📝 Modified Documentation Files

MODIFIED docs/fundamentals/configure-security.md

Modified by shlipsey3 on Jul 14, 2025 8:00 PM
📖 View on learn.microsoft.com

+9 / -1 lines changed

Commit: add-includes-to-landing-page

Changes:

Before

After

ms.service: entra
ms.subservice: fundamentals
ms.topic: reference
ms.date: 07/08/2025
 
ms.author: joflore
author: MicrosoftGuyJFlo
 
[!INCLUDE [21868](../includes/secure-recommendations/21868.md)]
 
## Monitoring
 
### Diagnostic settings are configured for all Microsoft Entra logs

ms.service: entra
ms.subservice: fundamentals
ms.topic: reference
ms.date: 07/14/2025
 
ms.author: joflore
author: MicrosoftGuyJFlo
 
[!INCLUDE [21868](../includes/secure-recommendations/21868.md)]
 
### Allow/Deny lists of domains to restrict external collaboration are configured
 
[!INCLUDE [21874](../includes/secure-recommendations/21874.md)]
 
### All guests have a sponsor
 
[!INCLUDE [21877](../includes/secure-recommendations/21877.md)]
 
## Monitoring
 

MODIFIED docs/identity/domain-services/network-considerations.md

Modified by Tracey Torble on Jul 14, 2025 1:16 PM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Update docs/identity/domain-services/network-considerations.md

Changes:

Before

After

Get-AzNetworkSecurityGroup -Name "nsg-name" -ResourceGroupName "resource-group-name" | Add-AzNetworkSecurityRuleConfig -Name "new-rule-name" -Access "Allow" -Protocol "TCP" -Direction "Inbound" -Priority "priority-number" -SourceAddressPrefix "CorpNetSaw" -SourcePortRange "*" -DestinationPortRange "3389" -DestinationAddressPrefix "*" | Set-AzNetworkSecurityGroup
```
 
### Othert ports - synchronization with secondary controller, backup
 
|Client Port(s)|Server Port|Service|
|---|---|---|
|1024-65535/TCP|135/TCP|RPC Endpoint Mapper|
|1024-65535/TCP|1024-65535/TCP|RPC for LSA, SAM, NetLogon |
|1024-65535/TCP|445/TCP|SMB|
|1024-65535/TCP|1024-65535/TCP|FRS RPC |
 
* When configuring firewall rules or network security policies, it is crucial to consider other ports for syncrhonizacion with secondary controller.
* If traffic restrictions are implemented for this ports, it is essential not to deny traffic between the IP addresses or the addressing range used by controllers of the service.
* **Blocking communication via these ports between controllers will prevent the correct functioning of replication and data synchronization.** This causes errors in the backup process.
* Ensure that security policies explicitly allow this internal communication to guarantee the integrity and availability of the service.
 
For more information: [How to configure a firewall for Active Directory domains and trusts](https://learn.microsoft.com/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts)
 
## User-defined routes

Get-AzNetworkSecurityGroup -Name "nsg-name" -ResourceGroupName "resource-group-name" | Add-AzNetworkSecurityRuleConfig -Name "new-rule-name" -Access "Allow" -Protocol "TCP" -Direction "Inbound" -Priority "priority-number" -SourceAddressPrefix "CorpNetSaw" -SourcePortRange "*" -DestinationPortRange "3389" -DestinationAddressPrefix "*" | Set-AzNetworkSecurityGroup
```
 
### Other ports - synchronization with secondary controller, backup
 
|Client port(s)|Server port|Service|
|---|---|---|
|1024-65535/TCP|135/TCP|RPC Endpoint Mapper|
|1024-65535/TCP|1024-65535/TCP|RPC for LSA, SAM, NetLogon |
|1024-65535/TCP|445/TCP|SMB|
|1024-65535/TCP|1024-65535/TCP|FRS RPC |
 
* When configuring firewall rules or network security policies, it's crucial to consider other ports for synchronization with secondary controller.
* If traffic restrictions are implemented for these ports, it's essential not to deny traffic between the IP addresses or the addressing range used by controllers of the service.
* **Blocking communication via these ports between controllers will prevent the correct functioning of replication and data synchronization.** This causes errors in the backup process.
* Ensure that security policies explicitly allow this internal communication to guarantee the integrity and availability of the service.
 
For more information see [How to configure a firewall for Active Directory domains and trusts](/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts).
 
