Microsoft Entra Documentation Changes

MODIFIED docs/global-secure-access/how-to-application-discovery.md

Modified by jayrusso on Jul 1, 2025 10:26 AM
📖 View on learn.microsoft.com

+28 / -32 lines changed

Commit: June 30 removed preview message and tags and several edits for clarity

Changes:

Before

After

---
title: Application Discovery (Preview) for Global Secure Access
description: Use Application discovery to detect the applications accessed by users and create separate private applications.
ms.service: global-secure-access
ms.topic: how-to
ms.date: 12/16/2024
ms.author: jayrusso
author: HULKsmashGithub
manager: dougeby
ms.custom: sfi-image-nochange
# Customer intent: As an administrator, I want to use Application discovery to detect the applications accessed by users and create separate private applications.
---
# Application discovery (Preview) for Global Secure Access
> [!IMPORTANT]
> Application discovery is currently in PREVIEW.
> This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
 
Application discovery enables administrators to gain comprehensive visibility into application usage within their corporate network. By identifying which applications are accessed and by whom, administrators can create private applications with precise segmentation and least privilege access, which minimizes unnecessary access. 
 
With Quick Access, you can quickly onboard to Private Access by publishing wide IP ranges and wildcard FQDNs, as you would with traditional VPN solutions. You can then transition from Quick Access to per-application publishing for better control and granularity over each application. For example, you can create a Conditional Access policy and set user assignments per application.  

---
title: Application Discovery for Global Secure Access
description: Use Application discovery to detect the applications accessed by users and create separate private applications.
ms.service: global-secure-access
ms.topic: how-to
ms.date: 06/30/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: dougeby
ms.custom: sfi-image-nochange
# Customer intent: As an administrator, I want to use Application discovery to detect the applications accessed by users and create separate private applications.
---
# Application discovery for Global Secure Access
Application discovery lets administrators see which applications people use on their corporate network. By identifying which applications are accessed and by whom, administrators can create private applications with precise segmentation and least privilege access, so users only get the access they need. 
 
With Quick Access, you can quickly onboard to Private Access by publishing wide IP ranges and wildcard FQDNs, like with traditional VPN solutions. You can then transition from Quick Access to per-application publishing for better control and granularity over each application. For example, you can create a Conditional Access policy and set user assignments per application.  
 
This article walks through how to use Application discovery to detect which applications users access (through Quick Access) and create separate private applications.
 
## Prerequisites

MODIFIED docs/identity/domain-services/tutorial-create-forest-trust.md

Modified by Justinha on Jul 1, 2025 1:31 AM
📖 View on learn.microsoft.com

+35 / -2 lines changed

Commit: added verification steps

Changes:

Before

After

 
Before you configure a forest trust in Domain Services, make sure your networking between Azure and on-premises environment meets the following requirements:
 
* Make sure firewall ports allow traffic that is necessary to create and use a trust. For more information about which ports need to be open to use a trust, see [Configure firewall settings for AD DS trusts](/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts).
* Use private IP addresses. Don't rely on DHCP with dynamic IP address assignment.
* Avoid overlapping IP address spaces to allow virtual network peering and routing to successfully communicate between Azure and on-premises.
* An Azure virtual network needs a gateway subnet to configure an [Azure site-to-site (S2S) VPN][vpn-gateway] or [ExpressRoute][expressroute] connection.
1. From the menu on the left-hand side of the managed domain, select **Trusts**, choose the trust, and click **Remove**.
1. Provide the same trust password that was used to configure the forest trust and click **OK**.
 
## Validate resource authentication
 
The following common scenarios let you validate that forest trust correctly authenticates users and access to resources:

 
Before you configure a forest trust in Domain Services, make sure your networking between Azure and on-premises environment meets the following requirements:
 
* Make sure firewall ports and domain controllers allow traffic that is necessary to create and use a trust. For more information about which ports need to be open to use a trust, see [Configure firewall settings for AD DS trusts](/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts). All domain controllers in the domain that has a trust with Domain Services need to have these ports open.
* Use private IP addresses. Don't rely on DHCP with dynamic IP address assignment.
* Avoid overlapping IP address spaces to allow virtual network peering and routing to successfully communicate between Azure and on-premises.
* An Azure virtual network needs a gateway subnet to configure an [Azure site-to-site (S2S) VPN][vpn-gateway] or [ExpressRoute][expressroute] connection.
1. From the menu on the left-hand side of the managed domain, select **Trusts**, choose the trust, and click **Remove**.
1. Provide the same trust password that was used to configure the forest trust and click **OK**.
 
