date: 05/08/2025
ms.author: cwerner
ms.reviewer: hosamsh
#Customer intent: As an application developer, I want to configure my application to trust a managed identity so that I can access Microsoft Entra protected resources without needing to use or manage application secrets or certificates.
 
The following code snippets demonstrate how to acquire a managed identity token and use it as a credential for your Entra application. The samples are valid in both cases where the target resource in the same tenant as the Entra application, or in a different tenant.
 
### Azure Identity client libraries
 
The following code samples demonstrate accessing an Azure Key Vault secret, but can be adapted to access any resource protected by Microsoft Entra.
 
### [.NET](#tab/dotnet)
 
```csharp
using Azure.Core;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

MODIFIED docs/identity/authentication/concept-mfa-data-residency.md

Modified by Justinha on Jun 7, 2025 5:24 AM
📖 View on learn.microsoft.com

+9 / -57 lines changed

Commit: added that providers may route outside of user or company location and removed outdated references

Changes:

Before

After

 
Microsoft Entra ID stores customer data in a geographical location based on the address an organization provides when subscribing to a Microsoft online service such as Microsoft 365 or Azure. For information on where your customer data is stored, see [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) in the Microsoft Trust Center.
 
Cloud-based Microsoft Entra multifactor authentication and MFA Server process and store personal data and organizational data. This article outlines what and where data is stored.
 
The Microsoft Entra multifactor authentication service has datacenters in the United States, Europe, and Asia Pacific. The following activities originate from the regional datacenters except where noted:
 
* Multifactor authentication SMS and phone calls originate from datacenters in the customer's region and are routed by global providers. Phone calls using custom greetings always originate from data centers in the United States.
* General purpose user authentication requests from other regions are currently processed based on the user's location.
* Push notifications that use the Microsoft Authenticator app are currently processed in regional datacenters based on the user's location. Vendor-specific device services, such as Apple Push Notification Service or Google Firebase Cloud Messaging, might be outside the user's location.
 
 
Personal data is user-level information that's associated with a specific person. The following data stores contain personal information:
 
* Blocked users
* Bypassed users
* Microsoft Authenticator device token change requests
* Multifactor authentication activity reports—store multifactor authentication activity from the multifactor authentication on-premises components: NPS Extension, AD FS adapter and MFA server.
* Microsoft Authenticator activations
 

 
Microsoft Entra ID stores customer data in a geographical location based on the address an organization provides when subscribing to a Microsoft online service such as Microsoft 365 or Azure. For information on where your customer data is stored, see [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) in the Microsoft Trust Center.
 
Microsoft Entra multifactor authentication processes and stores personal data and organizational data. This article outlines what and where data is stored.
 
The Microsoft Entra multifactor authentication service has datacenters in the United States, Europe, and Asia Pacific. The following activities originate from the regional datacenters except where noted:
 
* Multifactor authentication SMS and phone calls originate from datacenters in the customer's region and are routed by global providers. **These providers may route the SMS or phone call outside of the user and company location.** Phone calls using custom greetings always originate from data centers in the United States.
* General purpose user authentication requests from other regions are currently processed based on the user's location.
* Push notifications that use the Microsoft Authenticator app are currently processed in regional datacenters based on the user's location. Vendor-specific device services, such as Apple Push Notification Service or Google Firebase Cloud Messaging, might be outside the user's location.
 
 
Personal data is user-level information that's associated with a specific person. The following data stores contain personal information:
 
* Bypassed users
* Microsoft Authenticator device token change requests
* Multifactor authentication activity reports—store multifactor authentication activity from the multifactor authentication on-premises components NPS Extension and AD FS adapter.
* Microsoft Authenticator activations
 
This information is retained for 90 days.

