MODIFIED docs/identity/app-provisioning/index-employeeid-attribute-entra-id-to-active-directory.md

Modified by jenniferf-skc on Jul 24, 2025 5:27 PM
📖 View on learn.microsoft.com

+12 / -12 lines changed

Commit: Final updates

Changes:

Before

After

---
title: Index the employeeId attribute for Microsoft Inbound Provisioning to Active Directory
description: Learn how to get index the employeeId attribute to automate user account creation and updates from Inbound Provisioning to Active Directory
 
author: jenniferf-skc
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: how-to
ms.date: 07/23/2025
ms.author: jfields
ms.reviewer: cmmdesai
 
#customer intent: As a customer, I want to ensure efficient automation of user account creation and updates from Microsoft Inbound Provisioning to on-premises Active Directory.
---
 
# Index the 'employeeId' Attribute for Microsoft Entra Inbound Provisioning to Active Directory
 
Microsoft Entra inbound provisioning allows organizations to automate user account creation and updates in on-premises Active Directory (AD) environments from sources such as Workday, SuccessFactors, or API-driven integrations. To ensure smooth and efficient synchronization, it's important to understand the role of attribute indexing—particularly the `employeeId` attribute, which is used as the default matching property during provisioning. This article provides guidance for optimizing synchronization performance with the `employeeId` attribute.
 
## Why Indexing employeeId Is Needed

---
title: Index the employeeId attribute in Active Directory to improve provisioning performance
description: Learn how to get index the employeeId attribute to automate user account creation and updates from Inbound Provisioning to Active Directory
 
author: jenniferf-skc
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: how-to
ms.date: 07/24/2025
ms.author: jfields
ms.reviewer: cmmdesai
 
#customer intent: As a customer, I want to ensure efficient automation of user account creation and updates from Microsoft Inbound Provisioning to on-premises Active Directory.
---
 
# Index the employeeId attribute in Active Directory to improve provisioning performance
 
Microsoft Entra inbound provisioning allows organizations to automate user account creation and updates in on-premises Active Directory (AD) environments from sources such as Workday, SuccessFactors, or API-driven integrations. To ensure smooth and efficient synchronization, it's important to understand the role of attribute indexing—particularly the `employeeId` attribute, which is used as the default matching property during provisioning. This article provides guidance for optimizing synchronization performance with the `employeeId` attribute.
 
## Why indexing employeeId is needed

MODIFIED docs/identity-platform/ios-qr-code-pin-authentication.md

Modified by Justinha on Jul 24, 2025 6:56 PM
📖 View on learn.microsoft.com

+19 / -2 lines changed

Commit: added how to suppress camera consent

Changes:

Before

After

ms.service: msal
ms.subservice: msal-ios-mac
ms.topic: concept-article
ms.date: 02/05/2025
ms.reviewer: akgoel
 
#Customer intent: As a developer, I want to learn how to configure your iOS app to have optimized QR code authentication experience using the Microsoft Authentication Library for iOS and macOS. 
 
It's advised to call the `getDeviceInformationWithParameters` API in MSAL to find out if the admin has configured QR code authentication method. If it has, an app can update its UI to indicate that QR code authentication method is available as a sign-in option.
 
## Related content
 
- [Set up QR code authentication in Android app](android-qr-code-pin-authentication.md)
- [Authentication methods in Microsoft Entra ID - QR code authentication method (Preview)](/entra/identity/authentication/how-to-authentication-qr-code)

ms.service: msal
ms.subservice: msal-ios-mac
ms.topic: concept-article
ms.date: 07/24/2025
ms.reviewer: akgoel
 
#Customer intent: As a developer, I want to learn how to configure your iOS app to have optimized QR code authentication experience using the Microsoft Authentication Library for iOS and macOS. 
 
It's advised to call the `getDeviceInformationWithParameters` API in MSAL to find out if the admin has configured QR code authentication method. If it has, an app can update its UI to indicate that QR code authentication method is available as a sign-in option.
 
## Suppress camera consent prompt
 
By default, QR code authentication prompts users for camera permission every time they need to use the camera to scan a QR code. 
 
