📋 Microsoft Entra Documentation Changes

ms.reviewer: bochingwa

ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done

---

 

Microsoft is enhancing security by disabling TLS versions 1.0 and 1.1 as communicated on November 10, 2023. While the Microsoft implementation of TLS 1.0 and TLS 1.1 versions is not known to have vulnerabilities, TLS 1.2 or later versions provide improved security features, including perfect forward secrecy and stronger cipher suites. This change helps protect customer data and ensures compliance with industry standards.

 

1. Domain Services will remove the ability to disable the TLS 1.2 only mode. Customers who disable TLS 1.2 only mode can enable it.

1. After Domain Services removes the ability to disable the TLS 1.2 only mode, customers can't enable or disable TLS 1.2 only mode.

 

 

Use the Azure portal:

 

 

This may take about 10 minutes to complete as domain security updates are enforced.

 

 

1. Install the Az.ADDomainServices module:

- *issuer*, *subject* are the key pieces of information needed to set up the trust relationship. When the Azure workload requests Microsoft identity platform to exchange the managed identity token for an Entra app access token, the *issuer* and *subject* values of the federated identity credential are checked against the `issuer` and `subject` claims provided in the Managed Identity token. If that validation check passes, Microsoft identity platform issues an access token to the external software workload.

- *issuer* is the URL of the Microsoft Entra tenant's Authority URL in the form `https://login.microsoftonline.com/{tenant}/v2.0`. Both the Microsoft Entra app and managed identity must belong to the same tenant. If the `issuer` claim has leading or trailing whitespace in the value, the token exchange is blocked.

- `subject`: This is the case-sensitive GUID of the managed identity’s **Object (Principal) ID** assigned to the Azure workload. The managed identity must be in the same tenant as the app registration, even if the target resource is in a different cloud. The Microsoft identity platform will reject the token exchange if the `subject` in the federated identity credential configuration does not exactly match the managed identity's Principal ID.

- *audiences* specifies the value that appears in the `aud` claim in the managed identity token (Required). The value must be one of the following depending on the target cloud.

- **Microsoft Entra ID global service**: `api://AzureADTokenExchange`

- **Microsoft Entra ID for US Government**: `api://AzureADTokenExchangeUSGov`

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Domain Name Administrator](~/identity/role-based-access-control/permissions-reference.md#domain-name-administrator).

1. Choose your *external* tenant: Select the **Settings** icon in the top menu, and then switch to your external tenant.

 

1. [Add your custom domain name](~/fundamentals/add-custom-domain.yml#add-your-custom-domain-name) to Microsoft Entra ID.

 

 

## Next steps

 

Most recommendations follow the same pattern. You're provided information about how the recommendation works, its value, and some action steps to address the recommendation. This section provides an overview of the details provided in a recommendation, but aren't specific to one recommendation.

 

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](../role-based-access-control/permissions-reference.md#reports-reader).

1. Select a recommendation from the list.

 


## Related content

 

- [Review the Microsoft Entra recommendations overview](overview-recommendations.md)

- US Gov -> Commercial

- Commercial -> China

---

ms.service: entra-id

ms.subservice: domain-services

ms.topic: overview

ms.author: justinha

#Customer intent: As an IT administrator or decision maker, I want to understand the differences between Active Directory Domain Services (AD DS), Microsoft Entra ID, and Domain Services so I can choose the most appropriate identity solution for my organization.

---

ms.service: entra-id

ms.subservice: domain-services

ms.topic: conceptual

ms.author: justinha

---

 

ms.service: entra-id

ms.subservice: domain-services

ms.topic: conceptual

ms.author: justinha

ms.reviewer: wanjikumugo

ms.custom: devx-track-azurepowershell, has-azure-ad-ps-ref, azure-ad-ref-level-one-done

ms.subservice: domain-services

ms.workload: identity

ms.topic: tutorial

ms.author: justinha

ms.custom: sfi-image-nochange

#Customer intent: As an identity administrator, I want to create a one-way outbound forest from a Microsoft Entra Domain Services forest to an on-premises Active Directory Domain Services forest to provide authentication and resource access between forests.