MODIFIED docs/identity/authentication/howto-mfa-mfasettings.md

Modified by Justinha on Jun 7, 2025 2:35 AM
📖 View on learn.microsoft.com

+19 / -19 lines changed

Commit: replaced default scripts for custom greetings for MFA voice prompts

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 05/21/2025
ms.author: justinha
author: justinha
manager: femila
 
### Custom voice message defaults
 
You can use the following sample scripts to create your own custom messages. These phrases are the defaults if you don't configure your own custom messages.
 
| Message name | Script |
| --- | --- |
| Authentication successful | Your sign-in was successfully verified. Goodbye. |
| Extension prompt | Thank you for using Microsoft's sign-in verification system. Please press the pound key to continue. |
| Activation | Thank you for using the Microsoft sign-in verification system. Please press the pound key to finish your verification. |
| Authentication denied retry | Verification denied. |
| Retry (standard) | Thank you for using the Microsoft sign-in verification system. Please press the pound key to finish your verification. |
| Greeting (standard) | Thank you for using the Microsoft sign-in verification system. Please press the pound key to finish your verification. |

ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
ms.date: 06/06/2025
ms.author: justinha
author: justinha
manager: femila
 
### Custom voice message defaults
 
You can use the following sample scripts to create your own custom messages. These phrases are used by default if you don't configure your own custom messages.
 
Message name | Script
-------------|--------
OTP extension prompt | This is Microsoft. If you are trying to sign in, press the # key to continue. <br>The "#" represents the # key on a phone keypad. When translating, translate "#" to the word used to describe that key. For example, this phrase in English is "Press the pound key to continue.
OTP fraud greeting | This is Microsoft. If you are trying to sign in, press the # key to continue. If you are not trying to sign in, press 0 and #.<br>The "#" represents the # key on a phone keypad. When translating, translate "#" to the word used to describe that key. For example, these phrases in English are "Press the pound key to continue" and "To report this authentication to your IT team, press 0 pound".
OTP fraud confirm | If this was not you trying to sign in, protect your account by notifying your IT team by pressing 1.
OTP fraud confirmed | We have notified your IT team, no further action is required. For help, please contact your company's IT team. Goodbye.
OTP goodbye | Goodbye.
OTP greeting | This is Microsoft. If you are trying to sign in, press the # key to continue.<br>The "#" represents the # key on a phone keypad. When translating, translate "#" to the word used to describe that key. For example, this phrase in English is "Press the pound key to continue."

MODIFIED docs/identity/hybrid/connect/how-to-connect-install-existing-database.md

Modified by Nuno Alexandre on Jun 7, 2025 10:14 AM
📖 View on learn.microsoft.com

+19 / -14 lines changed

Commit: Learn Editor: Update how-to-connect-install-existing-database.md

Changes:

Before

After

- Except for credentials information, the synchronization configuration stored in the ADSync database is automatically recovered and used during installation. This includes custom synchronization rules, connectors, filtering, and optional features configuration.
- All the identity data (associated with connector spaces and metaverse) and synchronization cookies stored in the ADSync database are also recovered. The newly installed Microsoft Entra Connect server can continue to synchronize from where the previous Microsoft Entra Connect server left off, instead of having the need to perform a full sync.
 
## Scenarios where using an existing ADSync database is beneficial
These benefits are useful in the following scenarios:
 
 
## Steps to install Microsoft Entra Connect with “use existing database” mode
1. Download Microsoft Entra Connect installer (AzureADConnect.MSI) to the Windows server. Double-select the Microsoft Entra Connect installer to start installing Microsoft Entra Connect.
2. Once the MSI installation completes, the Microsoft Entra Connect wizard starts with the Express mode setup. Close the screen by selecting the Exit icon.
![Screenshot that shows the "Welcome to Microsoft Entra Connect" page, with "Express Settings" in the left-side menu highlighted.](./media/how-to-connect-install-existing-database/db1.png)
3. Start a new command prompt or PowerShell session. Navigate to folder "C:\Program Files\Microsoft Azure Active Directory Connect". Run command .\AzureADConnect.exe /useexistingdatabase to start the Microsoft Entra Connect wizard in “Use existing database” setup mode.