## Verify trust creation
For two-way and one-way incoming trust, you can verify the incoming trust (the outbound trust from your on-premises domain) by using either the Active Directory Domains and Trusts console or the nltest command-line tool after you configure the forest trust.
 
### Use Active Directory Domains and Trusts to verify a trust
 
Complete the following steps from the on-premises AD DS domain controller using an account that has permissions to create and validate trust relationships.
 
1. Select **Start** > **Administrative Tools** > **Active Directory Domains and Trusts**.
1. Right-click your domain and select **Properties**.
1. Choose the **Trusts** tab.

MODIFIED docs/fundamentals/whats-new.md

Modified by Ortagus Winfrey on Jul 1, 2025 9:34 PM
📖 View on learn.microsoft.com

+31 / -0 lines changed

Commit: Background image update added to whats new

Changes:

Before

After

 
## June 2025
 
### General Availability - API-driven provisioning in US Gov cloud
 
**Type:** New feature

 
## June 2025
 
### General Availability – Update to Microsoft Entra Work or School Default Background Image 
 
**Type:** Changed feature  
**Service category:** Authentications (Login)  
**Product capability:** User Authentication  
 
Starting September 29, 2025, we will be making a change to the default background image of our Microsoft Entra work or school authentication screens. This new background was designed to help users focus on signing into their accounts, enhancing productivity and minimizing distractions. With this, we aim to ensure visual consistency and a clean, simplified user experience throughout Microsoft’s authentication flows – aligning with Microsoft’s modernized Fluent design language. When our experiences look and feel consistent, it gives our users a familiar experience that they know and trust. 
 
**What’s changing?**                                                   		           
 
This update is solely a visual user interface refresh with no changes to functionality. This change will only affect screens where Company Branding doesn't apply or where users see the default background image. We recommend updating any documentation that contains screenshots and notifying your help desk. If you have configured a custom background image in Company Branding for your tenant, there will be no change for your users. 
 
**Additional Details:** 
 
1. **Tenants without a custom background configured:**  
    a. Tenants without a custom background will see the change on every authentication screen 
    b. To change this background and use a custom background, configure Company Branding 

MODIFIED docs/identity-platform/whats-new-docs.md

Modified by Henry Mbugua on Jul 1, 2025 6:00 PM
📖 View on learn.microsoft.com

+13 / -14 lines changed

Commit: June 2025 - What's new

Changes:

Before

After

 
Welcome to what's new in the Microsoft identity platform documentation. This article lists new articles that were added or had significant updates in the last three months.
 
## May 2025
 
### New articles
* [Tutorial: Set up a Node.js web app to sign in users by using Microsoft identity platform](tutorial-web-app-node-sign-in-prepare-app.md) - Register app refactor
* [Tutorial: Set up an Android app to sign in users by using Microsoft identity platform](tutorial-mobile-app-android-prepare-app.md) - Register app refactor
 
## March 2025
 
### Updated articles
 
- [Microsoft Entra app manifest (Azure AD Graph format)](reference-app-manifest.md) - The update improved content clarity.
- [Quickstart: Call a web API in a sample daemon app](quickstart-daemon-app-call-api.md) - The update improved content clarity.
- [Quickstart: Sign in users in a sample Desktop app](quickstart-desktop-app-sign-in.md) - The update improved content clarity.
- [Quickstart: Sign in users in a sample mobile app](quickstart-mobile-app-sign-in.md) - The update improved content clarity.
- [Quickstart: Sign in users in a single-page app (SPA) and call the Microsoft Graph API](quickstart-single-page-app-sign-in.md) - The update improved content clarity.
- [Quickstart: Sign in users in a sample web app](quickstart-web-app-sign-in.md) - The update improved content clarity.
- [Tutorial: Add sign-in and sign-out flows to a JavaScript SPA](tutorial-single-page-app-javascript-configure-authentication.md) - The tutorial was updated with the latest code sample.