:::image type="content" border="true" source="./media/ios-qr-code-pin-authentication/allow-camera.png" alt-text="Screenshot of a how to allow camera access on iOS.":::
 
Administrators can suppress this behavior and skip the request for camera permission. The request is configured by setting the following SSO extension configuration:
 
**Key**: suppress_camera_consent
**Type**: Integer 

MODIFIED docs/identity/conditional-access/agent-optimization-review-suggestions.md

Modified by shlipsey3 on Jul 24, 2025 6:19 PM
📖 View on learn.microsoft.com

+7 / -4 lines changed

Commit: ca-agent-072425

Changes:

Before

After

author: shlipsey3
ms.reviewer: lhuangnorth
manager: pmwongera
ms.date: 07/21/2025
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: how-to
 
Adjust the filters and the display as needed. Select a point on the graph to see a sample of the data that the policy affects. For example, for a policy to require multifactor authentication (MFA), the graph shows a sample of sign-in events where the Conditional Access policy wasn't applied. For more information, see [Policy impact](concept-conditional-access-report-only.md#reviewing-results).
 
### View agent's full activity
 
To see a detailed summary of the agent's activity and how it calculated the suggestion, select **View agent's full activity**.
 
:::image type="content" source="media/agent-optimization-review-suggestions/view-agent-activity-link.png" alt-text="Screenshot of the policy suggestion details with the view agent's full activity link highlighted." lightbox="media/agent-optimization-review-suggestions/view-agent-activity-link.png":::
 
 
If the agent suggests modifying an existing policy, select **Review policy changes** to see the details of the recommended change. This page lists the users, target resources, and other details of the policy that will change if you apply the suggestion.
 
:::image type="content" source="media/agent-optimization-review-suggestions/review-policy-changes.png" alt-text="Screenshot of the policy details page with the review policy changes button highlighted." lightbox="media/agent-optimization-review-suggestions/review-policy-changes.png":::

author: shlipsey3
ms.reviewer: lhuangnorth
manager: pmwongera
ms.date: 07/24/2025
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: how-to
 
Adjust the filters and the display as needed. Select a point on the graph to see a sample of the data that the policy affects. For example, for a policy to require multifactor authentication (MFA), the graph shows a sample of sign-in events where the Conditional Access policy wasn't applied. For more information, see [Policy impact](concept-conditional-access-report-only.md#reviewing-results).
 
:::image type="content" source="media/agent-optimization-review-suggestions/policy-impact-graph.png" alt-text="Screenshot of the policy impact graph." lightbox="media/agent-optimization-review-suggestions/policy-impact-graph.png":::
 
### View agent's full activity
 
To see a detailed summary of the agent's activity and how it calculated the suggestion, select **View agent's full activity**. The agent's activity assesses policy drift, or gaps in policy coverage, for users and apps. The agent also looks for policies that can be merged or consolidated.
 
:::image type="content" source="media/agent-optimization-review-suggestions/view-agent-activity-link.png" alt-text="Screenshot of the policy suggestion details with the view agent's full activity link highlighted." lightbox="media/agent-optimization-review-suggestions/view-agent-activity-link.png":::
 
 
If the agent suggests modifying an existing policy, select **Review policy changes** to see the details of the recommended change. This page lists the users, target resources, and other details of the policy that will change if you apply the suggestion.

MODIFIED docs/identity/app-provisioning/inbound-provisioning-api-concepts.md

Modified by jenniferf-skc on Jul 24, 2025 7:57 PM
📖 View on learn.microsoft.com

+6 / -4 lines changed

Commit: Additional PM updates

Changes:

Before

After

ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: reference
ms.date: 07/07/2025
ms.author: jfields
ms.reviewer: chmutali
---
- Tenant admins must grant API clients interacting with this provisioning app the Graph permissions `SynchronizationData-User.Upload`, `SynchronizationData-User.Upload.OwnedBy` (for ISVs), and `ProvisioningLog.Read.All`. 
- The Graph API endpoint accepts valid bulk request payloads using SCIM schema constructs.
- With SCIM schema extensions, you can send any attribute in the bulk request payload. 
- The rate limit for the inbound provisioning API is 40 bulk upload requests per second. Each bulk request can contain a maximum of 50 user records, thereby supporting an upload rate of 2000 records per second. 
- Each API endpoint is associated with a specific provisioning app in Microsoft Entra ID. You can integrate multiple data sources by creating a provisioning app for each data source. 
- Incoming bulk request payloads are processed in near real-time.
- Admins can check provisioning progress by viewing the [provisioning logs](~/identity/monitoring-health/concept-provisioning-logs.md). 
| *The resulting user is first created in...* | Microsoft Entra ID | On-premises Active Directory or Microsoft Entra ID | Microsoft Entra ID | Microsoft Entra ID |
| *The resulting user authenticates to...* | Microsoft Entra ID, with the password you supply | On-premises Active Directory of Microsoft Entra ID, with a [Temporary Access Pass provided by Entra Lifecycle workflows](https://go.microsoft.com/fwlink/?linkid=2261542) | Home tenant or other identity provider | Home tenant or other identity provider | 
| *Subsequent updates to the user can be done via* | Graph API or Microsoft Entra admin center | Graph API or HR inbound bulk API or Microsoft Entra admin center | Graph API or Microsoft Entra admin center | Graph API or Microsoft Entra admin center |
| *The lifecycle of user when their employment starts, is determined by...* | Manual processes | [Entra onboarding Lifecycle workflows](~/id-governance/tutorial-onboard-custom-workflow-portal.md) that trigger based on the ```employeeHireDate``` attribute | Entitlement management | [Automatic assignment](~/id-governance/entitlement-management-access-package-auto-assignment-policy.md) using Entitlement management access packages |
| *The lifecycle of user when their employment is terminated is determined by...* | Manual processes | [Entra offboarding lifecycle workflows](~/id-governance/tutorial-scheduled-leaver-portal.md) that trigger based on the ```employeeLeaveDateTime``` attribute | Access reviews | Entitlement management when the user loses their last access package assignment, they're removed |
 

ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: reference
ms.date: 07/24/2025
ms.author: jfields
ms.reviewer: chmutali
---
- Tenant admins must grant API clients interacting with this provisioning app the Graph permissions `SynchronizationData-User.Upload`, `SynchronizationData-User.Upload.OwnedBy` (for ISVs), and `ProvisioningLog.Read.All`. 
- The Graph API endpoint accepts valid bulk request payloads using SCIM schema constructs.
- With SCIM schema extensions, you can send any attribute in the bulk request payload. 
- The bulkUpload API endpoint enforces the following throttling limits:
    - There is a limit of 40 API calls within any 5-second window. If this threshold is exceeded, the service returns an HTTP 429 (Too Many Requests) response. To avoid throttling, implement pacing logic in the client to space out requests - such as adding delays or rate-limit handling between submissions.
    - There is a tenant-level limit of 2,000 API calls per 24-hour period under the Entra ID P1/P2 license, and 6,000 API calls under the Entra ID Governance license. Exceeding these limits results in an HTTP 429 (Too Many Requests) response. To stay within the quota, ensure that your SCIM bulk payloads are optimized to include up to 50 operations per API call.
- Each API endpoint is associated with a specific provisioning app in Microsoft Entra ID. You can integrate multiple data sources by creating a provisioning app for each data source. 
- Incoming bulk request payloads are processed in near real-time.
- Admins can check provisioning progress by viewing the [provisioning logs](~/identity/monitoring-health/concept-provisioning-logs.md). 
| *The resulting user is first created in...* | Microsoft Entra ID | On-premises Active Directory or Microsoft Entra ID | Microsoft Entra ID | Microsoft Entra ID |
| *The resulting user authenticates to...* | Microsoft Entra ID, with the password you supply | On-premises Active Directory of Microsoft Entra ID, with a [Temporary Access Pass provided by Entra Lifecycle workflows](https://go.microsoft.com/fwlink/?linkid=2261542) | Home tenant or other identity provider | Home tenant or other identity provider | 
| *Subsequent updates to the user can be done via* | Graph API or Microsoft Entra admin center | Graph API or HR inbound bulk API or Microsoft Entra admin center | Graph API or Microsoft Entra admin center | Graph API or Microsoft Entra admin center |
| *The lifecycle of user when their employment starts, is determined by...* | Manual processes | [Entra onboarding Lifecycle workflows](~/id-governance/tutorial-onboard-custom-workflow-portal.md) that trigger based on the `employeeHireDate` attribute | Entitlement management | [Automatic assignment](~/id-governance/entitlement-management-access-package-auto-assignment-policy.md) using Entitlement management access packages |

MODIFIED docs/identity/app-provisioning/inbound-provisioning-api-grant-access.md

Modified by jenniferf-skc on Jul 24, 2025 7:57 PM
📖 View on learn.microsoft.com

+5 / -3 lines changed

Commit: Additional PM updates

Changes:

Before

After

ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: how-to
ms.date: 07/07/2025
ms.author: jfields
ms.reviewer: cmmdesai
---
1. From the context menu **API permissions**, select the option **Add a permission**. 
1. Under **Request API permissions**, select **Microsoft Graph**. 
1. Select **Application permissions**.
1. Search and select permission **AuditLog.Read.All**, **ProvisioningLog.Read.All**, **SynchronizationData-User.Upload**, and **SyncrhonizationData-User.Upload.OwnedBy** (for ISVs).
1. Click on **Grant admin consent** on the next screen to complete the permission assignment. Click Yes on the confirmation dialog. Your app should have the following permission sets.
      [![Screenshot of app permissions.](media/inbound-provisioning-api-grant-access/api-client-permissions.png)](media/inbound-provisioning-api-grant-access/api-client-permissions.png#lightbox)  
1. You're now ready to use the service principal with your API client.
      $managedID = Get-MgServicePrincipal -Filter "DisplayName eq 'CSV2SCIMBulkUpload'"
      New-MgServicePrincipalAppRoleAssignment -PrincipalId $managedID.Id -ServicePrincipalId $managedID.Id -ResourceId $graphApp.Id -AppRoleId $AppRole.Id
 
      $PermissionName = "AuditLog.Read.All"
      $AppRole = $graphApp.AppRoles | `
      Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"}

ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: how-to
ms.date: 07/24/2025
ms.author: jfields
ms.reviewer: cmmdesai
---
1. From the context menu **API permissions**, select the option **Add a permission**. 
1. Under **Request API permissions**, select **Microsoft Graph**. 
1. Select **Application permissions**.
1. Search and select permission **ProvisioningLog.Read.All** and **SynchronizationData-User.Upload**.
    > [!NOTE] 
    > If you're configuring the service principal for use by an HR ISV that will instantiate the API-driven provisioning app in your tenant, consider granting the `Application.ReadWrite.OwnedBy` and `SynchronizationData-User.Upload.OwnedBy` application permissions. This ensures that the ISV can only upload data to the `/bulkUpload` API endpoint associated with the app it creates.
1. Click on **Grant admin consent** on the next screen to complete the permission assignment. Click Yes on the confirmation dialog. Your app should have the following permission sets.
      [![Screenshot of app permissions.](media/inbound-provisioning-api-grant-access/api-client-permissions.png)](media/inbound-provisioning-api-grant-access/api-client-permissions.png#lightbox)  
1. You're now ready to use the service principal with your API client.
      $managedID = Get-MgServicePrincipal -Filter "DisplayName eq 'CSV2SCIMBulkUpload'"
      New-MgServicePrincipalAppRoleAssignment -PrincipalId $managedID.Id -ServicePrincipalId $managedID.Id -ResourceId $graphApp.Id -AppRoleId $AppRole.Id
 
      $PermissionName = "ProvisioningLog.Read.All"

MODIFIED docs/identity/conditional-access/agent-optimization.md

Modified by shlipsey3 on Jul 24, 2025 6:19 PM
📖 View on learn.microsoft.com

+5 / -1 lines changed

Commit: ca-agent-072425

Changes:

Before

After

author: MicrosoftGuyJFlo
ms.reviewer: lhuangnorth
manager: dougeby
ms.date: 07/21/2025
 
ms.service: entra-id
ms.subservice: conditional-access
- From **Agents** > **Conditional Access optimization agent** > **Settings**.
- From **Conditional Access** > select the **Conditional Access optimization agent** card under **Policy summary** > **Settings**.
 
### Trigger
 
The agent is configured to run every 24 hours based on when it's initially configured. You can run it at a specific time by toggling the **Trigger** setting off and then back on when you want it to run.

author: MicrosoftGuyJFlo
ms.reviewer: lhuangnorth
manager: dougeby
ms.date: 07/24/2025
 
ms.service: entra-id
ms.subservice: conditional-access
- From **Agents** > **Conditional Access optimization agent** > **Settings**.
- From **Conditional Access** > select the **Conditional Access optimization agent** card under **Policy summary** > **Settings**.
 
## Agent capabilities
 
By default, the Conditional Access optimization agent can create new policies *in report-only mode*. You can change this setting so that an administrator must approve the new policy before it's created. The policy is still created in report-only mode, but only after admin approval. After reviewing the policy impact, you can turn on the policy directly from the agent experience or from Conditional Access.
 
### Trigger
 
The agent is configured to run every 24 hours based on when it's initially configured. You can run it at a specific time by toggling the **Trigger** setting off and then back on when you want it to run.