 
 
![PowerShell](./media/how-to-connect-install-existing-database/db2.png)
1. You are greeted with the Welcome to Microsoft Entra Connect screen. Once you agree to the license terms and privacy notice, select **Continue**.
   ![Screenshot that shows the "Welcome to Microsoft Entra Connect" page](./media/how-to-connect-install-existing-database/db3.png)
1. On the **Install required components** screen, the **Use an existing SQL Server** option is enabled. Specify the name of the SQL server that is hosting the ADSync database. If the SQL engine instance used to host the ADSync database isn't the default instance on the SQL server, you must specify the SQL engine instance name. Further, if SQL browsing isn't enabled, you must also specify the SQL engine instance port number. For example:         
   ![Screenshot that shows the "Install required components" page.](./media/how-to-connect-install-existing-database/db4.png)           
 

- Except for credentials information, the synchronization configuration stored in the ADSync database is automatically recovered and used during installation. This includes custom synchronization rules, connectors, filtering, and optional features configuration.
- All the identity data (associated with connector spaces and metaverse) and synchronization cookies stored in the ADSync database are also recovered. The newly installed Microsoft Entra Connect server can continue to synchronize from where the previous Microsoft Entra Connect server left off, instead of having the need to perform a full sync.
 
> [!IMPORTANT]
> In certain edge cases, installing from an existing ADSync database may trigger a full synchronization cycle. If you're not ready to initiate a full sync immediately after installation, you can defer it by configuring the sync scheduler. Use one of the following options:
- To set the NextSyncCyclePolicyType: `Set-ADSyncScheduler -NextSyncCyclePolicyType Delta`
> - To override connector behavior and prevent a full import/sync: `Set-ADSyncSchedulerConnectorOverride -ConnectorName '<connector name>' -FullImportRequired $false -FullSyncRequired $false`
 
## Scenarios where using an existing ADSync database is beneficial
These benefits are useful in the following scenarios:
 
 
## Steps to install Microsoft Entra Connect with “use existing database” mode
1. Download Microsoft Entra Connect installer (AzureADConnect.MSI) to the Windows server. Double-select the Microsoft Entra Connect installer to start installing Microsoft Entra Connect.
1. Once the MSI installation completes, the Microsoft Entra Connect wizard starts with the Express mode setup. Close the screen by selecting the Exit icon.
![Screenshot that shows the "Welcome to Microsoft Entra Connect" page, with "Express Settings" in the left-side menu highlighted.](./media/how-to-connect-install-existing-database/db1.png)
3. Start a new command prompt or PowerShell session. Navigate to folder "C:\Program Files\Microsoft Azure Active Directory Connect". Run command .\AzureADConnect.exe /useexistingdatabase to start the Microsoft Entra Connect wizard in “Use existing database” setup mode.
 
 
![PowerShell](./media/how-to-connect-install-existing-database/db2.png)

MODIFIED docs/identity/conditional-access/agent-optimization.md

Modified by shlipsey3 on Jun 7, 2025 6:03 AM
📖 View on learn.microsoft.com

+15 / -9 lines changed

Commit: image-step-cleanup

Changes:

Before

After

ms.author: joflore
author: MicrosoftGuyJFlo
 
ms.date: 06/04/2025
 
ms.service: entra-id
ms.subservice: conditional-access
## Getting started
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator).
1. From the new home page, select **Go to agents** from the agent notification card. 
 
   :::image type="content" source="media/agent-optimization/conditional-access-optimization-agent-try-now.png" alt-text="Screenshot of the Microsoft Entra admin center showcasing the new Security Copilot agents experience." lightbox="media/agent-optimization/conditional-access-optimization-agent-try-now.png":::
 
1. Select **View details** under the Conditional Access Optimization Agent, then select **Run agent** to begin your first run. 
