📋 Microsoft Entra Documentation Changes

ms.date: 06/25/2025

<!-- autogenerated content starts here -->

 

> | [Azure AD Joined Device Local Administrator](#azure-ad-joined-device-local-administrator) | Users assigned to this role are added to the local administrators group on Microsoft Entra joined devices. | 9f06204d-73c1-4d4c-880a-6edb90606fd8 |

Microsoft Entra Connect provides three options for application and certificate management:

Microsoft Entra Connect manages the application and certificate, which includes creation, rotation, and deletion of the certificate. The certificate is stored in the `CURRENT_USER` store. For optimal protection of the certificate's private key, we recommend that the machine should use a Trusted Platform Module (TPM) solution to establish a hardware-based security boundary.

When a TPM is available, key service operations are performed within a dedicated hardware environment. In contrast, if a TPM can't be used, Microsoft Entra Connect defaults to storing the certificate in the default Microsoft Software Key Storage Provider and marks the private key as nonexportable for extra protection. Without the hardware isolation provided by a TPM, only software safeguards secure the private key, which doesn't achieve the same level of protection.

We recommend the Microsoft Entra Connect certificate management option because we manage the keys and automatically rotate the certificate on expiry. This behavior is the default option in Microsoft Entra Connect Sync versions equal to or higher than 2.5.3.0.

1. Domain Services has removed the ability to disable the TLS 1.2 only mode. Customers who disable TLS 1.2 only mode can enable it.

1. Customers can not disable TLS 1.2 only mode once they have enabled it.

### Identify Applications Using Deprecated TLS Versions

 

Before enabling TLS 1.2 only mode, it's important to identify applications still using TLS 1.0 or 1.1 and update them or replace them with alternatives that support TLS 1.2. You can:

 

1. Use network monitoring tools (e.g., Wireshark, Microsoft Message Analyzer) to inspect TLS handshake versions.

 

### Use the Azure portal:

This is a [privileged role](../privileged-roles-permissions.md). Users with this role have access to all administrative features in Microsoft Entra ID, as well as services that use Microsoft Entra identities like the Microsoft 365 Defender portal, the Microsoft Purview compliance portal, Exchange Online, SharePoint Online, and Skype for Business Online. Global Administrators can view Directory Activity logs. Furthermore, Global Administrators can [elevate their access](/azure/role-based-access-control/elevate-access-global-admin) to manage all Azure subscriptions and management groups. This allows Global Administrators to get full access to all Azure resources using the respective Microsoft Entra tenant. The person who signs up for the Microsoft Entra organization becomes a Global Administrator. There can be more than one Global Administrator at your company. Global Administrators can reset the password for any user and all other administrators. A Global Administrator cannot remove their own Global Administrator assignment. This is to prevent a situation where an organization has zero Global Administrators.

> | microsoft.directory/applications/allProperties/allTasks | Create and delete applications, and read and update all properties<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/authorizationPolicy/allProperties/allTasks | Manage all aspects of authorization policy<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[](privileged-roles-permissions.md) |

Microsoft Entra Connect deployments vary from a single forest Express mode installation to complex deployments that are synced across multiple forests by using custom synchronization rules. Because of the large number of configuration options and mechanisms, it's essential to understand what settings are in effect and be able to quickly deploy a server with an identical configuration. This feature introduces the ability to catalog the configuration of a specific synchronization server and import the settings into a new deployment. You can compare different synchronization settings snapshots to easily visualize the differences between two servers or the same server over time.

You can't use this feature if the Microsoft Entra Connect installation was modified to include the G-SQL connector or the G-LDAP connector. You also can't combine this feature when you use an existing Microsoft Entra Connect Sync database. The use of import/export configuration and using an existing database are mutually exclusive.

1. Install Microsoft Entra Connect on a new server.

- EEOStatus (String)

- FLSAStatus (String)

- PayGrade (String)

- PayScaleType (String)

- IsRehire (Boolean)

- EmployeeLevel (Integer)

- `urn:ietf:params:scim:schemas:extension:microsoft:entra:csa:isRehire`

- `urn:ietf:params:scim:schemas:extension:microsoft:entra:csa:EmployeeLevel`

This is a [privileged role](../privileged-roles-permissions.md). Do not use. This role has been deprecated and will be removed from Microsoft Entra ID in the future. This role is intended for use by a small number of Microsoft resale partners, and is not intended for general use.

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/domains/allProperties/allTasks | Create and delete domains, and read and update all properties<br/>[](privileged-roles-permissions.md) |

This is a [privileged role](../privileged-roles-permissions.md). Assign the Privileged Authentication Administrator role to users who need to do the following:

> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/standard/read | Read standard properties of authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](privileged-roles-permissions.md) |

This is a [privileged role](../privileged-roles-permissions.md). Assign the Authentication Administrator role to users who need to do the following:

> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](privileged-roles-permissions.md) |

This is a [privileged role](../privileged-roles-permissions.md). Do not use. This role has been deprecated and will be removed from Microsoft Entra ID in the future. This role is intended for use by a small number of Microsoft resale partners, and is not intended for general use.

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](privileged-roles-permissions.md) |

This is a [privileged role](../privileged-roles-permissions.md). Assign the User Administrator role to users who need to do the following:

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/create | Add users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](privileged-roles-permissions.md) |

This is a [privileged role](../privileged-roles-permissions.md). Users in this role can read and update basic information of users, groups, and service principals.

> | microsoft.directory/oAuth2PermissionGrants/basic/update | Update OAuth 2.0 permission grants<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/create | Create OAuth 2.0 permission grants<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/create | Add users<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](privileged-roles-permissions.md) |

## Suppress camera consent prompt

 

By default, QR code and PIN authentication prompts users for camera permission every time they need to use the camera to scan a QR code. However, administrators can suppress this behavior and skip requesting camera permission.

 


 

This is configured by the Authentication Policy Administrator through an [app configuration policy for managed Android Enterprise devices](/mem/intune/apps/app-configuration-policies-use-android) on the Microsoft Authenticator App, setting `sdm_suppress_camera_consent` equal to `true`, similar to how the `preferred_auth_method` is configured.

 

When this setting is enabled:

- The app will not show the camera consent prompt if camera permissions are already granted at the OS level

- Users will have a smoother authentication experience without repeated permission requests

- The QR code scanning flow will be more streamlined for managed devices

 

This configuration is particularly useful in enterprise environments where devices are managed and camera permissions can be pre-configured by IT administrators.

 

 

This is a [privileged role](../privileged-roles-permissions.md). Users with this role have permissions to manage security-related features in the Microsoft 365 Defender portal, Microsoft Entra ID Protection, Microsoft Entra Authentication, Azure Information Protection, and Microsoft Purview compliance portal. For more information about Office 365 permissions, see [Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance](/microsoft-365/security/office-365-security/scc-permissions).

> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/domains/federation/update | Update federation property of domains<br/>[](privileged-roles-permissions.md) |

[](privileged-roles-permissions.md)

This is a [privileged role](../privileged-roles-permissions.md). Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. Note that users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](privileged-roles-permissions.md) |

> | microsoft.directory/customAuthenticationExtensions/allProperties/allTasks | Create and manage custom authentication extensions<br/>[](privileged-roles-permissions.md) |