📋 Microsoft Entra Documentation Changes

|2503|Add/Update/Delete directories.|Provides the name of the affected directory.|

|2504|Enable Express settings mode.| This event is logged after the administrator selects **Express Setup**.|

|2505|Enable/Disable domains and organizational units (OUs) for sync.| Shows a list of all domains connected to Microsoft Entra Connect Sync.|

|2506|Enable/Disable password hash synchronization (PHS) sync.| Shows that PHS is enabled or disabled.|

|2507|Enable/Disable sync start after installation.| Event is logged when sync is enabled or disabled after the installation is finished.|

|2508|Create Active Directory Domain Services (AD DS) account.| Shows the created account needed to connect to the new directory added.|

|2509|Use existing AD DS account.| Shows the name of the account used to connect to the directory.|

|2510|Create/Update/Delete custom sync rule.| Shows the name of the sync rule that changed along with information on what changed.|

|2511|Enable/Disable domain-based filtering.|Shows that domain filtering is selected and lists selected domains.|

|2512|Enable/Disable OU-based filtering.| Shows that OU-based filtering is selected and lists selected OUs. |

|2513|User sign-in method changed.|Shows the old sign-in method and the new one. |

|2514|Configure new Active Directory Federation Services (AD FS) farm.| Shows the federation services name.|

|2515|Enable/Disable single sign-on.| Shows single sign-on change. |

|2516|Install web application proxy server.|Shows selected AD FS servers and the domain admin username.|

|2517|Set permissions.| Shows the specific ADSync permission that changed.|

|2518|Change AD DS Connector credential.| Shows the AD DS Connector credential that changed.|

|2519|Reinitialize Entra ID Connector account password.| Shows that the ADSync account password was reset.|

For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Microsoft Entra ID](../app-provisioning/user-provisioning.md). For differences between cross-tenant synchronization and cross-cloud synchronization, see [Cross-cloud synchronization in Frequently asked questions](./cross-tenant-synchronization-overview.md#clouds).

#### Symptom - Test connection fails with AzureActiveDirectoryCrossTenantSyncPolicyCheckFailure

When configuring cross-tenant synchronization in the source tenant and you test the connection, it fails with one of the following error messages:

Error code: AzureActiveDirectoryCrossTenantSyncPolicyCheckFailure

Details: The source tenant has not enabled automatic user consent with the target tenant. Please enable the outbound cross-tenant access policy for automatic user consent in the source tenant. aka.ms/TroubleshootingCrossTenantSyncPolicyCheck

```

 

Groups that are written back from Microsoft Entra ID to Active Directory have a source of authority in the cloud. Any changes made on-premises to groups that are written back from Microsoft Entra ID are overwritten in the next sync cycle.

:::image type="content" source="media/how-to-connect-group-writeback/optional-group-writeback-1.png" alt-text="Screenshot that shows selecting the Writeback group Distinguished Name with cloud Display Name option." lightbox="media/how-to-connect-group-writeback/optional-group-writeback-1.png":::

Disabling group writeback causes any groups that this feature created previously to be deleted from your local Active Directory on the next sync cycle.


Disabling group writeback sets the `Full Import` and `Full Synchronization` flags to `true` on the Azure Active Directory Connector. The rule changes propagate through on the next sync cycle and delete the groups that were previously written back to your Active Directory.

ms.date: 06/23/2025

- For information about the relationship between the Azure Cloud environments and Microsoft 365 (GCC, GCCH), see [Microsoft 365 integration](/azure/security/fundamentals/feature-availability#microsoft-365-integration). Synchronization between commercial and GCC is supported.

- Cross-cloud synchronization (such as public cloud to Azure Government) is currently in public preview.

- [Bring Your Own Application (BYOA)](#bring-your-own-application)

- [Bring Your Own Certificate (BYOC)](#bring-your-own-certificate)

1. [Remove the Directory Synchronization Account (DSA) from Entra ID (recommended)](#remove-a-legacy-service-account-by-using-powershell).

manager: pmwongera

ms.date: 06/23/2025

ms.reviewer: mkokkalera

### Default background image

 

The default background image behind the sign-in box is changing later this year. The change is only to the image and requires no action and doesn't change any functionality. We know that the default background image is often used for training and documentation to demonstrate the sign-in experience. Providing the updated image allows you to update your documentation so you can demonstrate the exact sign-in experience that your users will see. For details on the upcoming change, see [Microsoft Entra releases and announcements](../fundamentals/whats-new.md).

 

### Understand authorization and permission grant policies in Microsoft Graph PowerShell

On the other hand, the [permissionGrantPolicies](/powershell/module/microsoft.graph.identity.signins/get-mgpolicypermissiongrantpolicy) endpoint lists your current permission grant policies. These policies determine what permissions can be granted to applications and under what circumstances. Each policy 'includes' certain conditions, but 'excludes' others. When a user tries to consent to an application, the system checks the permission grant policies to see if any of them apply to the user's request. For example, the low-risk policy would allow users to consent to those permissions configured as 'low risk'. It includes these low-risk policies (as a GUID). In another scenario, if a user tries to consent in a context that matches the 'AdminOnly' policy, they're unable to consent.

### Understand authorization and permission grant policies in Microsoft Graph

On the other hand, the `permissionGrantPolicies` endpoint (`GET https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies`) lists your current permission grant policies. These policies determine what permissions can be granted to applications and under what circumstances. Each policy 'includes' certain conditions, but 'excludes' others. When a user tries to consent to an application, the system checks the permission grant policies to see if any of them apply to the user's request. For example, the low-risk policy would allow users to consent to those permissions configured as 'low risk'. It includes these low-risk policies (as a GUID). In another scenario, if a user tries to consent in a context that matches the 'AdminOnly' policy, they're unable to consent.

ms.date: 06/23/2025

# risklevel: medium

# userimpact: medium

# implementationcost: medium

Microsoft Entra ID Governance utilizes Monthly Active User (MAU) licensing for guest users which is different than licensing for employees and requires an Azure subscription.

Under the guest billing model, guests are identified by a *userType* of Guest regardless of where the user authenticates. A *userType* of Guest is the default userType for all B2B invitation methods and can also be set by an Identity administrator. The bill for each month includes a record for each guest user with one or more governance actions in that month. See the Azure pricing page for pricing details.

For more information, see: [Microsoft Entra ID Governance licensing for guest users](microsoft-entra-id-governance-licensing-for-guest-users.md).

ms.date: 06/23/2025

If you never previously signed in to the Azure portal with MFA, you're prompted to complete MFA to sign in, or postpone MFA enforcement. This screen is displayed only once. For more information about how to set up MFA, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md).

If you select **Postpone MFA**, the date of NFA enforcement will be one month in the future, or Sept 30, 2025, whichever is earlier. After you sign in, you can change the date at [https://aka.ms/managemfaforazure](https://aka.ms/managemfaforazure). To confirm that you want to proceed with the postponement request, click **Confirm postponement**.

 

1. Browse to **Identity** > **Overview**.

- [Learn about app and service principal objects in Microsoft Entra ID](../../identity-platform/app-objects-and-service-principals.md)

- Confluence: 9.0.1 to 9.5.1

> Please note that our Confluence Plugin was last supported on **Ubuntu 16.04**, which is no longer supported. The plugin now supports **only Windows**.

ms.date: 06/23/2025

1. Follow the instructions to [Create the profile](../mem/intune-service/configuration/preference-file-settings-macos#create-the-profile).

|userType|String||

|urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:division|String||

|urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization|String||