📋 Microsoft Entra Documentation Changes

To enhance the security of the service, we're rolling out an application identity that uses Oauth 2.0 client credential flow with certificate credentials. In this new method, Microsoft Entra or Administrator creates a single tenant non-Microsoft application in Microsoft Entra ID and uses one of the following relevant certificate management options for the credentials.

Microsoft Entra Connect provides three options for application/certificate management:

Entra Connect manages the application and certificate including creation, rotation, and deletion of the certificate. The certificate is stored in the Current User store. For optimal protection of the certificate’s private key, we recommend that the machine employ a Trusted Platform Module (TPM) solution to establish a hardware-based security boundary.

When a TPM is available, key service operations are performed within a dedicated hardware environment. In contrast, if a TPM can't be used, Entra Connect defaults to storing the certificate in the default Microsoft Software Key Storage Provider and marks the private key as nonexportable for extra protection. Without the hardware isolation provided by a TPM, the private key is secured solely by software safeguards and doesn't achieve the same level of protection.

For more information on TPM, see [Trusted Platform Module technology overview](/windows/security/hardware-security/tpm/trusted-platform-module-overview).

title: 'Auditing administrator events in Microsoft Entra Connect Sync'

# Auditing administrator events in Microsoft Entra Connect Sync (Public Preview)

In January 2025, we released a new version [(2.4.129.0)](reference-connect-version-history.md#241290) of Microsoft Entra Connect Sync. This version contains an update to auditing which is enabled by default. With this update, you can now monitor administrator events and activity. The following article describes how to disable the auditing feature.

## How to manually disable auditing of administrator events

To disable auditing of administrator events, use the following steps:

1. Open the Registry Editor - Press Win + R to open the run dialog.

2. Type **regedit** and press Enter to launch the Registry Editor. Confirm any security prompts to proceed.

3. Navigate to the following path: **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Azure AD Connect**.

4. Modify or Create the **AuditEventLogging** Value by right-click on the Azure AD Connect key, select New -> **DWORD (32-bit)** Value if the AuditEventLogging value doesn't already exist.

ms.date: 05/29/2025

# implementationcost: Medium

- [Remove standing Global Administrator access to Azure subscriptions](/azure/role-based-access-control/elevate-access-global-admin) and require explicit elevation

- [Configure Privileged Identity Management (PIM) for Azure resource access](/azure/active-directory/privileged-identity-management/pim-resource-roles-configure-role-settings) to enable just-in-time elevation

- [Implement monitoring and alerting for Global Administrator elevation events](/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts)

- [Establish approval workflows for high-privilege Azure resource access](/azure/active-directory/privileged-identity-management/pim-resource-roles-approval-workflow)

- [Create regular access reviews for Global Administrator assignments](/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review)

- [Enable Conditional Access policies for privileged role activation](/entra/identity/conditional-access/policy-privileged-users-mfa)

`https://myaccount.microsoft.com?tenantId=contoso.onmicrosoft.com`

 

-or-

 

`https://myaccount.microsoft.com?tenantId=aaaabbbb-0000-cccc-1111-dddd2222eeee`

 

You might need to open this URL in a private browser session.

:::image type="content" source="media/leave-the-organization/organization-list.png" alt-text="Screenshot showing the list of organizations you belong to." lightbox="media/leave-the-organization/organization-list.png":::

title: Understanding Access Package Visibility in the My Access portal

# Understanding Access Package Visibility in the My Access Portal

 

**Introduction**

 

1. **Is the catalog enabled?** The system first checks if the Catalog containing the access package is enabled. If the entire Catalog is disabled, none of its packages are visible for discovery.

title: Configure Rippling Human Capital Management (HCM) for Single sign-on

manager: femila

ms.reviewer: rahuln3223

ms.date: 12/18/2024

# Configure Rippling Human Capital Management (HCM) for Single sign-on

Staged Rollout allows you to selectively test groups of users with cloud authentication capabilities like Microsoft Entra multifactor authentication, Conditional Access, Microsoft Entra ID Protection for leaked credentials, Identity Governance, and others, before cutting over your domains. This article discusses how to make the switch.

For Windows 10, Windows Server 2016 and later versions, it's recommended to use SSO via [Primary Refresh Token (PRT)](~/identity/devices/concept-primary-refresh-token.md) with [Microsoft Entra joined devices](~/identity/devices/concept-directory-join.md), [Microsoft Entra hybrid joined devices](~/identity/devices/concept-hybrid-join.md) or [personal registered devices](~/identity/devices/concept-device-registration.md) via Add Work or School Account.

- You have configured all the appropriate tenant-branding and Conditional Access policies you need for users who are being migrated to cloud authentication.

- If you have moved from federated to cloud authentication, you must verify that the DirSync setting `synchronizeUpnForManagedUsersEnabled` is set to `true`, otherwise Microsoft Entra ID doesn't allow sync updates to the UPN or alternate login ID for licensed user accounts that use managed authentication. For more information, see [Microsoft Entra Connect Sync service features](how-to-connect-syncservice-features.md).