 
   :::image type="content" source="media/agent-optimization/agent-optimization-start-agent.png" alt-text="Screenshot showing the Conditional Access Optimization Agent configuration page." lightbox="media/agent-optimization/agent-optimization-start-agent.png":::
 
1. When the agent overview page loads, you see most recent and next scheduled runtimes, performance highlights, recent suggestions, and recent activity.
 

ms.author: joflore
author: MicrosoftGuyJFlo
 
ms.date: 06/06/2025
 
ms.service: entra-id
ms.subservice: conditional-access
## Getting started
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator).
1. From the new home page, select **Go to agents** from the agent notification card then select **View details** under the Conditional Access Optimization Agent.
 
   :::image type="content" source="media/agent-optimization/conditional-access-optimization-agent-try-now.png" alt-text="Screenshot of the Microsoft Entra admin center showcasing the new Security Copilot agents experience." lightbox="media/agent-optimization/conditional-access-optimization-agent-try-now.png":::
 
1. Select **Run agent** to begin your first run. 
 
   :::image type="content" source="media/agent-optimization/agent-optimization-start-agent.png" alt-text="Screenshot showing the Conditional Access Optimization Agent configuration page." lightbox="media/agent-optimization/agent-optimization-start-agent.png":::
 
1. When the agent overview page loads, any suggestions appear at the top. You can also see the recent activity 
and performance highlights.

MODIFIED docs/fundamentals/copilot-entra-security-scenarios.md

Modified by shlipsey3 on Jun 7, 2025 8:19 AM
📖 View on learn.microsoft.com

+15 / -4 lines changed

Commit: Update copilot-entra-security-scenarios.md

Changes:

Before

After

 
### SLA in Scenario Health Monitoring
 
> [!NOTE]
> 
> Details of this feature haven't been provided yet. This section is updated with more information, methods, and examples before GA.
 
### Microsoft Entra domains
 
- [Get started with Microsoft Security Copilot](/copilot/security/get-started-security-copilot)
- [Microsoft Security Copilot experiences](/copilot/security/experiences-security-copilot)
- [Respond to identity threats using risky user summarization](/entra/fundamentals/copilot-entra-risky-user-summarization)

 
### SLA in Scenario Health Monitoring
 
Microsoft Entra Health provides look-back reporting on Service Level Agreements (SLA) for authentication availability for your Microsoft Entra tenant. The SLA Attainment is a monthly look-back solution that shows the core authentication availability of Microsoft Entra ID each month. IT admins often need to review the SLA reports in conjuntion with service outages. Security Copilot interacts with the Microsoft Entra SLA using the Microsoft Graph API.
 
The least privileged role needed for this feature is [Reports Reader](../role-based-access-control/permissions-reference.md#reports-reader).
 
The following example prompts can be used to get SLA information:
 
- *What is my SLA for Microsoft Entra authentication?*
- *What is my Microsoft Entra SLA?*
- *SLA of Microsoft Entra authentication*
- *Microsoft Entra SLA*
- *Show me my tenant's authentication availability*
- *What is my authentication availability?*
- *Authentication availability*
- *Has my tenant had an SLA breach in the last X months?*
 
### Microsoft Entra domains
 

MODIFIED docs/identity/authentication/concept-fido2-compatibility.md

Modified by Justinha on Jun 7, 2025 9:13 AM
📖 View on learn.microsoft.com

+4 / -2 lines changed

Commit: emphasized that ios and macos isn't supported

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 05/12/2025
 
author: justinha
ms.author: justinha
> [!NOTE]
> Passkey authentication with a third-party IdP isn't supported in third-party apps using authentication broker, or Microsoft apps on Android at this time.
 
On iOS and Mac devices that are managed by Mobile Device Management (MDM), third-party IdPs can implement their own single sign-on (SSO) extension.
Apple's extensible SSO framework on MDM-managed devices enables identity providers to intercept network requests directed to their URLs. 