## User-defined routes

MODIFIED docs/identity/domain-services/reference-domain-services-tls-enforcement.md

Modified by Justinha on Jul 14, 2025 9:02 PM
📖 View on learn.microsoft.com

+3 / -6 lines changed

Commit: removed en-us

Changes:

Before

After

ms.service: entra-id
ms.subservice: domain-services
ms.topic: how-to
ms.date: 07/10/2025
ms.author: justinha
ms.reviewer: bochingwa
ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done
 
Microsoft is enhancing security by disabling TLS versions 1.0 and 1.1 as communicated on November 10, 2023. While the Microsoft implementation of TLS 1.0 and TLS 1.1 versions isn't known to have vulnerabilities, TLS 1.2 or later versions provide improved security features, including perfect forward secrecy and stronger cipher suites. This change helps protect customer data and ensures compliance with industry standards.
 
Microsoft Entra Domain Services supports TLS versions 1.0 and 1.1, but they're disabled by default.
The following retirement path for TLS versions 1.0 and 1.1 is used for Domain Services:
 
1. Domain Services has removed the ability to disable **TLS 1.2 Only Mode**. Customers who disable **TLS 1.2 Only Mode** can enable it. 
 
You can use the Azure portal or PowerShell to enable **TLS 1.2 Only Mode**.
 
## Identify applications that use deprecated TLS versions
 
Before you enable **TLS 1.2 Only Mode**, it's important to identify applications that still use TLS 1.0 or 1.1, and update them or replace them with alternatives that support TLS 1.2. Please refer to [this documentation](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-10-11-deprecation-in-windows) for a list of apps that are expected to be impacted.

ms.service: entra-id
ms.subservice: domain-services
ms.topic: how-to
ms.date: 07/14/2025
ms.author: justinha
ms.reviewer: bochingwa
ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done
 
Microsoft is enhancing security by disabling TLS versions 1.0 and 1.1 as communicated on November 10, 2023. While the Microsoft implementation of TLS 1.0 and TLS 1.1 versions isn't known to have vulnerabilities, TLS 1.2 or later versions provide improved security features, including perfect forward secrecy and stronger cipher suites. This change helps protect customer data and ensures compliance with industry standards.
 
Microsoft Entra Domain Services supports TLS versions 1.0 and 1.1, but they're disabled by default. Domain Services has removed the ability to disable **TLS 1.2 Only Mode**. Customers who disable **TLS 1.2 Only Mode** can enable it. 
 
You can use the Azure portal or PowerShell to enable **TLS 1.2 Only Mode**.
 
## Identify applications that use deprecated TLS versions
 
Before you enable **TLS 1.2 Only Mode**, it's important to identify applications that still use TLS 1.0 or 1.1, and update them or replace them with alternatives that support TLS 1.2. For more information about apps that are expected to be impacted, see [TLS 1.0 and TLS 1.1 deprecation in Windows](/windows/win32/secauthn/tls-10-11-deprecation-in-windows).
 
## [**Azure portal**](#tab/portal)
 

MODIFIED docs/identity/users/licensing-service-plan-reference.md

Modified by Nicholak-MS on Jul 14, 2025 6:33 PM
📖 View on learn.microsoft.com

+7 / -2 lines changed

Commit: Update licensing-service-plan-reference.md

Changes:

Before

After

ms.service: entra-id
ms.subservice: users
ms.topic: reference
ms.date: 07/11/2025
ms.author: nicholak
ms.reviewer: Nicholak-MS
ms.custom: it-pro
- **Service plans included (friendly names)**: A list of service plans (friendly names) in the product that correspond to the string ID and GUID
 
>[!NOTE]
>This information was last updated on July 11, 2025.<br/>You can also download a CSV version of this table [here](https://download.microsoft.com/download/e/3/e/e3e9faf2-f28b-490a-9ada-c6089a1fc5b0/Product%20names%20and%20service%20plan%20identifiers%20for%20licensing.csv).
><br/>
 
