📋 Microsoft Entra Documentation Changes

> | microsoft.directory/applications/allProperties/allTasks | Create and delete applications, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/authorizationPolicy/allProperties/allTasks | Manage all aspects of authorization policy<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/customAuthenticationExtensions/allProperties/allTasks | Create and manage custom authentication extensions<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/deviceManagementPolicies/basic/update | Update basic properties on mobile device management and mobile app management policies<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/domains/allProperties/allTasks | Create and delete domains, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/standard/read | Read standard properties of authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/password/update | Reset passwords for all users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/userPrincipalName/update | Update User Principal Name of users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/basic/update | Update basic properties of authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/create | Update authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/authenticationMethods/delete | Delete authentication methods for users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/password/update | Reset passwords for all users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/userPrincipalName/update | Update User Principal Name of users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/create | Add users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/create | Add users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/delete | Delete users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/lifeCycleInfo/read | Read lifecycle information of users, such as employeeLeaveDateTime<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/password/update | Reset passwords for all users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/basic/update | Update OAuth 2.0 permission grants<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/create | Create OAuth 2.0 permission grants<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/create | Add users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/disable | Disable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/enable | Enable users<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/users/invalidateAllRefreshTokens | Force sign-out by invalidating user refresh tokens<br/>[](../privileged-roles-permissions.md) |

### General Availability - API-driven provisioning in US Gov cloud

**Type:** New feature

**Service category:** Provisioning

**Product capability:** Identity Governance

API-driven provisioning is now generally available in US Gov cloud. With this capability, customers in US Gov cloud can now ingest identity data from any authoritative sources into Microsoft Entra ID and on-premises Active Directory. For more information, see: [Quickstart API-driven inbound provisioning with Graph Explorer](../identity/app-provisioning/inbound-provisioning-api-graph-explorer.md).

---

 

### Public Preview - Conditional Access Overview Monitoring Tab to Retire

> [!NOTE]

> Effective July 2025, Microsoft begins rolling out an update to the guest user sign-in experience for B2B collaboration. The rollout continues through the end of 2025. With this update, guest users initially access your organization's branded sign-in page. After entering their email address and selecting **Next**, they are redirected to their own organization's sign-in page to provide their credentials. Guest users see the branding and URL endpoint of their home tenant. This step ensures greater clarity regarding which sign-in information to use. Following successful authentication in their own organization, guest users are returned to your organization to complete the sign-in process. This update is designed to make sign-in less confusing for guests from other organizations. No administrative action is required before the rollout. We recommend reviewing your current B2B collaboration configuration to assess any potential impact.

In the Microsoft Entra admin center, you must be assigned the Global Administrator role to activate the External Collaboration Settings page and update the settings. When using Microsoft Graph, lesser privileged roles might be available for individual settings; see [Configure settings with Microsoft Graph](#configure-settings-with-microsoft-graph) later in this article.

:::image type="content" source="./media/external-collaboration-settings-configure/collaboration-restrictions.png" alt-text="Screenshot showing Collaboration restrictions settings.":::

> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/domains/federation/update | Update federation property of domains<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/identityProtection/allProperties/update | Update all resources in Microsoft Entra ID Protection<br/>[](../privileged-roles-permissions.md) |

ms.date: 06/27/2025

> You need to be a Global Administrator or a Privileged Role Administrator with Catalog Owner permissions to add Microsoft Entra Roles to a catalog. Once a Microsoft Entra Role is added to a catalog, Identity Governance Administrators and Access Package Managers can create access packages containing that Microsoft Entra Role, and other users with permissions to manage access packages can assign users to that Microsoft Entra Role. Similarly, Applications with EntitlementManagement.RW.All permissions can't add Microsoft Entra Roles to catalogs unless they also have the Global Administrator or Privileged Role Administrator role with necessary Entitlement Management permissions.

> If you select **Eligible**, users become eligible for that role and can activate their assignment using Privileged Identity Management in the Microsoft Entra admin center. If you select **Active**, users have an active role assignment until they no longer have access to the access package. For Microsoft Entra roles that are tagged as *“privileged”*, you'll only be able to select **Eligible**. You can find a list of privileged roles here: [Microsoft Entra built-in roles](../identity/role-based-access-control/permissions-reference.md).

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/customAuthenticationExtensions/allProperties/allTasks | Create and manage custom authentication extensions<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

## Microsoft Entra Joined Device Local Administrator

 

[!INCLUDE [microsoft-entra-joined-device-local-administrator](includes/microsoft-entra-joined-device-local-administrator.md)]

 

> | microsoft.directory/applications/credentials/update | Update application credentials<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks | Create and delete OAuth 2.0 permission grants, and read and update all properties<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/servicePrincipals/credentials/update | Update credentials of service principals<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/bitlockerKeys/key/read | Read bitlocker metadata and key on devices<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/deviceManagementPolicies/basic/update | Update basic properties on mobile device management and mobile app management policies<br/>[](../privileged-roles-permissions.md) |

> | microsoft.directory/deviceRegistrationPolicy/basic/update | Update basic properties on device registration policies<br/>[](../privileged-roles-permissions.md) |