When the SSO extension of the identity provider intercepts a network request, they can implement a custom authentication handshake. 
This allows them to use a system browser or native Apple APIs for passkey authentication without needing changes in Microsoft applications.
 
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 06/06/2025
 
author: justinha
ms.author: justinha
> [!NOTE]
> Passkey authentication with a third-party IdP isn't supported in third-party apps using authentication broker, or Microsoft apps on Android at this time.
 
Microsoft Entra ID doesn't support passkey authentication with a third-party IdP on iOS/macOS. 
As a workaround, third-party IdPs can implement their own single sign-on (SSO) extension on iOS/macOS devices if they're managed by Mobile Device Management (MDM).
 
Apple's extensible SSO framework on MDM-managed devices enables identity providers to intercept network requests directed to their URLs. 
When the SSO extension of the identity provider intercepts a network request, they can implement a custom authentication handshake. 
This allows them to use a system browser or native Apple APIs for passkey authentication without needing changes in Microsoft applications.

MODIFIED docs/identity/monitoring-health/howto-investigate-health-scenario-alerts.md

Modified by shlipsey3 on Jun 7, 2025 2:38 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: health-060625

Changes:

Before

After

title: How to investigate Health monitoring alerts (preview)
description: Learn how to investigate Microsoft Entra health monitoring alerts to monitor and improve the health of your tenant.
author: shlipsey3
manager: femila
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 02/19/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- The [Helpdesk Administrator](../role-based-access-control/permissions-reference.md#helpdesk-administrator) is the least privileged role required to *update alerts* and *update alert notification configurations*.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- The `HealthMonitoringAlert.ReadWrite.All` permission is required to *view and modify the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#monitoring-and-health---audit-and-sign-in-logs-least-privileged-roles).
 
> [!NOTE]
> Newly onboarded tenants might not have enough data to generate alerts for about 30 days.

title: How to investigate Health monitoring alerts (preview)
description: Learn how to investigate Microsoft Entra health monitoring alerts to monitor and improve the health of your tenant.
author: shlipsey3
manager: pmwongera 
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 06/06/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- The [Helpdesk Administrator](../role-based-access-control/permissions-reference.md#helpdesk-administrator) is the least privileged role required to *update alerts* and *update alert notification configurations*.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- The `HealthMonitoringAlert.ReadWrite.All` permission is required to *view and modify the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#microsoft-entra-health-least-privileged-roles).
 
> [!NOTE]
> Newly onboarded tenants might not have enough data to generate alerts for about 30 days.

MODIFIED docs/identity/monitoring-health/scenario-health-sign-ins-compliant-managed-device.md

Modified by shlipsey3 on Jun 7, 2025 2:38 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: health-060625

Changes:

Before

After

title: Sign-ins requiring a compliant or managed device
description: Learn about the Microsoft Entra Health signals and alerts for sign-ins that require a compliant or managed device
author: shlipsey3
manager: femila
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 02/19/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- The [Helpdesk Administrator](../role-based-access-control/permissions-reference.md#helpdesk-administrator) is the least privileged role required to *update alerts* and *update alert notification configurations*.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- The `HealthMonitoringAlert.ReadWrite.All` permission is required to *view and modify the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#monitoring-and-health---audit-and-sign-in-logs-least-privileged-roles).
 
## Investigate the signals and alerts
 

title: Sign-ins requiring a compliant or managed device
description: Learn about the Microsoft Entra Health signals and alerts for sign-ins that require a compliant or managed device
author: shlipsey3
manager: pmwongera 
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 06/06/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- The [Helpdesk Administrator](../role-based-access-control/permissions-reference.md#helpdesk-administrator) is the least privileged role required to *update alerts* and *update alert notification configurations*.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- The `HealthMonitoringAlert.ReadWrite.All` permission is required to *view and modify the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#microsoft-entra-health-least-privileged-roles).