| Product name | String ID | GUID | Service plans included | Service plans included (friendly names) |
| Dynamics 365 for Case Management, Enterprise Edition for Government | D365_ENTERPRISE_CASE_MANAGEMENT_GOV | 5cd0b796-9ac8-4792-9f0b-796ca9044e4a | DYN365_ENTERPRISE_CASE_MANAGEMENT_GOV (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>EXCHANGE_S_FOUNDATION_GOV (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>SHAREPOINTWAC_GOV (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>PROJECT_ESSENTIALS_GOV (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SHAREPOINTENTERPRISE_GOV (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>FLOW_DYN_APPS_GOV (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>POWERAPPS_DYN_APPS_GOV (3089c02b-e533-4b73-96a5-01fa648c3c3c) |	Dynamics 365 for Case Management for Government (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>Exchange Foundation for Government (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>Office for the Web for Government (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>Project Online Essentials for Government (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SharePoint Plan 2G (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>Power Automate for Dynamics 365 for Government (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>PowerApps for Dynamics 365 for Government (3089c02b-e533-4b73-96a5-01fa648c3c3c) |
| Dynamics 365 for Case Management, Enterprise Edition for Government | DYN365_ENTERPRISE_CASE_MANAGEMENT_GOV |	ff5a82be-1edd-4d48-94e0-52527825b589 | DYN365_ENTERPRISE_CASE_MANAGEMENT_GOV (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>Power_Pages_Internal_User (60bf28f9-2b70-4522-96f7-335f5e06c941)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC_GOV (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>PROJECT_ESSENTIALS_GOV (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SHAREPOINTENTERPRISE_GOV (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>FLOW_DYN_APPS_GOV (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>POWERAPPS_DYN_APPS_GOV (3089c02b-e533-4b73-96a5-01fa648c3c3c) | Dynamics 365 for Case Management for Government (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>Power Pages Internal User (60bf28f9-2b70-4522-96f7-335f5e06c941)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web for Government (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>Project Online Essentials for Government (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SharePoint Plan 2G (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>Power Automate for Dynamics 365 for Government (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>PowerApps for Dynamics 365 for Government (3089c02b-e533-4b73-96a5-01fa648c3c3c) |
| Dynamics 365 Customer Service Enterprise Admin | Dynamics_365_Customer_Service_Enterprise_admin_trial | 94a6fbd4-6a2f-4990-b356-dc7dd8bed08a | CUSTOMER_VOICE_DYN365_VIRAL_TRIAL (dbe07046-af68-4861-a20d-1c8cbda9194f)<br/>DYN365_CS_MESSAGING_TPS (47c2b191-a5fb-4129-b690-00c474d2f623)<br/>D365_CSI_EMBED_CSEnterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>DYN365_ENTERPRISE_CUSTOMER_SERVICE (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>DYN365_CS_VOICE (f6ec6dfa-2402-468d-a455-89be11116d43)<br/>POWER_VIRTUAL_AGENTS_D365_CS_VOICE (a3dce1be-e9ca-453a-9483-e69a5b46ce98)<br/>POWER_VIRTUAL_AGENTS_D365_CS_MESSAGING (2d2f174c-c3cc-4abe-9ce8-4dd86f469ab1)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba) |	Customer Voice for Dynamics 365 vTrial (dbe07046-af68-4861-a20d-1c8cbda9194f)<br/>Dynamics 365 Customer Service Digital Messaging add-on (47c2b191-a5fb-4129-b690-00c474d2f623)<br/>Dynamics 365 Customer Service Insights for CS Enterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>Dynamics 365 for Customer Service (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Dynamics 365 for Customer Service Voice Add-in (f6ec6dfa-2402-468d-a455-89be11116d43)<br/>Power Virtual Agents for Customer Service Voice (a3dce1be-e9ca-453a-9483-e69a5b46ce98)<br/>Power Virtual Agents for Digital Messaging (2d2f174c-c3cc-4abe-9ce8-4dd86f469ab1)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba) |
| Dynamics 365 for Customer Service Enterprise Edition | DYN365_ENTERPRISE_CUSTOMER_SERVICE | 749742bf-0d37-4158-a120-33567104deeb | D365_CSI_EMBED_CSEnterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>DYN365_ENTERPRISE_CUSTOMER_SERVICE (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Forms_Pro_Service (67bf4812-f90b-4db9-97e7-c0bbbf7b2d09)<br/>NBENTERPRISE (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>PROJECT_ESSENTIALS (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SHAREPOINTENTERPRISE (5dbe027f-2339-4123-9542-606e4d348a72)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba) | Dynamics 365 Customer Service Insights for CS Enterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>Dynamics 365 for Customer Service (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Microsoft Dynamics 365 Customer Voice for Customer Service Enterprise (67bf4812-f90b-4db9-97e7-c0bbbf7b2d09)<br/>Microsoft Social Engagement (03acaee3-9492-4f40-aed4-bcb6b32981b6)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web (e95bec33-7c88-4a70-8e19-b10bd9d0c014)<br/>Project Online Essentials (1259157c-8581-4875-bca7-2ffb18c51bda)<br/>SharePoint (Plan 2) (5dbe027f-2339-4123-9542-606e4d348a72)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba) |
| Dynamics 365 for Customer Service, Enterprise Edition for Government | DYN365_ENTERPRISE_CUSTOMER_SERVICE_GOV | 3c74d823-8f01-4fe8-82d5-f089a5504cec |	DYN365_ENTERPRISE_CUSTOMER_SERVICE_GOV (dc6643d9-1e72-4dce-9f64-1d6eac1f1c5a)<br/>Forms_Pro_Service_GCC (bb681a9b-58f5-42ee-9926-674325be8aaa)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC_GOV (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>PROJECT_ESSENTIALS_GOV (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SHAREPOINTENTERPRISE_GOV (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>FLOW_DYN_APPS_GOV (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>POWERAPPS_DYN_APPS_GOV (3089c02b-e533-4b73-96a5-01fa648c3c3c) | Dynamics 365 for Customer Service for Government (dc6643d9-1e72-4dce-9f64-1d6eac1f1c5a)<br/>Microsoft Dynamics 365 Customer Voice for Customer Service Enterprise for GCC (bb681a9b-58f5-42ee-9926-674325be8aaa)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web for Government (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>Project Online Essentials for Government (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SharePoint Plan 2G (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>Power Automate for Dynamics 365 for Government (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>PowerApps for Dynamics 365 for Government (3089c02b-e533-4b73-96a5-01fa648c3c3c) |
| Dynamics 365 for Customer Service Enterprise for Government | D365_ENTERPRISE_CUSTOMER_SERVICE_GOV | 65758a5f-2e16-43b3-a8cb-296cd8f69e09 | DYN365_ENTERPRISE_CUSTOMER_SERVICE_GOV (dc6643d9-1e72-4dce-9f64-1d6eac1f1c5a)<br/>Forms_Pro_Service_GCC (bb681a9b-58f5-42ee-9926-674325be8aaa)<br/>Power_Pages_Internal_User (60bf28f9-2b70-4522-96f7-335f5e06c941)<br/>EXCHANGE_S_FOUNDATION_GOV (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>SHAREPOINTWAC_GOV (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>PROJECT_ESSENTIALS_GOV (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SHAREPOINTENTERPRISE_GOV (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>FLOW_DYN_APPS_GOV (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>POWERAPPS_DYN_APPS_GOV (3089c02b-e533-4b73-96a5-01fa648c3c3c) |	Dynamics 365 for Customer Service for Government (dc6643d9-1e72-4dce-9f64-1d6eac1f1c5a)<br/>Microsoft Dynamics 365 Customer Voice for Customer Service Enterprise for GCC (bb681a9b-58f5-42ee-9926-674325be8aaa)<br/>Power Pages Internal User (60bf28f9-2b70-4522-96f7-335f5e06c941)<br/>Exchange Foundation for Government (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>Office for the Web for Government (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>Project Online Essentials for Government (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SharePoint Plan 2G (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>Power Automate for Dynamics 365 for Government (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>PowerApps for Dynamics 365 for Government (3089c02b-e533-4b73-96a5-01fa648c3c3c) |

