📋 Microsoft Entra Documentation Changes

In this scenario, Global Secure Access handles private application traffic. Netskope only capture Internet traffic.

In this scenario, Global Secure Access handles all Microsoft 365 traffic. Netskope handles private application and Internet traffic.

To configure Microsoft and Netskope for a unified SASE solution, start by setting up Microsoft Entra Internet Access and Microsoft Entra Private Access. Next, configure Netskope Private Access and Internet Access. Finally, make sure to establish the required Fully Qualified Domain Name (FQDN) and IP bypasses to ensure smooth integration between the two platforms.

- Credentials

- Redirect URIs

- Implicit flow configuration

- Application ID URI (a.k.a. identifier URI)

- Access token version

- Application instance lock

## Redirect URIs

title: Security Features in External Tenants

## Built-in security controls

In newly created external tenants, the following core security features are enabled by default to help protect applications from various cyber threats.

|Brute force protection | Mitigates brute force attacks by limiting the number of login attempts to prevent unauthorized access through repeated password guessing. |

|Common networking HTTP Protection | Provides protection against common network-layer attacks and timing-based attacks, protecting against attempts to overwhelm your service with excessive requests.|

|Account Protection | Ensures accounts are protected from unauthorized access to safeguard user data and prevent account compromise. |

|Access Control | Controls access to applications and resources, ensuring only authorized users can access sensitive information. |

## Real-time and offline protection

ms.date: 06/09/2025

In preview, the Conditional Access optimization agent evaluates policies such as requiring multifactor authentication (MFA), enforcing device based controls (device compliance, app protection policies, and domain-joined devices), and blocking legacy authentication and device code flow.

- You can assign [Conditional Access Administrators](../role-based-access-control/permissions-reference.md#conditional-access-administrator) with Security Copilot access, which gives your Conditional Access Administrators the ability to use the agent as well.

- For more information, see [Assign Security Copilot access](/copilot/security/authentication#assign-security-copilot-access)

manager: pmwongera

ms.reviewer: cmmdesai

ms.date: 06/09/2025

Follow these high-level steps for configuring the app integration with Microsoft Entra ID in the Darwinbox Portal.

Open Darwinbox studio and navigate to **Connector Library**. Search for and install the **Microsoft** and **Microsoft Entra** connectors

## May 2025

 

### New articles

 

- [Email OTP send event reference](custom-extension-email-otp-send-data.md)

 

### Updated articles

 

- [Custom claims provider reference](custom-claims-provider-reference.md) - The update improved content clarity.

- [Application configuration options](msal-client-application-configuration.md) - The update improved content clarity.

- [Custom authentication extensions overview](custom-extension-overview.md) - The update improved content clarity.

- [Single-page application: Acquire a token to call an API](scenario-spa-acquire-token.md) - [DevEx] The update improved content clarity.

- [Single-page application: Code configuration](scenario-spa-app-configuration.md) - [DevEx] The update improved content clarity.

- [Single-page application: Add sign-in and sign-out code](scenario-spa-sign-in.md) - [DevEx] The update improved content clarity.

- [Microsoft Entra authentication and authorization error codes](reference-error-codes.md) - Add and partially update error code

 

`https://access.broadcom.com/default/saml/v1/sp/acs`

| FirstName | user.givenname |

| LastName | user.surname |

| Email | user.userprincipalname |

| Groups | user.assignedroles |

 

1. In order to properly pass along your ”Groups” SAML assertions, you need to configure App roles and set the value to match the role mappings that are set within AppNeta Performance Manager. Under **Entra ID** > **App registrations**, select **Appneta Performance Manager**.

ms.date: 06/09/2025

The following table includes each FIDO2 security key model listed in MDS version 169 that's eligible for attestation with Microsoft Entra ID. For each model, the table shows its Authenticator Attestation Globally Unique Identifier (AAGUID) and feature capabilities.

 

Deepnet SafeKey/Classic (FP)|e41b42a3-60ac-4afb-8757-a98f2d7f6c9f|✅|❌|❌|❌

ms.date: 06/09/2025

External Health Monitoring is a feature in Microsoft Entra that analyzes scenario-specific metrics for each tenant, detects anomalies, and raises alerts. These alerts are sent via the Microsoft Graph API and displayed in the Microsoft Entra admin center UI, enabling tenant admins to proactively investigate and address issues. For example, in the multifactor authentication (MFA) scenario, External Health Monitoring tracks metrics such as sign-in success rate, sign-in failure rate, and failure count. If there's a spike in failures, an alert is raised to notify the tenant admin, who can then take appropriate action to resolve the issue.

- [Reports Reader](/entra/identity/role-based-access-control/permissions-reference#reports-reader)

- [Helpdesk Administrator](/entra/identity/role-based-access-control/permissions-reference#helpdesk-administrator)

- [Security Operator](/entra/identity/role-based-access-control/permissions-reference#security-operator)

Microsoft services applications that operate in your tenant are identified as service principals with the owner organization ID "f8cdef31-a31e-4b4a-93e4-5f571e91255a". When these service principals have credentials configured in your tenant, they might create potential attack vectors that threat actors can exploit. If the credentials were added by an administrator and are no longer needed, they can become a target for attackers. Although less likely when proper preventive and detective controls are in place on privileged activities, credentials can also be added maliciously by threat actors. In either case, threat actors can use these credentials to authenticate as the service principal, gaining the same permissions and access rights as the Microsoft service application. This initial access can lead to privilege escalation if the application has high-level permissions, allowing lateral movement across the tenant. Attackers can then proceed to data exfiltration or persistence establishment through creating additional backdoor credentials.

When credentials (like client secrets or certificates) are configured for these service principals in your tenant, it means someone - either an administrator or a malicious actor - has enabled them to authenticate independently within your environment. These credentials should be investigated to determine their legitimacy and necessity. If they are no longer needed, they should be removed to reduce the risk. If they are still required, consider using OAuth2 permissions instead of credentials for better security practices.

manager: pmwongera

ms.date: 06/09/2025

- The provisioning service supports setting custom security attributes of type `String`, `Integer`, and `Boolean`.

ms.date: 06/10/2025

Enterprise applications (service principals) inherit specific properties from their associated app registrations when both exist in the same tenant. These properties are synchronized from the app registration, but the synchronization isn't immediate or continuous. Sometimes, updating an enterprise application might prompt the directory to refresh properties from the app registration, causing updates that weren't part of the original request.

 

> Managed identities are distinct from Microsoft Entra App Registrations. Managed identities only have a service principal object and don't possess an application object, which is typically used for granting app permissions. As a result, global admins can't change the settings of a managed identity, as the security boundary is the resource itself.

ms.author: barclayn

author: barclayn

manager: pmwongera

ms.author: barclayn

author: barclayn

manager: pmwongera

ms.author: barclayn

author: barclayn

manager: pmwongera