 
Welcome to what's new in the Microsoft identity platform documentation. This article lists new articles that were added or had significant updates in the last three months.
 
## June 2025
 
### New articles
 
- [Restrictions on identifier URIs of Microsoft Entra applications](identifier-uri-restrictions.md)
 
### Updated articles
 
- [Retrieve and return data from an OnAttributeCollectionStart event](custom-extension-onattributecollectionstart-retrieve-return-data.md) - Update request payload and response
- [Retrieve and return data from an OnAttributeCollectionSubmit event](custom-extension-onattributecollectionsubmit-retrieve-return-data.md) - Update request payload and response
- [Security best practices for application properties in Microsoft Entra ID](security-best-practices-for-app-registration.md) - Update security best practices
- [Run automated integration tests](test-automate-integration-testing.md) - The update improved content clarity.
 
## May 2025
 
### New articles
* [Tutorial: Set up a Node.js web app to sign in users by using Microsoft identity platform](tutorial-web-app-node-sign-in-prepare-app.md) - Register app refactor

MODIFIED docs/identity/monitoring-health/concept-sign-in-log-activity-details.md

Modified by shlipsey3 on Jul 1, 2025 5:45 AM
📖 View on learn.microsoft.com

+9 / -4 lines changed

Commit: logs-timereceived-063025

Changes:

Before

After

ms.service: entra-id
ms.topic: conceptual
ms.subservice: monitoring-health
ms.date: 02/25/2025
ms.author: sarahlipsey
ms.reviewer: egreenberg14
ms.custom: sfi-image-nochange
- **Success:** The Conditional Access policy was applied successfully to the sign-in attempt.
- **Failure:** The Conditional Access policy was applied to the sign-in attempt, but the sign-in attempt failed.
- **Not Applied:** The sign-in didn't match the criteria for the policy to be applied.
   - There are specific scenarios that due to their nature, are required to be exempt from Conditional Access evaluation to prevent a circular dependency (chicken-and-egg scenario) that would not be possible to complete. These are considered "bootstrap scenarios" and might include sign-ins associated with device registration, device compliance, or Network Policy Server connectors.
   - Windows Hello for Business sign-ins show as "Not Applied" because Conditional Access policies protect sign-in attempts to cloud resources, not the Windows sign-in process.
- **Disabled:** The policy was disabled at the time of the sign-in attempt.
 
  - `Not applied`: No policy applied to the user and application during sign-in. Windows Hello for Business shows up as "Not Applied" because Conditional Access policies protect sign-in attempts to cloud resources, not the Windows sign-in process. Other sign-ins might get interrupted so a policy isn't applied.
  - `Success`: One or more Conditional Access policies applied to or were evaluated for the user and application (but not necessarily the other conditions) during sign-in. Even though a Conditional Access policy might not apply, if it was evaluated, the Conditional Access status shows *Success*.
  - `Failure`: The sign-in satisfied the user and application condition of at least one Conditional Access policy and grant controls are either not satisfied or set to block access.
  - Conditional Access does not apply to Windows sign-in, such as Windows Hello for Business. Conditional Access protects sign-in attempts to cloud resources, not the device sign-in process.
 
- **Continuous access evaluation:** Shows whether continuous access evaluation (CAE) was applied to the sign-in event.

ms.service: entra-id
ms.topic: conceptual
ms.subservice: monitoring-health
ms.date: 06/30/2025
ms.author: sarahlipsey
ms.reviewer: egreenberg14
ms.custom: sfi-image-nochange
- **Success:** The Conditional Access policy was applied successfully to the sign-in attempt.
- **Failure:** The Conditional Access policy was applied to the sign-in attempt, but the sign-in attempt failed.
- **Not Applied:** The sign-in didn't match the criteria for the policy to be applied.
   - There are specific scenarios that due to their nature, are required to be exempt from Conditional Access evaluation to prevent a circular dependency (chicken-and-egg scenario) that wouldn't be possible to complete. These scenarios are considered "bootstrap scenarios" and might include sign-ins associated with device registration, device compliance, or Network Policy Server connectors.
   - Windows Hello for Business sign-ins show as "Not Applied" because Conditional Access policies protect sign-in attempts to cloud resources, not the Windows sign-in process.
- **Disabled:** The policy was disabled at the time of the sign-in attempt.
 