ms.service: entra-id
ms.subservice: users
ms.topic: reference
ms.date: 07/14/2025
ms.author: nicholak
ms.reviewer: Nicholak-MS
ms.custom: it-pro
- **Service plans included (friendly names)**: A list of service plans (friendly names) in the product that correspond to the string ID and GUID
 
>[!NOTE]
>This information was last updated on July 14, 2025.<br/>You can also download a CSV version of this table [here](https://download.microsoft.com/download/e/3/e/e3e9faf2-f28b-490a-9ada-c6089a1fc5b0/Product%20names%20and%20service%20plan%20identifiers%20for%20licensing.csv).
><br/>
 
| Product name | String ID | GUID | Service plans included | Service plans included (friendly names) |
| Dynamics 365 for Case Management, Enterprise Edition for Government | D365_ENTERPRISE_CASE_MANAGEMENT_GOV | 5cd0b796-9ac8-4792-9f0b-796ca9044e4a | DYN365_ENTERPRISE_CASE_MANAGEMENT_GOV (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>EXCHANGE_S_FOUNDATION_GOV (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>SHAREPOINTWAC_GOV (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>PROJECT_ESSENTIALS_GOV (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SHAREPOINTENTERPRISE_GOV (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>FLOW_DYN_APPS_GOV (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>POWERAPPS_DYN_APPS_GOV (3089c02b-e533-4b73-96a5-01fa648c3c3c) |	Dynamics 365 for Case Management for Government (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>Exchange Foundation for Government (922ba911-5694-4e99-a794-73aed9bfeec8)<br/>Office for the Web for Government (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>Project Online Essentials for Government (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SharePoint Plan 2G (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>Power Automate for Dynamics 365 for Government (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>PowerApps for Dynamics 365 for Government (3089c02b-e533-4b73-96a5-01fa648c3c3c) |
| Dynamics 365 for Case Management, Enterprise Edition for Government | DYN365_ENTERPRISE_CASE_MANAGEMENT_GOV |	ff5a82be-1edd-4d48-94e0-52527825b589 | DYN365_ENTERPRISE_CASE_MANAGEMENT_GOV (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>Power_Pages_Internal_User (60bf28f9-2b70-4522-96f7-335f5e06c941)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>SHAREPOINTWAC_GOV (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>PROJECT_ESSENTIALS_GOV (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SHAREPOINTENTERPRISE_GOV (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>FLOW_DYN_APPS_GOV (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>POWERAPPS_DYN_APPS_GOV (3089c02b-e533-4b73-96a5-01fa648c3c3c) | Dynamics 365 for Case Management for Government (79bb0a8d-e686-4e16-ac59-2b3fd0014a61)<br/>Power Pages Internal User (60bf28f9-2b70-4522-96f7-335f5e06c941)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Office for the Web for Government (8f9f0f3b-ca90-406c-a842-95579171f8ec)<br/>Project Online Essentials for Government (fdcb7064-f45c-46fa-b056-7e0e9fdf4bf3)<br/>SharePoint Plan 2G (153f85dd-d912-4762-af6c-d6e0fb4f6692)<br/>Power Automate for Dynamics 365 for Government (2c6af4f1-e7b6-4d59-bbc8-eaa884f42d69)<br/>PowerApps for Dynamics 365 for Government (3089c02b-e533-4b73-96a5-01fa648c3c3c) |
