📋 Microsoft Entra Documentation Changes

ms.date: 06/11/2025

# Troubleshoot sign-in problems with Conditional Access

Use this article to fix unexpected sign-in outcomes related to Conditional Access by checking error messages and Microsoft Entra sign-in logs.

The Conditional Access framework gives you a lot of configuration flexibility. But this flexibility means you need to carefully review each configuration policy before releasing it to avoid unwanted results. In this context, pay special attention to assignments that affect complete sets like **all users / groups / resources**.

Don't use the following configurations:

#Customer intent: As an Identity Governance Administrators, Catalog Owners, or Access Package Manager, I want detailed information about which access packages are visible to users when discovering packages in the My Access portal.

The [My Access portal](https://myaccess.microsoft.com) is the central place for users to request, approve, and review their access to resources within Microsoft Entra. For administrators, the portal provides additional functionalities through the Microsoft Entra admin center, enabling them to configure access packages and conduct access reviews.

When managing access to resources in Microsoft Entra, understanding how access packages appear to users in the [My Access portal](https://myaccess.microsoft.com) is essential for administrators, catalog owners, and access package managers. Access package visibility determines which packages users can discover and request, and is influenced by several configuration settings and upcoming changes. This article provides a detailed overview of the factors that control access package visibility in the My Access portal, outlines the current logic, and highlights important updates effective September 30, 2025.

**Deep Dive: Discovering Requestable Access Packages**

When a user lands on the "Available" tab, searches for requestable packages, or clicks "View all", Microsoft Entra evaluates which access packages they should be able to see and potentially request. This visibility is determined by a specific sequence of checks.

The following flow diagram illustrates the logic used to determine if an access package appears in the browse/search view for a specific user (valid until September 30, 2025 - see Upcoming Changes section below):

## Microsoft Learn article (DRAFT)

 

**Title: Understanding Access Package Visibility in the My Access

Portal**

 

*Audience: Identity Governance Administrators, Catalog Owners, Access

Package Managers*

 

This article explains the concepts determining which Microsoft Entra

Entitlement Management access packages are visible to end-users when

discovering packages in the My Access portal. Understanding this helps

you configure access effectively and troubleshoot visibility issues.

 

The My Access portal (myaccess.microsoft.com) is the central place for

users to request, approve, and review their access to resources. When

ms.date: 06/02/2025

## How does the Identity Secure Score benefit me?

 

This score helps to:

 

1. Add a Configuration Name such as `MSFTSSEWebTraffic`.

 

1. Choose a **User Group** or **OU** to apply the configuration to.

 

1. Under **Cloud, Web and Firewall** > **Web Traffic**

 

1. **Bypass exception traffic at** > **Client**

 

1. Under **Private Apps** > **None**.

 

1. Under **Borderless SD-WAN Apps** > **None**.

 

1. Set **Status** to **Disabled** and select **Save**.

 

1. Select the `MSFTSSEWebTraffic` configuration > **Exceptions** > **New Exception** > **Destination Locations**.

 

1. Select `MSFT SSE Service` (Instructions for creating this object are listed in the Netskope profiles section).

title: Conditional Access service dependencies

# Service dependencies in Microsoft Entra Conditional Access

With Conditional Access policies, you specify requirements to use websites and services. For example, your requirements can include requiring multifactor authentication (MFA) or [managed devices](./concept-conditional-access-grant.md).

When you use a site or service directly, it's usually easy to see how a related policy affects you. For example, if you set a policy that requires multifactor authentication (MFA) for SharePoint Online, MFA is required for each sign-in to the SharePoint web portal. But sometimes it's hard to know how a policy affects you because some cloud apps depend on other cloud apps. For example, Microsoft Teams lets you use resources in SharePoint Online. So, when you use Microsoft Teams in this scenario, you're also subject to the SharePoint MFA policy.

