📋 Microsoft Entra Documentation Changes

ms.date: 06/11/2025

As a developer, you want to run automated integration tests on the apps you develop. Calling your API protected by Microsoft identity platform (or other protected APIs such as [Microsoft Graph](/graph/)) in automated integration tests is a challenge. Microsoft Entra ID often requires an interactive user sign-in prompt, which is difficult to automate. This article describes how you can use a non-interactive flow, called [Resource Owner Password Credential Grant (ROPC)](v2-oauth-ropc.md), to automatically sign in users for testing.

To prepare for your automated integration tests, create some test users, create and configure an app registration, and potentially make some configuration changes to your tenant. Some of these steps require admin privileges. [Create a separate test tenant](test-setup-environment.md) that you are an administrator of so you can safely and effectively run your automated integration tests.

> Microsoft recommends that you *do not* use the ROPC flow in a production environment. Use a more trusted method such as the [authorization code flow](./v2-oauth2-auth-code-flow.md). In most production scenarios, more secure alternatives are available and recommended. The ROPC flow requires a very high degree of trust in the application, and carries risks which aren't present in other authentication flows. You should only use this flow for testing purposes in a [separate test tenant](test-setup-environment.md), and only with test users.

title: Require Password Reset Notifications for Administrator Roles

ms.date: 06/10/2025

# risklevel: High

# userimpact: Low

Configuring password reset notifications for administrator roles in Microsoft Entra ID enhances security by notifying privileged administrators when another administrator resets their password. This visibility helps detect unauthorized or suspicious activity that could indicate credential compromise or insider threats. Without these notifications, malicious actors could exploit elevated privileges to establish persistence, escalate access, or extract sensitive data. Proactive notifications support quick action, preserve privileged access integrity, and strengthen the overall security posture.

- [Notify all admins when other admins reset their passwords](../../identity/authentication/concept-sspr-howitworks.md#notify-all-admins-when-other-admins-reset-their-passwords)

title: Resource-Specific Consent Is Restricted

ms.date: 06/10/2025

# risklevel: Medium

# userimpact: Medium

# implementationcost: Medium

Letting group owners consent to applications in Microsoft Entra ID creates a lateral escalation path that lets threat actors persist and steal data without admin credentials. If an attacker compromises a group owner account, they can register or use a malicious application and consent to high-privilege Graph API permissions scoped to the group, such as reading all Teams messages, accessing SharePoint files, or managing group membership. This consent action creates a long-lived application identity with delegated or application permissions. The attacker maintains persistence with OAuth tokens, steals sensitive data from team channels and files, and impersonates users through messaging or email permissions. Without centralized enforcement of app consent policies, security teams lose visibility, and malicious applications spread under the radar, enabling multi-stage attacks across collaboration platforms.

title: App Instance Property Lock Is Configured for All Multitenant Applications

ms.date: 06/10/2025

# risklevel: High

# userimpact: Low

Enable the app instance property lock for all multitenant applications and specify the properties to lock.

title: Workload Identities are Configured with Risk-based Policies

ms.date: 06/10/2025

Configuring workload identity based on risk policy in Microsoft Entra ID is a critical security measure that ensures only trusted and verified workloads can access sensitive resources. Without these policies, threat actors can compromise workload identities with minimal detection to perform further attacks. The lack of conditional controls for risk detections, such as anomalous activity, allows malicious operations like token forgery, sensitive resource access, and disruption of workloads to proceed unchecked. The lack of automated containment mechanisms increases dwell time and impacts the confidentiality, integrity, and availability of critical services.

- [Create a risk-based Conditional Access policy](../../identity/conditional-access/workload-identity.md#create-a-risk-based-conditional-access-policy)

Allowing unrestricted external collaboration with unverified organizations can increase the risk surface area of the tenant because it allows guest accounts that might not have proper security controls. Threat actors can attempt to gain access by compromising identities in these loosely-governed external tenants. Once granted guest access, they can then leverage legitimate collaboration pathways to infiltrate resources in your tenant and attempt to gain sensitive information. Threat actors can also exploit misconfigured permissions to escalate privileges and try different types of attacks.

Without vetting the security of organizations you collaborate with, malicious external accounts can persist undetected, exfiltrate confidential data, and inject malicious payloads. This type of exposure can weaken organizational control and enable cross-tenant attacks that bypass traditional perimeter defenses and undermine both data integrity and operational resilience. Cross-tenant settings for outbound access in Microsoft Entra provides the ability to block collaboration with unknown organizations by default, reducing the attack surface.

- [Cross-tenant access overview](../../external-id/cross-tenant-access-overview.md)

- [Configure cross-tenant access settings](../../external-id/cross-tenant-access-settings-b2b-collaboration.yml#configure-default-settings)

- [Modify outbound access settings](../../external-id/cross-tenant-access-settings-b2b-collaboration.yml#modify-outbound-settings)

- The user may see a "Sorry, we're having trouble verifying your account"

## Regions that need to opt-in for MFA telephony verification

 

Note: We always recommend that customers figure more than one authentication, with at least one being a non-telecom method.