  - `Not applied`: No policy applied to the user and application during sign-in. Windows Hello for Business shows up as "Not Applied" because Conditional Access policies protect sign-in attempts to cloud resources, not the Windows sign-in process. Other sign-ins might get interrupted so a policy isn't applied.
  - `Success`: One or more Conditional Access policies applied to or were evaluated for the user and application (but not necessarily the other conditions) during sign-in. Even though a Conditional Access policy might not apply, if it was evaluated, the Conditional Access status shows *Success*.
  - `Failure`: The sign-in satisfied the user and application condition of at least one Conditional Access policy and grant controls are either not satisfied or set to block access.
  - Conditional Access doesn't apply to Windows sign-in, such as Windows Hello for Business. Conditional Access protects sign-in attempts to cloud resources, not the device sign-in process.
 
- **Continuous access evaluation:** Shows whether continuous access evaluation (CAE) was applied to the sign-in event.

MODIFIED docs/identity/monitoring-health/howto-analyze-activity-logs-with-microsoft-graph.md

Modified by Michele Martin on Jul 1, 2025 10:25 AM
📖 View on learn.microsoft.com

+5 / -3 lines changed

Commit: fix blocking issues - email, note format

Changes:

Before

After

- To find sign-up attempts that failed during email validation:
 
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=status/errorCode eq 1002013 and signUpStage eq 'credentialValidation'`
  - Note: Error code 1002013 represents an expected (and successful) interrupt of the sign-up flow. [Learn more](howto-troubleshoot-sign-up-errors.md#sign-up-error-codes)
 
- For sign-ups during a date range:
  - GET `https://graph.microsoft.com/v1.0/auditLogs/signUps?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z)`
- For social account sign-ups (Google in this example):
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=signUpIdentityProvider eq ‘Google'`
 
- To see entries for a specific user, for example `[email protected]`:
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=signUpIdentity/signUpIdentifier eq '[email protected]'`
 
- To find entries matching a specific correlation ID:  
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=correlationId eq 'CorrelationId'`
 
 

- To find sign-up attempts that failed during email validation:
 
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=status/errorCode eq 1002013 and signUpStage eq 'credentialValidation'`
 
   > [!NOTE]
   > Error code 1002013 indicates an expected (and successful) interrupt of the sign-up flow. [Learn more](howto-troubleshoot-sign-up-errors.md#sign-up-error-codes)
 
- For sign-ups during a date range:
  - GET `https://graph.microsoft.com/v1.0/auditLogs/signUps?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z)`
- For social account sign-ups (Google in this example):
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=signUpIdentityProvider eq ‘Google'`
 
- To see entries for a specific user, for example `[email protected]`:
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=signUpIdentity/signUpIdentifier eq '[email protected]'`
 
- To find entries matching a specific correlation ID:  
  - GET `https://graph.microsoft.com/beta/auditLogs/signUps?$filter=correlationId eq 'CorrelationId'`

MODIFIED docs/external-id/customers/tutorial-configure-cloudflare-integration.md

Modified by Lynne O'Connor on Jul 1, 2025 6:13 AM
📖 View on learn.microsoft.com

+4 / -1 lines changed

Commit: add note per Gargi

Changes:

Before

After

ms.service: entra-external-id
ms.subservice: external
ms.topic: how-to
ms.date: 08/05/2024
ms.author: gasinh
ms.custom: it-pro

   [![Screenshot of proxied status.](media/tutorial-configure-cloudflare-integration/proxied-status.png)](media/tutorial-configure-cloudflare-integration/proxied-status-expanded.png#lightbox)

## Cloudflare security controls

For optimal protection, we recommend you enable Cloudflare security controls.

ms.service: entra-external-id
ms.subservice: external
ms.topic: how-to
ms.date: 06/30/2025
ms.author: gasinh
ms.custom: it-pro


   [![Screenshot of proxied status.](media/tutorial-configure-cloudflare-integration/proxied-status.png)](media/tutorial-configure-cloudflare-integration/proxied-status-expanded.png#lightbox)

> [!NOTE]
> Azure Front Door-managed certificates aren't automatically renewed if your custom domain’s CNAME record points to a DNS record other than the Azure Front Door endpoint’s domain (for example, when using a third-party DNS service like Cloudflare). To renew the certificate in such cases, follow the instructions in the [Renew Azure Front Door-managed certificates](/azure/frontdoor/domain#renew-azure-front-door-managed-certificates) article.