 
## Investigate the signals and alerts
 

MODIFIED docs/identity/monitoring-health/scenario-health-sign-ins-mfa.md

Modified by shlipsey3 on Jun 7, 2025 2:38 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: health-060625

Changes:

Before

After

title: Sign-ins requiring Microsoft Entra MFA
description: Learn about the Microsoft Entra Health signals and alerts for sign-ins that require Microsoft Entra multifactor authentication
author: shlipsey3
manager: femila
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 02/19/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- The [Helpdesk Administrator](../role-based-access-control/permissions-reference.md#helpdesk-administrator) is the least privileged role required to *update alerts* and *update alert notification configurations*.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- The `HealthMonitoringAlert.ReadWrite.All` permission is required to *view and modify the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#monitoring-and-health---audit-and-sign-in-logs-least-privileged-roles).
 
## Investigate the signals and alerts
 

title: Sign-ins requiring Microsoft Entra MFA
description: Learn about the Microsoft Entra Health signals and alerts for sign-ins that require Microsoft Entra multifactor authentication
author: shlipsey3
manager: pmwongera 
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 06/06/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- The [Helpdesk Administrator](../role-based-access-control/permissions-reference.md#helpdesk-administrator) is the least privileged role required to *update alerts* and *update alert notification configurations*.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- The `HealthMonitoringAlert.ReadWrite.All` permission is required to *view and modify the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#microsoft-entra-health-least-privileged-roles).
 
## Investigate the signals and alerts
 

MODIFIED docs/identity/monitoring-health/scenario-health-sign-ins-saml-auth.md

Modified by shlipsey3 on Jun 7, 2025 2:38 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: health-060625

Changes:

Before

After

title: Sign-ins to applications using SAML authentication
description: Learn about the Microsoft Entra Health signals and alerts for sign-ins to applications that use SAML authentication
author: shlipsey3
manager: femila
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 02/03/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- A tenant with a [Microsoft Entra P1 or P2 license](../../fundamentals/get-started-premium.md) is required to view the Microsoft Entra health scenario monitoring signals.
- The [Reports Reader](../role-based-access-control/permissions-reference.md#reports-reader) role is the least privileged role required to view scenario monitoring signals.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#monitoring-and-health---audit-and-sign-in-logs-least-privileged-roles).
 
## Investigate the signals
 

title: Sign-ins to applications using SAML authentication
description: Learn about the Microsoft Entra Health signals and alerts for sign-ins to applications that use SAML authentication
author: shlipsey3
manager: pmwongera 
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 06/06/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 
- A tenant with a [Microsoft Entra P1 or P2 license](../../fundamentals/get-started-premium.md) is required to view the Microsoft Entra health scenario monitoring signals.
- The [Reports Reader](../role-based-access-control/permissions-reference.md#reports-reader) role is the least privileged role required to view scenario monitoring signals.
- The `HealthMonitoringAlert.Read.All` permission is required to *view the alerts using the Microsoft Graph API*.
- For a full list of roles, see [Least privileged role by task](../role-based-access-control/delegate-by-task.md#microsoft-entra-health-least-privileged-roles).
