📋 Microsoft Entra Documentation Changes

| accountEnabled |X |Defines if an account is enabled. |

| cn |X | |

| displayName |X | |

| objectSID |X |mechanical property. AD user identifier used to maintain sync between Microsoft Entra ID and AD. |

| pwdLastSet |X |mechanical property. Used to know when to invalidate already issued tokens. Used by both password hash sync, pass-through authentication and federation. |

|samAccountName|X| |

| sourceAnchor |X |mechanical property. Immutable identifier to maintain relationship between ADDS and Microsoft Entra ID. |

| usageLocation |X |mechanical property. The user’s country/region. Used for license assignment. |

| userPrincipalName |X |UPN is the login ID for the user. Most often the same as [mail] value. |

| accountEnabled |X | | |Defines if an account is enabled. |

| altRecipient |X | | |Requires Microsoft Entra Connect build 1.1.552.0 or after. |

| authOrig |X |X |X | |

| c |X |X | | |

> After you enable this capability, your Azure virtual machine / Arc-enabled machine will be Microsoft Entra joined. You can't join them to another domain, like on-premises Active Directory or Microsoft Entra Domain Services. If you need to do so, disconnect the device from Microsoft Entra by uninstalling the extension. In addition, if you deploy a supported golden image, you can enable Microsoft Entra ID authentication installing after the deployment the dedicated extension.

::: zone pivot="identity-extension-hybrid"

1. Create a PKI container object.

1. Sign in to the Microsoft Entra admin center as an [Privilege Authentication Administrator](../role-based-access-control/permissions-reference.md#privileged-authentication-administrator).

1. Browse to **Entra ID** > **Identity Secure Score** > **Public key infrastructure (Preview)**.

1. Click **+ Create PKI**.

1. Enter **Display Name**.

1. Click **Create**.

:::image type="content" border="true" source="./media/how-to-certificate-based-authentication/new-public-key-infrastructure.png" alt-text="Diagram of the steps required to create a PKI.":::

1. Select **Columns** to add or delete columns.

1. Select **Refresh** to refresh the list of PKIs.

1. To delete a PKI, select the PKI and select **Delete**. If the PKI has CAs in it, enter the name of the PKI to acknowledge the deletion of all CAs within it and select **Delete**.

:::image type="content" border="true" source="./media/how-to-certificate-based-authentication/new-public-key-infrastructure.png" alt-text="Diagram of the steps required to delete a PKI.":::

In preview, the Conditional Access optimization agent evaluates policies such as requiring multifactor authentication (MFA), enforcing device based controls (device compliance, app protection policies, and domain-joined devices), and blocking legacy authentication and device code flow. The agent also evaluates all existing enabled policies to propose potential consolidation of similar policies. With **one-click remediation**, when the agent identifies a suggestion you can have the agent update the associated policy with one click.

In preview, the policy suggestions reviewed by the agent include:

- All logs for the agent will be associated with the user who started the agent.

description: "This article shows the new and updated documentation for the Microsoft Entra application management."

ms.date: 06/03/2025

 

## March 2025

 

### Updated articles

Activation | script

Retry (Standard) | script

OTP extension prompt | This is Microsoft. If you are trying to sign in, press the # key to continue.

OTP fraud greeting | This is Microsoft. If you are trying to sign in, press the # key to continue. If you are not trying to sign in, press 0 and #.

OTP fraud confirm | If this was not you trying to sign in, protect your account by notifying your IT team by pressing 1.

OTP fraud confirmed | We have notified your IT team, no further action is required. For help, please contact your company's IT team. Goodbye.

OTP goodbye | Goodbye.

OTP greeting | This is Microsoft. If you are trying to sign in, press the # key to continue.

OTP last verification code | Again, your code is

Greeting | This is Microsoft. If you are trying to sign in, press the # key to finish signing in.

 

Authentication failed | I'm sorry we can't sign you in at this time. Please try again later.

ms.date: 06/05/2025

## February 2025

 

### New articles

 

To ensure Conditional Access policies are accurately enforced on specified authentication flows, we use functionality called protocol tracking. This tracking is applied to the session using device code flow or authentication transfer. In these cases, the sessions are considered protocol tracked. Any protocol tracked sessions are subject to policy enforcement if a policy exists. Protocol tracking state is sustained through subsequent refreshes. Nondevice code flow or authentication transfer flows can be subject to enforcement of authentication flows policies if the session is protocol tracked.

1. You use device code flow to sign-in to SharePoint, as allowed by the configured policy. At this point, the session is considered protocol tracked

1. You're blocked by the configured policy due to the protocol tracked state of the session

If you have a sign-in unexpectedly blocked by a Conditional Access policy, you should confirm whether the policy was an authentication flows policy. You can do this confirmation by going to **sign-in logs**, clicking on the blocked sign-in, and then navigating to the **Conditional Access** tab in the **Activity details: sign-ins** pane. If the policy enforced was an authentication flows policy, select the policy to determine which authentication flow was matched.

If device code flow was matched but device code flow wasn't the flow performed for that sign-in, the refresh token was protocol tracked. You can verify this case by clicking on the blocked sign-in and searching for the **Original transfer method** property in the **Basic info** portion of the **Activity details: sign-ins** pane.

author: rwike77

ms.author: ryanwi

- GET `https://graph.microsoft.com/v1.0/auditLogs/signUps?&$filter=(createdDateTime ge 2024-01-13T14:13:32Z and createdDateTime le 2024-01-14T17:43:26Z)`

- GET `https://graph.microsoft.com/beta/signupLogs/signUps?$filter=appId eq 'AppId'`

ms.date: 03/04/2025

The best way to configure the certificate authorities (CAs) is with the PKI-based trust store (Preview). You can delegate configuration with a PKI-based trust store to least privileged roles. For more information see, [Step 1: Configure the certificate authorities with PKI-based trust store (Preview)](how-to-certificate-based-authentication.md#step-1-configure-the-certificate-authorities-with-pki-based-trust-store).

| Add company branding to your sign-in page | You can customize your sign-in page so builds trust and helps B2B guest users recognize your organization during sign-in. Effective July 2025, Microsoft begins rolling out an update to the guest user sign-in experience for B2B collaboration. The rollout continues through the end of 2025. With this update, guest users initially access your organization's branded sign-in page. After entering their email address and selecting **Next**, they're redirected to their own organization's sign-in page to provide their credentials. Following successful authentication in their own organization, guest users are returned to your organization to complete the sign-in process. See how to [add company branding to sign in and Access Panel pages](~/fundamentals/how-to-customize-branding.md). |

| June | 99.999% | 99.999% | 99.999% | 99.999% | |

- Consider creating a [performance baseline](~/MicrosoftDocs/SupportArticles-docs-pr/blob/main/support/windows-server/performance/troubleshoot-performance-problems-in-windows) for your private network connectors.

`https://www.gettyimages.in/sign-in/sso`