## Cloudflare security controls

For optimal protection, we recommend you enable Cloudflare security controls. 

MODIFIED docs/includes/secure-recommendations/21788.md

Modified by OpenPublishing.Build on Jul 1, 2025 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: update

Changes:

Before

After

 
**Remediation action**
 
- [Get started with a phishing-resistant passwordless authentication deployment](/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication.md)
 
- [Ensure that privileged accounts register and use phishing resistant methods](/entra/identity/authentication/concept-authentication-strengths#authentication-strengths.md)
 
- [Deploy Conditional Access policy to target privileged accounts and require phishing resistant credentials using authentication strengths](/entra/identity/conditional-access/policy-admin-phish-resistant-mfa.md)
 
- [Monitor authentication method activity](/entra/identity/monitoring-health/concept-usage-insights-report#authentication-methods-activity.md)

 
**Remediation action**
 
- [Get started with a phishing-resistant passwordless authentication deployment](/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)
 
- [Ensure that privileged accounts register and use phishing resistant methods](/entra/identity/authentication/concept-authentication-strengths#authentication-strengths.md)
 
- [Deploy Conditional Access policy to target privileged accounts and require phishing resistant credentials using authentication strengths](/entra/identity/conditional-access/policy-admin-phish-resistant-mfa)
 
- [Monitor authentication method activity](/entra/identity/monitoring-health/concept-usage-insights-report#authentication-methods-activity.md)

MODIFIED docs/includes/secure-recommendations/21803.md

Modified by OpenPublishing.Build on Jul 1, 2025 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: update

Changes:

Before

After

 
**Remediation action**
 
- [Enable combined security information registration](/entra/identity/authentication/howto-registration-mfa-sspr-combined.md)
- [How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra ID](/entra/identity/authentication/how-to-authentication-methods-manage.md)

 
**Remediation action**
 
- [Enable combined security information registration](/entra/identity/authentication/howto-registration-mfa-sspr-combined)
- [How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra ID](/entra/identity/authentication/how-to-authentication-methods-manage)

MODIFIED docs/includes/secure-recommendations/21804.md

Modified by OpenPublishing.Build on Jul 1, 2025 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: update

Changes:

Before

After

 
**Remediation action**
 
- [Enable combined security information registration](/entra/identity/authentication/howto-registration-mfa-sspr-combined.md)
- [How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra ID](/entra/identity/authentication/how-to-authentication-methods-manage.md)

 
**Remediation action**
 
- [Enable combined security information registration](/entra/identity/authentication/howto-registration-mfa-sspr-combined)
- [How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra ID](/entra/identity/authentication/how-to-authentication-methods-manage)

MODIFIED docs/identity/conditional-access/concept-conditional-access-cloud-apps.md

Modified by John Flores on Jul 1, 2025 2:48 AM
📖 View on learn.microsoft.com

+0 / -3 lines changed

Commit: Update concept-conditional-access-cloud-apps.md

Changes:

Before

After

 
We're continually adding more administrative portals to the list.
 
> [!NOTE]
> The Microsoft Admin Portals app applies to interactive sign-ins to the listed admin portals only. Sign-ins to the underlying resources or services like Microsoft Graph or Azure Resource Manager APIs aren't covered by this application. Those resources are protected by the [Windows Azure Service Management API](#windows-azure-service-management-api) app. This grouping enables customers to move along the MFA adoption journey for admins without impacting automation that relies on APIs and PowerShell. When you're ready, Microsoft recommends using a [policy requiring administrators perform MFA always](policy-old-require-mfa-admin.md) for comprehensive protection.
 
### Other applications
 
Administrators can add any Microsoft Entra registered application to Conditional Access policies. These applications might include:

 
We're continually adding more administrative portals to the list.
 