 
## Investigate the signals
 

MODIFIED docs/identity/authentication/troubleshoot-sspr.md

Modified by Justinha on Jun 7, 2025 7:23 AM
📖 View on learn.microsoft.com

+3 / -2 lines changed

Commit: added usage error on slow computers

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: troubleshooting
ms.date: 03/04/2025
 
ms.author: justinha
author: justinha
manager: femila
ms.reviewer: tilarso
---
# Troubleshoot self-service password reset in Microsoft Entra ID
| The directory is enabled for password reset, but the authentication information for the user is missing or malformed. | Make sure that user account is properly formed contact data on file in the directory. For more information, see [Data used by Microsoft Entra self-service password reset](howto-sspr-authenticationdata.md). |
| The directory is enabled for password reset, but the user has only one piece of contact data on file when the policy is set to require two verification methods. | Make sure that the user has at least two properly configured contact methods. An example is having both a mobile phone number *and* an office phone number. |
| The directory is enabled for password reset and the user is properly configured, but the user is unable to be contacted. | A temporary service error, or there's incorrect contact data that we can't properly detect. <br> If the user waits 10 seconds, a link is displayed to "Try again" and "Contact your administrator". If the user selects "Try again," it retries the call. If the user selects "Contact your administrator," it sends a form email to the administrators requesting a password reset to be performed for that user account. |
| The user never receives the password reset SMS or phone call. | The phone number in the directory may be malformed. Make sure the phone number is in the format "+1 4251234567". <br> <br>Password reset doesn't support extensions, even if you specify one in the directory. The extensions are stripped before the call is made. Use a number without an extension, or integrate the extension into the phone number in your private branch exchange (PBX). |
| The user never receives the password reset email. | The most common cause for this problem is that the message is rejected by a spam filter. Check your spam, junk, or deleted items folder for the email. <br> <br> Also, make sure the user checks the correct email account as registered with SSPR. |
| I set a password reset policy, but when an admin account uses password reset, that policy isn't applied. | Microsoft manages and controls the administrator password reset policy to ensure the highest level of security. |
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: troubleshooting
ms.date: 06/06/2025
 
ms.author: justinha
author: justinha
manager: dougeby
ms.reviewer: tilarso
---
# Troubleshoot self-service password reset in Microsoft Entra ID
| The directory is enabled for password reset, but the authentication information for the user is missing or malformed. | Make sure that user account is properly formed contact data on file in the directory. For more information, see [Data used by Microsoft Entra self-service password reset](howto-sspr-authenticationdata.md). |
| The directory is enabled for password reset, but the user has only one piece of contact data on file when the policy is set to require two verification methods. | Make sure that the user has at least two properly configured contact methods. An example is having both a mobile phone number *and* an office phone number. |
| The directory is enabled for password reset and the user is properly configured, but the user is unable to be contacted. | A temporary service error, or there's incorrect contact data that we can't properly detect. <br> If the user waits 10 seconds, a link is displayed to "Try again" and "Contact your administrator". If the user selects "Try again," it retries the call. If the user selects "Contact your administrator," it sends a form email to the administrators requesting a password reset to be performed for that user account. |
| On slow computers, you might need to retry password reset. | If you click **Reset Password** on a slow computer, but password reset dialog box fails to display, retry until it appears. |
| The user never receives the password reset SMS or phone call. | The phone number in the directory may be malformed. Make sure the phone number is in the format "+1 4251234567". <br> <br>Password reset doesn't support extensions, even if you specify one in the directory. The extensions are stripped before the call is made. Use a number without an extension, or integrate the extension into the phone number in your private branch exchange (PBX). |
| The user never receives the password reset email. | The most common cause for this problem is that the message is rejected by a spam filter. Check your spam, junk, or deleted items folder for the email. <br> <br> Also, make sure the user checks the correct email account as registered with SSPR. |
| I set a password reset policy, but when an admin account uses password reset, that policy isn't applied. | Microsoft manages and controls the administrator password reset policy to ensure the highest level of security. |

MODIFIED docs/identity/role-based-access-control/delegate-by-task.md

Modified by shlipsey3 on Jun 7, 2025 2:38 AM
📖 View on learn.microsoft.com

+3 / -2 lines changed

Commit: health-060625

Changes:

Before

After

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 05/25/2025
ms.author: barclayn
ms.custom: it-pro, sfi-ga-nochange
#Customer intent: As a Microsoft Entra administrator, I want to know which role has the least privilege for a given task to make my Microsoft Entra organization more secure.