MODIFIED docs/identity/app-provisioning/plan-cloud-hr-provision.md

Modified by jenniferf-skc on Jul 24, 2025 5:27 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Final updates

Changes:

Before

After

description: This article describes the deployment process of integrating cloud HR systems, such as Workday and SuccessFactors, with Microsoft Entra ID. Integrating Microsoft Entra ID with your cloud HR system results in a complete identity lifecycle management system.
 
author: jenniferf-skc
manager: femila
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: conceptual
ms.date: 03/04/2025
ms.author: jfields
ms.reviewer: arvinh
---
 
To ensure the right HR records are mapped to users in Microsoft Entra ID (Entra ID)/ on-premises Active Directory (AD), work with your HR and IT teams to ensure data consistency and plan for any data cleansing tasks. Here is a list of best practices to get started.  
 
1. **Matching identifier presence and uniqueness:** The provisioning service uses a matching attribute to uniquely identify and link user records in your HR system with corresponding user accounts in AD / Entra ID. The default matching attribute is based on Employee ID. Ensure that the value of employee ID is populated in Entra ID (for cloud-only users) and on-premises AD (for hybrid users) before initiating full sync and it uniquely identifies a user.  
 
2. **Use scoping filters to skip HR records that are no longer relevant:** HR systems have several years of employment data probably going all the way back to 1970s. On the other hand, your IT team may only be interested in the list of currently active employees and termination records that come through after go-live. To filter out HR records that are no longer relevant from your IT team perspective, work with your HR team to add flags on the HR record that can be used in the Microsoft Entra provisioning scoping filters.  
 

description: This article describes the deployment process of integrating cloud HR systems, such as Workday and SuccessFactors, with Microsoft Entra ID. Integrating Microsoft Entra ID with your cloud HR system results in a complete identity lifecycle management system.
 
author: jenniferf-skc
manager: pmwongera
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: conceptual
ms.date: 07/24/2025
ms.author: jfields
ms.reviewer: arvinh
---
 
To ensure the right HR records are mapped to users in Microsoft Entra ID (Entra ID)/ on-premises Active Directory (AD), work with your HR and IT teams to ensure data consistency and plan for any data cleansing tasks. Here is a list of best practices to get started.  
 
1. **Matching identifier presence and uniqueness:** The provisioning service uses a matching attribute to uniquely identify and link user records in your HR system with corresponding user accounts in AD / Entra ID. The default matching attribute is based on Employee ID. Ensure that the value of employee ID is populated in Entra ID (for cloud-only users) and on-premises AD (for hybrid users) before initiating full sync and it uniquely identifies a user. [Index the employeeId attribute](./index-employeeid-attribute-entra-id-to-active-directory.md) in Active Directory before initiating full sync. 
 
2. **Use scoping filters to skip HR records that are no longer relevant:** HR systems have several years of employment data probably going all the way back to 1970s. On the other hand, your IT team may only be interested in the list of currently active employees and termination records that come through after go-live. To filter out HR records that are no longer relevant from your IT team perspective, work with your HR team to add flags on the HR record that can be used in the Microsoft Entra provisioning scoping filters.  
 

MODIFIED docs/identity/conditional-access/policy-all-users-approved-app-or-app-protection.md

Modified by John Flores on Jul 24, 2025 8:25 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: [BULK] Update manager name

Changes:

Before

After

---
title: Conditional Access - Require approved app or app protection policy
description: Create a custom Conditional Access policy require approved app or app protection policy
author: MicrosoftGuyJFlo
ms.author: joflore
manager: femila
ms.reviewer: lhuangnorth
ms.date: 04/01/2025
ms.service: entra-id

---
title: Conditional Access - Require approved app or app protection policy
description: Create a custom Conditional Access policy require approved app or app protection policy
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: lhuangnorth
ms.date: 04/01/2025
ms.service: entra-id

MODIFIED docs/identity/conditional-access/policy-block-by-location.md

Modified by John Flores on Jul 24, 2025 8:25 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: [BULK] Update manager name

Changes:

Before

After

---
title: Conditional Access - Block access by location
description: Create a custom Conditional Access policy to block access to resources by IP location.
author: MicrosoftGuyJFlo
ms.author: joflore
manager: femila
ms.reviewer: lhuangnorth
ms.date: 04/01/2025
ms.service: entra-id