| Dynamics 365 Customer Service Enterprise Admin | Dynamics_365_Customer_Service_Enterprise_admin_trial | 94a6fbd4-6a2f-4990-b356-dc7dd8bed08a | CUSTOMER_VOICE_DYN365_VIRAL_TRIAL (dbe07046-af68-4861-a20d-1c8cbda9194f)<br/>DYN365_CS_MESSAGING_TPS (47c2b191-a5fb-4129-b690-00c474d2f623)<br/>D365_CSI_EMBED_CSEnterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>DYN365_ENTERPRISE_CUSTOMER_SERVICE (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>DYN365_CS_VOICE (f6ec6dfa-2402-468d-a455-89be11116d43)<br/>POWER_VIRTUAL_AGENTS_D365_CS_VOICE (a3dce1be-e9ca-453a-9483-e69a5b46ce98)<br/>POWER_VIRTUAL_AGENTS_D365_CS_MESSAGING (2d2f174c-c3cc-4abe-9ce8-4dd86f469ab1)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>POWERAPPS_DYN_APPS (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>FLOW_DYN_APPS (7e6d7d78-73de-46ba-83b1-6d25117334ba) |	Customer Voice for Dynamics 365 vTrial (dbe07046-af68-4861-a20d-1c8cbda9194f)<br/>Dynamics 365 Customer Service Digital Messaging add-on (47c2b191-a5fb-4129-b690-00c474d2f623)<br/>Dynamics 365 Customer Service Insights for CS Enterprise (5b1e5982-0e88-47bb-a95e-ae6085eda612)<br/>Dynamics 365 for Customer Service (99340b49-fb81-4b1e-976b-8f2ae8e9394f)<br/>Dynamics 365 for Customer Service Voice Add-in (f6ec6dfa-2402-468d-a455-89be11116d43)<br/>Power Virtual Agents for Customer Service Voice (a3dce1be-e9ca-453a-9483-e69a5b46ce98)<br/>Power Virtual Agents for Digital Messaging (2d2f174c-c3cc-4abe-9ce8-4dd86f469ab1)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318)<br/>Power Apps for Dynamics 365 (874fc546-6efe-4d22-90b8-5c4e7aa59f4b)<br/>Power Automate for Dynamics 365 (7e6d7d78-73de-46ba-83b1-6d25117334ba) |
| Dynamics 365 Customer Insights Attach | Dynamics_365_Customer_Insights_Attach_New | ff22b8d4-5073-4b24-ba45-84ad5d9b6642 | CDS_CUSTOMER_INSIGHTS_BASE (d04ca659-b119-4a92-b8fc-3ede584a9d65)<br/>CDS_CUSTOMER_INSIGHTS_COMBINED_BASE (d66ee5da-07d5-49d6-a1d8-45662c3f37be)<br/>DYN365_CUSTOMER_INSIGHTS_JOURNEYS_BASE (1720c3f7-7da3-4a11-8324-92aad283eb68)<br/>Forms_Pro_Marketing_App (22b657cf-0a9e-467b-8a91-5e31f21bc570)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318) | Dataverse for Cust Insights BASE (d04ca659-b119-4a92-b8fc-3ede584a9d65)<br/>Dataverse for Customer Insights Combined Base (d66ee5da-07d5-49d6-a1d8-45662c3f37be)<br/>Dynamics 365 Customer Insights Journeys (1720c3f7-7da3-4a11-8324-92aad283eb68)<br/>Microsoft Dynamics 365 Customer Voice for Marketing Application (22b657cf-0a9e-467b-8a91-5e31f21bc570)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318) |
| Dynamics 365 Customer Insights Journeys T3 Interacted People | Dynamics_365_Customer_Insights_Journeys_T3_Interacted_People |	05735051-46c0-4c84-9107-bb13d77d0b88 | CDS_CUSTOMER_INSIGHTS_JOURNEYS_ADD-ON (2f2e81a6-15de-4041-9f33-73c06fed3801)<br/>DYN365_MARKETING_50K_CONTACT_ADDON (e626a4ec-1ba2-409e-bf75-9bc0bc30cca7)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318) | Dataverse for Customer Insights Journeys add-on (2f2e81a6-15de-4041-9f33-73c06fed3801)<br/>Dynamics 365 for Marketing 50K Addnl Contacts (e626a4ec-1ba2-409e-bf75-9bc0bc30cca7)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318) |
| Dynamics 365 Customer Insights User License | Dynamics_365_Customer_Insights_User_License | 12b5a442-a6f2-49e4-868b-2d7408c2356f |	DYN365_MARKETING_MSE_USER (2824c69a-1ac5-4397-8592-eae51cb8b581)<br/>DYN365_MARKETING_USER (5d7a6abc-eebd-46ab-96e1-e4a2f54a2248)<br/>EXCHANGE_S_FOUNDATION (113feb6c-3fe4-4440-bddc-54d774bf0318) | Dynamics 365 for Marketing MSE User (2824c69a-1ac5-4397-8592-eae51cb8b581)<br/>Dynamics 365 for Marketing USL (5d7a6abc-eebd-46ab-96e1-e4a2f54a2248)<br/>Exchange Foundation (113feb6c-3fe4-4440-bddc-54d774bf0318) |