### Other applications
 
Administrators can add any Microsoft Entra registered application to Conditional Access policies. These applications might include:

MODIFIED docs/identity/domain-services/manage-dns.md

Modified by Kelvin Mbuco on Jul 1, 2025 9:58 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update manage-dns.md

Changes:

Before

After

Refrain from redirecting DNS zones related to windowsazure.com or core.windows.net. If DNS redirection is required, limit the redirection to individual host names instead of zones. For example, use server1.file.core.windows.net instead of file.core.windows.net.
 
>[!NOTE]
>Creating or changing root hints or server-level DNS forwarders isn't supported and causes issues for the Domain Services managed domain. 
 
This article shows you how to install the DNS Server tools then use the DNS console to manage records and create conditional forwarders in Domain Services.

Refrain from redirecting DNS zones related to windowsazure.com or core.windows.net. If DNS redirection is required, limit the redirection to individual host names instead of zones. For example, use server1.file.core.windows.net instead of file.core.windows.net.
 
>[!NOTE]
>Setting the "Use Root Hints" option to Enable or changing the server-level DNS forwarder to anything other than 168.63.129.16 is not supported and will cause issues with Entra Domain Services managed domains. Avoid modifying these settings, as it can lead to an unsupported configuration for your tenant. If you encounter difficulties configuring DNS to a supported state, contact Microsoft Support for assistance.
 
This article shows you how to install the DNS Server tools then use the DNS console to manage records and create conditional forwarders in Domain Services.

MODIFIED docs/identity/conditional-access/concept-conditional-access-grant.md

Modified by kmsft on Jul 1, 2025 5:10 PM
📖 View on learn.microsoft.com

+2 / -0 lines changed

Commit: Learn Editor: Update concept-conditional-access-grant.md

Changes:

Before

After

- Provectus - Secure Contacts
- Viva Engage (Android, iOS, and iPadOS)
 
> [!NOTE]
> Kaizala, Skype for Business, and Visio don't support the **Require app protection policy** grant. If you require these apps to work, use the **Require approved apps** grant exclusively. Using the "or" clause between the two grants will not work for these three applications.

- Provectus - Secure Contacts
- Viva Engage (Android, iOS, and iPadOS)
 
- Windows App (Android, iOS/iPadOS and Edge on Windows)
 
> [!NOTE]
> Kaizala, Skype for Business, and Visio don't support the **Require app protection policy** grant. If you require these apps to work, use the **Require approved apps** grant exclusively. Using the "or" clause between the two grants will not work for these three applications.
 

MODIFIED docs/includes/secure-recommendations/21888.md

Modified by OpenPublishing.Build on Jul 1, 2025 4:18 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: update

Changes:

Before

After

 
**Remediation action**
 
- [Redirect URI (reply URL) outline and restrictions](/entra/identity-platform/reply-url.md)

 
**Remediation action**
 
- [Redirect URI (reply URL) outline and restrictions](/entra/identity-platform/reply-url)

MODIFIED docs/global-secure-access/how-to-configure-connectors.md

Modified by Marilee Turscak - MSFT on Jul 1, 2025 10:21 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Support for multi-geo connectors is in preview

Changes:

Before

After

For information about connectors, capacity planning, and how they stay up-to-date, see [Understand Microsoft Entra private network connectors](concept-connectors.md).
 
> [!NOTE]
> Microsoft Entra Private Access does not support multi-geo connectors. The cloud service instances for your connector are chosen in the same region as your Microsoft Entra tenant (or the closest region to it) even if you have connectors installed in regions different from your default region.
 
## Verify the installation and registration

For information about connectors, capacity planning, and how they stay up-to-date, see [Understand Microsoft Entra private network connectors](concept-connectors.md).
 
> [!NOTE]
> Microsoft Entra Private Access support for multi-geo connectors is currently in PREVIEW. By default, the cloud service instances for your connector are chosen in the same region as your Microsoft Entra tenant (or the closest region to it) even if you have connectors installed in regions different from your default region. Multi-Geo support lets customers optimize traffic flow by assigning connector groups according to their preferred geo locations instead of relying solely on the tenant's geo location.
 
## Verify the installation and registration

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files