 

Note: If a user has previously received SMS or voice calls in the country and stopped receiving them, they may be temporarily throttled. PLease retry after some time. If users of a tenant are not receiving SMS or voice calls in a specific country, and the country is listed in the opt-in list, it may indicate that the customer/tenant is not enabled for telecom authentication in that country and may need to opt-in. In such cases we recommend that the user use an alternative authentication method to immediately unblock themselves. If telecom is required and they are unable to use an alternative authentication method for some reason, suggest opening a support ticket.

 

| Entitlement Management |[Mark guest as governed](entitlement-management-access-package-manage-lifecycle.md) | Bill on conversion to governed user.<br>**API**<br> https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/subjects where *"subjectLifecycle"* is set to "governed". | Update access package user lifecycle. |

| Access Reviews  | [Access Review – machine learning assisted access reviews](review-recommendations-access-reviews.md#user-to-group-affiliation) | Bill on access review decision or review end date if no decision. <br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions where recommendation settings is enabled in a group review. | Available after 8/1/2025 |

| Access Reviews  | [Access Review – inactive users](review-recommendations-access-reviews.md#inactive-user-recommendations) | Bill on access review decision or review end date if no decision.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions where inactive guest reviews are included in the policy for a group resource. | Available after 8/1/2025 |

**Does Governance guest billing apply to all guest users, including those within the first 50,000 Monthly Active Users (MAU)?**

 

Yes, there is no free tier for governance billing. Governance guest billing applies to all guest users, even those within the first 50,000 MAU.

 

When credentials (like client secrets or certificates) are configured for these service principals in your tenant, it means someone - either an administrator or a malicious actor - has enabled them to authenticate independently within your environment. These credentials should be investigated to determine their legitimacy and necessity. If they are no longer needed, they should be removed to reduce the risk.

 

If this check doesn't pass, it's labeled as "investigate" because you need to identify and review any applications with unused credentials configured.

- [Follow the Entra recommendation guidance to remove unused credentials from apps](../../identity/monitoring-health/recommendation-remove-unused-credential-from-apps.md)

Without approval workflows, threat actors who compromise Global Administrator credentials through phishing, credential stuffing, or other authentication bypass techniques can immediately activate the most privileged role in a tenant without any additional verification or oversight. Privileged Identity Management (PIM) allows eligible role activations to become active within seconds, so compromised credentials can allow near-instant privilege escalation. Once activated, threat actors can use the Global Administrator role to gain persistent access by creating new privileged accounts, modifying Conditional Access policies to exclude those new accounts, and establishing alternate authentication methods such as certificate-based authentication or application registrations with high privileges. The Global Administrator role provides access to administrative features in Microsoft Entra ID and services that use Microsoft Entra identities, including Microsoft 365 Defender, Microsoft Purview, Exchange Online, and SharePoint Online. Without approval gates, threat actors can rapidly escalate to complete tenant takeover, exfiltrating sensitive data, compromising all user accounts, and establishing long-term backdoors through service principals or federation modifications that persist even after the initial compromise is detected.

- [Configure role settings to require approval for Global Administrator role activation](../../id-governance/privileged-identity-management/pim-how-to-change-default-settings.md)

- [Set up approval workflows for privileged roles](../../id-governance/privileged-identity-management/pim-approval-workflow.md)

title: ID Protection Notifications Are Enabled

- [Configure users at risk detected alerts](../../id-protection/howto-identity-protection-configure-notifications.md#configure-users-at-risk-detected-alerts)

`https://github.com/enterprises/{enterprise}`

`https://github.com/enterprises/{enterprise}/saml/consume`

`https://github.com/enterprises/{enterprise}/sso`

You configure and test Microsoft Entra single sign-on for my.sdworx.com in a test environment (my.acc.sdworx.com) but not by using this gallery app (import SP metadata, to be provided by your my.sdworx.com contact). my.sdworx.com supports **IDP** and **SP** initiated single sign-on.

|[Entitlement management - Microsoft Entra Roles (Preview)](~/id-governance/entitlement-management-roles.md)|||| :white_check_mark: | :white_check_mark: |

|[Entitlement management - Request access packages on-behalf-of (Preview)](~/id-governance/entitlement-management-request-behalf.md)|||| :white_check_mark: | :white_check_mark: |

The **OnOtpSend** event is triggered when a one time passcode email is activated. It allows you to [call a REST API to use your own email provider](./custom-extension-email-otp-get-started.md). This event can be used to send customized emails to users who sign up with email address, sign in with email one-time passcode (Email OTP), reset their password using Email OTP, or use Email OTP for multifactor authentication (MFA).