MODIFIED docs/includes/secure-recommendations/21772.md

Modified by jayrusso on Jul 15, 2025 12:33 AM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: July 14 added client secrets

Changes:

Before

After

---
title: Applications don't have secrets configured
ms.author: barclayn
author: barclayn
manager: pmwongera
ms.service: entra-id
ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# category: Application management
# risklevel: High

---
title: Applications don't have client secrets configured
ms.author: barclayn
author: barclayn
manager: pmwongera
ms.service: entra-id
ms.topic: include
ms.date: 07/14/2025
ms.custom: Identity-Secure-Recommendation
# category: Application management
# risklevel: High

MODIFIED docs/id-governance/complete-access-review.md

Modified by Ortagus Winfrey on Jul 14, 2025 6:34 PM
📖 View on learn.microsoft.com

+4 / -0 lines changed

Commit: Access Review notes

Changes:

Before

After

> - User not found / other errors can also result in an apply result not being supported.
> - Reviewing the members of mail enabled group: The group can't be managed in Microsoft Entra ID, so membership can't be changed.
> - Reviewing an Application that uses group assignment won't remove the members of those groups, so they'll retain the existing access from the group relationship for the application assignment
 
## Actions taken on denied guest users in an access review

> - User not found / other errors can also result in an apply result not being supported.
> - Reviewing the members of mail enabled group: The group can't be managed in Microsoft Entra ID, so membership can't be changed.
> - Reviewing an Application that uses group assignment won't remove the members of those groups, so they'll retain the existing access from the group relationship for the application assignment
 
 
> [!NOTE]
> Access review decisions do not change membership in dynamic groups. These groups are managed by rules-users remain members as long as they match the rule conditions.
 