> Use the [Office 365](concept-conditional-access-cloud-apps.md#office-365) app to target all Office apps and avoid issues with service dependencies in the Office stack.

| Entitlement Management | [Request access package on-behalf-of other users](entitlement-management-request-behalf.md) | Bill on successful request creation. User requests or updates an access package assignment on-behalf-of another user.<br> **API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests when the requestor (manager) is extracted from the token, and the target object is determined by the ID of the direct employee who is receiving access. | User requests access package assignment, Create access package assignment user update request |

| Entitlement Management | [Guest is assigned to an Microsoft Entra role assignment](entitlement-management-roles.md) | Bill on successful request creation when a Microsoft Entra role is included in the access package.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests when the access package contains a Microsoft Entra role. | User requests access package assignment, Create access package assignment user update request |

| Entitlement Management | [Sponsor policy is applied to assignment](entitlement-management-access-package-create.md) | Bill on successful request creation when a sponsor is included as an approver in the access package policy.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests where a sponsor is included as an approver in the access package policy. | User requests access package assignment, Create access package assignment user update request |

| Entitlement Management | [EM – PIM for groups](create-access-review-pim-for-groups.md) | Bill on successful request creation when a PIM group is included in the access package.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests when the access package contains a PIM group. | User requests access package assignment, Create access package assignment user update request. |

| Entitlement Management | [Guest uses verified ID for request](entitlement-management-verified-id-settings.md) | Bill on successful request creation when verified ID is required in the policy.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests when the access package policy requires a Verified ID. | User requests access package assignment, Create access package assignment user update request. |

| Entitlement Management | [Guest policy assigned with custom extension](entitlement-management-logic-apps-integration.md) | Bill on successful request creation when a custom extension is included in the assignment policy.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests when a custom extension is included in the assignment policy. | User requests access package assignment, Create access package assignment user update request. |

| Entitlement Management | [Directly assign any user](entitlement-management-access-package-assignments.md#directly-assign-any-user-preview) | Bill on successful request creation when using directly assigning an access package to a user not yet in the directory.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests when using requestType "*AdminAdd*" for a user who doesn’t exist in the directory. | Administrator directly assigns user to access package. |

| Entitlement Management |[Mark guest as governed](entitlement-management-access-package-manage-lifecycle.md) | Bill on conversion to governed user.<br>**API**<br> https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/subjects where *"subjectLifecycle"* is set to "governed". | Update access package user lifecycle. |

| Access Reviews  | [Access Review – machine learning assisted access reviews](review-recommendations-access-reviews.md#user-to-group-affiliation) | Bill when guest user is included in review. <br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions where recommendation settings is enabled in a group review. | Available after 8/1/2025 |

| Access Reviews  | [Access Review – inactive users](review-recommendations-access-reviews.md#inactive-user-recommendations) | Bill when guest user is included in review.<br>**API**<br> https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions where inactive guest reviews are included in the policy for a group resource. | Available after 8/1/2025 |

title: Global Administrator role activation triggers an approval workflow

Without restricting privileged role activations to dedicated Privileged Access Workstations (PAWs), threat actors can exploit compromised endpoint devices to perform privilege escalation attacks from unmanaged or non-compliant workstations. When administrators activate privileged roles from standard productivity workstations, these devices often contain attack vectors such as unrestricted web browsing, email clients vulnerable to phishing, and locally installed applications with potential vulnerabilities. Threat actors who gain initial access through malware, browser exploits, or social engineering can then leverage the locally cached privileged credentials or hijack existing authenticated sessions to escalate their privileges. Since privileged role activations grant extensive administrative rights across Microsoft Entra ID and connected services, attackers can establish persistent access by creating additional administrative accounts, modifying security policies, accessing sensitive data across all organizational resources, and deploying additional malware or backdoors throughout the environment. This lateral movement from a compromised endpoint to privileged cloud resources represents a critical attack path that bypasses many traditional security controls, as the privileged access appears legitimate when originating from an authenticated administrator's session.

- [Enable Privileged Access Workstations (PAWs) for privileged role activations](/entra/identity-governance/privileged-identity-management/configure-paws)

- [Implement conditional access policies to restrict privileged role activations to PAWs](/entra/identity-governance/privileged-identity-management/configure-conditional-access)

- [Regularly review and audit privileged role assignments](/entra/identity-governance/privileged-identity-management/review-privileged-role-assignments)

Without approval workflows, threat actors who compromise Global Administrator credentials through phishing, credential stuffing, or other authentication bypass techniques can immediately activate the most privileged role in a tenant without any additional verification or oversight. Privileged Identity Management (PIM) allows eligible role activations to become active within seconds, so compromised credentials can allow near-instant privilege escalation. Once activated, threat actors can use the Global Administrator role to gain persistent access by creating new privileged accounts, modifying Conditional Access policies to exclude those new accounts, and establishing alternate authentication methods such as certificate-based authentication or application registrations with high privileges. The Global Administrator role provides access to administrative features in Microsoft Entra ID and services that use Microsoft Entra identities, including Microsoft 365 Defender, Microsoft Purview, Exchange Online, and SharePoint Online. Without approval gates, threat actors can rapidly escalate to complete tenant takeover, exfiltrating sensitive data, compromising all user accounts, and establishing long-term backdoors through service principals or federation modifications that persist even after the initial compromise is detected.