- If you plan to use Microsoft Entra multifactor authentication, we recommend that you use [combined registration for self-service password reset (SSPR) and multifactor authentication](~/identity/authentication/concept-registration-mfa-sspr-combined.md) to have your users register their authentication methods once. Note- when using SSPR to reset password or change password using MyProfile page while in Staged Rollout, Microsoft Entra Connect needs to sync the new password hash that can take up to 2 minutes after reset.

ms.date: 05/29/2025

- [Configure security alerts for privileged role activations in PIM](/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts)

- [Enable diagnostic settings to capture privileged role activation events](/entra/identity/monitoring-health/howto-configure-diagnostic-settings)

- [Integrate privileged access logs with Azure Monitor for real-time alerting](/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs)

- [Create custom alert rules for unusual privileged role activation patterns](/azure/azure-monitor/alerts/alerts-log)

- [Implement SIEM integration for comprehensive privileged access monitoring](/entra/identity/monitoring-health/howto-stream-logs-to-event-hub)

- [Establish incident response procedures for privileged role activation alerts](/entra/id-governance/privileged-identity-management/pim-how-to-use-audit-log)

ms.date: 05/29/2025

- [Regularly audit and review redirect URIs in app registrations](/entra/identity-platform/reply-url) to identify obsolete or unmaintained entries

- [Remove unused or orphaned redirect URIs](/entra/identity-platform/quickstart-register-app#add-a-redirect-uri) from application configurations

- [Implement monitoring for domain ownership](/azure/app-service/app-service-web-tutorial-custom-domain) of all redirect URI domains

- [Establish domain validation processes](/entra/identity-platform/reply-url#restrictions-on-wildcards-and-localhost) to ensure active control of redirect endpoints

- [Configure application management policies](/graph/api/resources/applicationauthenticationmethodpolicy) to enforce redirect URI validation requirements

- [Create regular security reviews](/entra/identity/governance/access-reviews-overview) of application redirect URI configurations

Historically, organizations could use Active Directory Domain Services, deploy [domain controllers at each site](/windows-server/identity/ad-ds/plan/planning-domain-controller-placement), so that users could authenticate to a local domain controller. Authenticating users through Microsoft Entra and connecting applications to Microsoft Entra ID via federation protocols such as SAML brings benefits, including multifactor authentication and risk based conditional access. When applications are federated to Microsoft Entra, the users authenticate themselves to Microsoft Entra, and Microsoft Entra then provides tokens that carry claims and indicate their authentication status to the applications. However, if there is a break in the network connectivity between the site and the Internet, then users and applications are unable to access Microsoft Entra cloud endpoints. With that break in connectivity, no more tokens can be issued from Microsoft Entra to applications via that route until the break is repaired. Users already authenticated to the application and able to connect to the application may be able to continue to use the application for a time. However, if the application requires the user to reauthenticate and the break has not yet been repaired, then the user won't be able to get a new access token from Microsoft Entra. In addition, until the break is repaired, any user who hadn't previously connected to the application may find themselves unable to use the application as well.

This tutorial illustrates how to configure Microsoft Entra for a federated application, using a relying party STS. In normal operations, users will authenticate to Microsoft Entra, and Microsoft Entra will issue tokens for the application. And in a site disconnect situation, users can authenticate to Active Directory, and obtain tokens for that application with similar claims as that provided by Microsoft Entra. While Microsoft Entra features including multifactor authentication or risk-based conditional access won't be available for applications during the time of disconnection, users will continue to be able to be authenticated to access to those applications.

Your applications may also have user sessions that are derived from the user having been authenticated. For example, a browser-based application may authenticate a user and then store a browser cookie indicating the user has been authenticated. You may wish to have your applications rely upon the disconnected identity providers for as short a period as possible. For example, if a user had not used an application before, and then the first time the user tried to connect to an application was when the site was disconnected, then the authentication was performed by Windows Server AD. Following that authentication, the application may have stored a session cookie for the user to be able to continue to interact with the application without needing to re-authenticate. However, once the site is reconnected, you may wish to have the user be re-authenticated by Microsoft Entra, so that the Microsoft Entra policies such as conditional access can be applied. This will require invalidating any session state for those users that was derived from Windows Server AD, such as by informing the application to not allow session state generated during a particular time window. How this is provided to the application will vary by applications.

- **Add conditional access policy**

- **Delete conditional access policy**

- **Update conditional access policy**

| Admin resets password | Revoked | Revoked | Stays alive | Stays alive | Stays alive |

- [Configurable token lifetimes](configurable-token-lifetimes.md)

Alternatively, add a TLS policy to a security profile and link it to a [conditional access policy](how-to-configure-web-content-filtering.md#create-and-link-conditional-access-policy) for a specific user or group.

:::image type="content" source="media/how-to-transport-layer-security/conditional-access-group-assignment.png" alt-text="Screenshot of the new conditional access policy form with all fields completed with sample information.":::

> Microsoft Entra External ID is a customer identity and access management (CIAM) solution that stores and manages data in a separate tenant created for your customer-facing apps and customer directory data. This tenant is called the external tenant. When you create an external tenant, you have the option to select the geographic location for data storage. It’s important to note that the data locations and region availability may differ from those of Microsoft Entra ID, as indicated in this article.

In the public cloud, you're prompted to select a location at the time of tenant creation (for example, signing up for Office 365 or Azure, or creating more Microsoft Entra instances through the Azure portal). Microsoft Entra ID maps the selection to a geo-location and a single scale unit in it. Tenant location can't be changed after it's set.

## Create a conditional access policy that requires MFA

## Test your conditional access policy