## Actions taken on denied guest users in an access review
 

MODIFIED docs/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review.md

Modified by Ortagus Winfrey on Jul 14, 2025 6:44 PM
📖 View on learn.microsoft.com

+3 / -0 lines changed

Commit: Access Review Note in PIM

Changes:

Before

After

 
    :::image type="content" source="./media/pim-create-azure-ad-roles-and-resource-roles-review/current-v-series-setting.png" alt-text="Screenshot of the settings page under access reviews." lightbox="./media/pim-create-azure-ad-roles-and-resource-roles-review/current-v-series-setting.png":::
    
## Next steps
 
- [Perform an access review of Azure resource and Microsoft Entra roles in PIM](./pim-perform-roles-and-resource-roles-review.md)

 
    :::image type="content" source="./media/pim-create-azure-ad-roles-and-resource-roles-review/current-v-series-setting.png" alt-text="Screenshot of the settings page under access reviews." lightbox="./media/pim-create-azure-ad-roles-and-resource-roles-review/current-v-series-setting.png":::
    
> [!NOTE]
> Creating Access Reviews for Azure resources using AOBO (Admin On Behalf Of) under the Azure Plan is not supported. If you're a CSP partner managing a customer's subscription via AOBO, you cannot create Access Reviews from your own (partner) tenant.<br>**Workaround**:<br> Have the CSP partner added as a **guest user** in the customer's tenant with the necessary permissions, and create the Access Review **from within the customer's tenant**.
 
## Next steps
 
- [Perform an access review of Azure resource and Microsoft Entra roles in PIM](./pim-perform-roles-and-resource-roles-review.md)

MODIFIED docs/includes/secure-recommendations/21869.md

Modified by Dennis Rea on Jul 14, 2025 8:28 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Acrolinx fixes

Changes:

Before

After

---
When enterprise applications lack both explicit assignment requirements AND scoped provisioning controls, threat actors can exploit this dual weakness to gain unauthorized access to sensitive applications and data. The highest risk occurs when applications are configured with the default setting: "Assignment required" is set to "No" *and* provisioning isn't required or scoped. This dangerous combination allows threat actors who compromise any user account within the tenant to immediately access applications with broad user bases, expanding their attack surface and potential for lateral movement within the organization.
 
While an application with open assignment but proper provisioning scoping (such as department-based filters or group membership requirements) maintains security controls through the provisioning layer, applications lacking both controls create unrestricted access pathways that threat actors can exploit. When applications provision accounts for all users without assignment restrictions, threat actors can abuse compromised accounts to conduct reconnaissance activities, enumerate sensitive data across multiple systems, or use the applications as staging points for further attacks against connected resources. This unrestricted access model is dangerous for applications with elevated permissions or are connected to critical business systems. Threat actors can use any compromised user account to access sensitive information, modify data, or perform unauthorized actions that the application's permissions allow. The absence of both assignment controls and provisioning scoping also prevents organizations from implementing proper access governance. Without proper governance, it's difficult to track who has access to which applications, when access was granted, and whether access should be revoked based on role changes or employment status. Furthermore, applications with broad provisioning scopes can create cascading security risks where a single compromised account provides access to an entire ecosystem of connected applications and services.
 
**Remediation action**
- Evaluate business requirements to determine appropriate access control method. [Restrict a Microsoft Entra app to a set of users](../../identity-platform/howto-restrict-your-app-to-a-set-of-users.md).

---
When enterprise applications lack both explicit assignment requirements AND scoped provisioning controls, threat actors can exploit this dual weakness to gain unauthorized access to sensitive applications and data. The highest risk occurs when applications are configured with the default setting: "Assignment required" is set to "No" *and* provisioning isn't required or scoped. This dangerous combination allows threat actors who compromise any user account within the tenant to immediately access applications with broad user bases, expanding their attack surface and potential for lateral movement within the organization.
 