> [!div class="mx-tableFixed"]
> | Task | Least privileged role | Additional roles |
> | ---- | --------------------- | ---------------- |
> | View scenario monitoring signals | [Reports Reader](permissions-reference.md#reports-reader) | [Security Reader](permissions-reference.md#security-reader)<br>[Security Operator](permissions-reference.md#security-operator)<br>[Security Administrator](permissions-reference.md#security-administrator)<br>[Helpdesk Administrator](permissions-reference.md#helpdesk-administrator)<br>[Global Reader](permissions-reference.md#global-reader)<br>|
 
<a name='identity-protection'></a>
 
 

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 06/06/2025
ms.author: barclayn
ms.custom: it-pro, sfi-ga-nochange
#Customer intent: As a Microsoft Entra administrator, I want to know which role has the least privilege for a given task to make my Microsoft Entra organization more secure.
> [!div class="mx-tableFixed"]
> | Task | Least privileged role | Additional roles |
> | ---- | --------------------- | ---------------- |
> | View scenario monitoring signals and alert configurations | [Reports Reader](permissions-reference.md#reports-reader) | [Security Reader](permissions-reference.md#security-reader)<br>[Security Operator](permissions-reference.md#security-operator)<br>[Security Administrator](permissions-reference.md#security-administrator)<br>[Helpdesk Administrator](permissions-reference.md#helpdesk-administrator)<br>[Global Reader](permissions-reference.md#global-reader)<br>|
> | Update alerts and alert email configurations | [Helpdesk Administrator](permissions-reference.md#helpdesk-administrator) |  |
 
<a name='identity-protection'></a>
 

MODIFIED docs/identity/monitoring-health/scenario-health-conditional-access-block-policy.md

Modified by shlipsey3 on Jun 7, 2025 2:38 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: health-060625

Changes:

Before

After

title: Conditional Access block policy health scenario
description: Learn about the Microsoft Entra Health signals and alerts for Conditional Access block policy health scenarios
author: shlipsey3
manager: femila
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 04/25/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 

title: Conditional Access block policy health scenario
description: Learn about the Microsoft Entra Health signals and alerts for Conditional Access block policy health scenarios
author: shlipsey3
manager: pmwongera 
ms.service: entra-id
ms.topic: how-to
ms.subservice: monitoring-health
ms.date: 06/06/2025
ms.author: sarahlipsey
ms.reviewer: sarbar
 

MODIFIED docs/global-secure-access/scripts/powershell-add-ia-devicecompliance-bypasses.md

Modified by Frank Gomulka on Jun 7, 2025 1:26 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update PowerShell sample documentation and TOC for Intune device compliance bypasses

Changes:

Before

After

 
The [Universal Conditional Access documentation](../concept-universal-conditional-access#known-tunnel-authorization-limitations) notes that Global Secure Access has tunnel authoriziation limitations. This means that you can block access to a forwarding profile in Conditional Access and inadvertenty lock users out from accessing anything on their machine.
 
The way to mitigate this issue is bypassing Network endpoints for Microsoft Intune. This PowerShell script adds Intune-related endpoints to the Global Secure Access Internet Access (IA) custom bypass policy. This helps mitigate device compliance issues and supports scenarios such as AzVPN side-by-side deployments.
 
The sample requires the [Microsoft Graph Beta PowerShell module](/powershell/microsoftgraph/installation) 2.10 or newer.

 
The [Universal Conditional Access documentation](../concept-universal-conditional-access#known-tunnel-authorization-limitations) notes that Global Secure Access has tunnel authoriziation limitations. This means that you can block access to a forwarding profile in Conditional Access and inadvertenty lock users out from accessing anything on their machine.
 
The way to mitigate this issue is bypassing network endpoints for Microsoft Intune. This PowerShell script adds Intune-related endpoints to the Global Secure Access Internet Access (IA) custom bypass policy. This helps mitigate device compliance issues and supports scenarios such as AzVPN side-by-side deployments.
 
The sample requires the [Microsoft Graph Beta PowerShell module](/powershell/microsoftgraph/installation) 2.10 or newer.

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files