- [Configure role settings to require approval for Global Administrator role activation](../../id-governance/privileged-identity-management/pim-how-to-change-default-settings.md)

- [Set up approval workflows for privileged roles](../../id-governance/privileged-identity-management/pim-approval-workflow.md)

```Failed to add identifier URI {uri}. All newly added URIs must contain a tenant verified domain, tenant ID, or app ID, as per the default tenant policy of your organization. See https://aka.ms/identifier-uri-formatting-error for more information on this error.```

Microsoft also offers a more restrictive security policy on the `identifierUris` property.

- An [exemption](https://aka.ms/identifier-uri-protection-grant-exemptions) has been granted by an administrator to the app the URI is being added to, or to the user or service performing the addition.

This more restrictive policy can help protect your organization from common token validation errors in the `audience` claim. We recommend enabling it if possible.

When guest users are assigned highly privileged directory roles such as Global Administrator or Privileged Role Administrator, organizations create significant security vulnerabilities that threat actors can exploit for initial access through compromised external accounts or business partner environments. Since guest users originate from external organizations without direct control of security policies, threat actors who compromise these external identities gain privileged access to the target organization's Microsoft Entra tenant. Once threat actors obtain access through compromised guest accounts with elevated privileges, they can perform privilege escalation by leveraging administrative permissions to create additional backdoor accounts, modify security policies, or assign themselves permanent roles within the organization. The compromised privileged guest accounts enable threat actors to establish persistence by creating cloud-only accounts, bypassing conditional access policies applied to internal users, or maintaining access even after the guest's home organization detects the compromise. Threat actors can then conduct lateral movement using administrative privileges to access sensitive resources, modify audit settings, or disable security monitoring across the entire tenant. Finally, threat actors achieve impact through unauthorized access to sensitive data, or complete compromise of the organization's identity infrastructure while maintaining plausible deniability through the external guest account origin.

- [Review guest user assignments to high privileged directory roles](/entra/identity-governance/privileged-identity-management/review-guest-user-assignments)

- [Remove guest users from high privileged directory roles](/entra/identity-governance/privileged-identity-management/remove-guest-users-from-privileged-roles)

- [Implement conditional access policies to restrict guest access to high privileged roles](/entra/identity-governance/privileged-identity-management/configure-conditional-access)

ms.date: 05/14/2025

Global Secure Access (GSA) uses Role-Based Access Control (RBAC) to effectively manage administrative access. By default, Microsoft Entra ID requires specific administrator roles for accessing Global Secure Access.

### Global Administrator

 

**Full access**: This role grants administrators full permissions within Global Secure Access. They can manage policies, configure settings, and view logs; including Conditional Access scenarios, configurations for Private Access, write operations on application segments, and management of user assignments for traffic profiles.

 

> It's highly recommended to use a least privilege approach for security reasons. The Global Administrator role is only required to configure enriched Microsoft 365 logs as outlined in the table. For all other scenarios, use the least privileged role required to administer the service. To learn more about least privileged, see [Least privileged roles by task in Microsoft Entra ID](../identity/role-based-access-control/delegate-by-task.md). To learn more about least privilege in Microsoft Entra ID Governance, see [The principle of least privilege with Microsoft Entra ID Governance](../id-governance/scenarios/least-privileged.md).

ms.date: 05/02/2025

- Cross-tenant synchronization is **not** currently suitable for use across organizational boundaries.

:::image type="content" source="media/entitlement-management-access-package-my-access-visibility/my-access-visibility-diagram.png" alt-text="Screenshot of visibility diagram for access package.":::

:::image type="content" source="media/entitlement-management-access-package-my-access-visibility/image2.png" alt-text="Screenshot of updated my access visibility access package diagram.":::