While an application with open assignment but proper provisioning scoping (such as department-based filters or group membership requirements) maintains security controls through the provisioning layer, applications lacking both controls create unrestricted access pathways that threat actors can exploit. When applications provision accounts for all users without assignment restrictions, threat actors can abuse compromised accounts to conduct reconnaissance activities, enumerate sensitive data across multiple systems, or use the applications as staging points for further attacks against connected resources. This unrestricted access model is dangerous for applications that have elevated permissions or are connected to critical business systems. Threat actors can use any compromised user account to access sensitive information, modify data, or perform unauthorized actions that the application's permissions allow. The absence of both assignment controls and provisioning scoping also prevents organizations from implementing proper access governance. Without proper governance, it's difficult to track who has access to which applications, when access was granted, and whether access should be revoked based on role changes or employment status. Furthermore, applications with broad provisioning scopes can create cascading security risks where a single compromised account provides access to an entire ecosystem of connected applications and services.
 
**Remediation action**
- Evaluate business requirements to determine appropriate access control method. [Restrict a Microsoft Entra app to a set of users](../../identity-platform/howto-restrict-your-app-to-a-set-of-users.md).

MODIFIED docs/identity/conditional-access/agent-optimization.md

Modified by shlipsey3 on Jul 14, 2025 3:27 PM
📖 View on learn.microsoft.com

+0 / -2 lines changed

Commit: pm-update

Changes:

Before

After

 
The Security Administrator and Global Administrator roles have access to Security Copilot by default. You can assign Conditional Access Administrators with Security Copilot access. This authorization gives your Conditional Access Administrators the ability to use the agent as well. For more information, see [Assign Security Copilot access](/copilot/security/authentication#assign-security-copilot-access).
 
The user who approves a suggestion to add users to a policy becomes an owner of the group the user is added to.
 
The user who approves a suggestion to add users to a policy becomes an owner of the group for adding users to a policy.
 
### Custom instructions

 
The Security Administrator and Global Administrator roles have access to Security Copilot by default. You can assign Conditional Access Administrators with Security Copilot access. This authorization gives your Conditional Access Administrators the ability to use the agent as well. For more information, see [Assign Security Copilot access](/copilot/security/authentication#assign-security-copilot-access).
 
The user who approves a suggestion to add users to a policy becomes an owner of the group for adding users to a policy.
 
### Custom instructions

MODIFIED docs/identity/authentication/how-to-enable-passkey-fido2.md

Modified by Tracey Torble on Jul 14, 2025 8:21 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update docs/identity/authentication/how-to-enable-passkey-fido2.md

Changes:

Before

After

     - Metadata for FIDO2 security keys needs to be published and verified with the FIDO Alliance Metadata Service, and also pass another set of validation testing by Microsoft. For more information, see [Become a Microsoft-compatible FIDO2 security key vendor](/entra/identity/authentication/concept-fido2-hardware-vendor).
     - Passkeys in Microsoft Authenticator also support attestation. For more information, see [How passkey attestation works with Authenticator](concept-authentication-authenticator-app.md#how-passkey-attestation-works-with-authenticator).
 
     >[!WARNINGS]
     >- If you set **Enforce attestation** to **No**, users can register any type of passkey. Set **Enforce attestation** to **Yes** to ensure that users can only register device-bound passkeys.
     >
     >- Attestation enforcement governs whether a passkey (FIDO2) is allowed only during registration. Users who register a passkey (FIDO2) without attestation aren't blocked from sign-in if **Enforce attestation** is set to **Yes** later.

     - Metadata for FIDO2 security keys needs to be published and verified with the FIDO Alliance Metadata Service, and also pass another set of validation testing by Microsoft. For more information, see [Become a Microsoft-compatible FIDO2 security key vendor](/entra/identity/authentication/concept-fido2-hardware-vendor).
     - Passkeys in Microsoft Authenticator also support attestation. For more information, see [How passkey attestation works with Authenticator](concept-authentication-authenticator-app.md#how-passkey-attestation-works-with-authenticator).
 
     >[!WARNING]
     >- If you set **Enforce attestation** to **No**, users can register any type of passkey. Set **Enforce attestation** to **Yes** to ensure that users can only register device-bound passkeys.
     >
     >- Attestation enforcement governs whether a passkey (FIDO2) is allowed only during registration. Users who register a passkey (FIDO2) without attestation aren't blocked from sign-in if **Enforce attestation** is set to **Yes** later.

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files