---
title: Conditional Access - Block access by location
description: Create a custom Conditional Access policy to block access to resources by IP location.
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: lhuangnorth
ms.date: 04/01/2025
ms.service: entra-id

MODIFIED docs/identity/authentication/concept-authentication-qr-code.md

Modified by Justinha on Jul 24, 2025 7:28 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: added how to suppress camera consent request

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 06/24/2025
 
ms.author: justinha
author: aanjusingh
 
You can optimize sign-in for your apps by using Microsoft Authentication Library (MSAL) to add QR code as an option on the sign-in page. Then users can scan the QR code with two fewer clicks. This optimized sign-in experience is available in BlueFletch and Jamf app launchers.
 
For more information about how to optimize the sign-in experience, see: 
 
- [Set up optimized QR code authentication experience in Android app](~/identity-platform/android-qr-code-pin-authentication.md) 
- [Set up optimized QR code authentication experience in iOS app](~/identity-platform/ios-qr-code-pin-authentication.md)

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 07/24/2025
 
ms.author: justinha
author: aanjusingh
 
You can optimize sign-in for your apps by using Microsoft Authentication Library (MSAL) to add QR code as an option on the sign-in page. Then users can scan the QR code with two fewer clicks. This optimized sign-in experience is available in BlueFletch and Jamf app launchers.
 
For more information about how to optimize the sign-in experience or suppress camera consent prompt, see: 
 
- [Set up optimized QR code authentication experience in Android app](~/identity-platform/android-qr-code-pin-authentication.md) 
- [Set up optimized QR code authentication experience in iOS app](~/identity-platform/ios-qr-code-pin-authentication.md)

MODIFIED docs/identity-platform/scopes-oidc.md

Modified by Erin Greenlee on Jul 24, 2025 5:32 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update scopes-oidc.md

Changes:

Before

After

author: omondiatieno
manager: CelesteDG
ms.author: jomondi
ms.date: 01/03/2025
ms.reviewer: jawoods, ludwignick, phsignor
ms.service: identity-platform
ms.topic: concept-article
 
The [`offline_access` scope](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess) gives your app access to resources on behalf of the user for an extended time. On the consent page, this scope appears as the **Maintain access to data you have given it access to** permission.
 
If any of the requested delegated permissions from the `scope` parameter (excluding `openid`, `profile`, `email`) are granted, this is sufficient for the app to request a refresh token using `offline_access`. For example, if `User.Read` for Microsoft is granted, the app will only receive an access token. That said, if the app were to subsequently request a refresh token, the fact that `User.Read` had been granted is sufficient for a refresh token to be provided. Refresh tokens are long-lived. Your app can get new access tokens as older ones expire.
 
> [!NOTE]
> This permission currently appears on all consent pages, even for flows that don't provide a refresh token (such as the [implicit flow](v2-oauth2-implicit-grant-flow.md)). This setup addresses scenarios where a client can begin within the implicit flow and then move to the code flow where a refresh token is expected.

author: omondiatieno
manager: CelesteDG
ms.author: jomondi
ms.date: 07/24/2025
ms.reviewer: jawoods, ludwignick, phsignor
ms.service: identity-platform
ms.topic: concept-article
 
The [`offline_access` scope](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess) gives your app access to resources on behalf of the user for an extended time. On the consent page, this scope appears as the **Maintain access to data you have given it access to** permission.
 
If any delegated permission is granted, offline_access is implicitly granted. You can assume that the application has offline_access if there are any delegated permissions granted. Refresh tokens are long-lived. Your app can get new access tokens as older ones expire.
 
> [!NOTE]
> This permission currently appears on all consent pages, even for flows that don't provide a refresh token (such as the [implicit flow](v2-oauth2-implicit-grant-flow.md)). This setup addresses scenarios where a client can begin within the implicit flow and then move to the code flow where a refresh token is expected.

MODIFIED docs/architecture/backup-authentication-system-apps.md

Modified by John Flores on Jul 24, 2025 8:25 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: [BULK] Update manager name

Changes:

Before

After

ms.date: 07/22/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: femila
ms.reviewer: joroja
ms.custom:
  - sfi-ropc-nochange

ms.date: 07/22/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: joroja
ms.custom:
  - sfi-ropc-nochange

MODIFIED docs/architecture/backup-authentication-system.md

Modified by John Flores on Jul 24, 2025 8:25 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: [BULK] Update manager name

Changes:

Before

After

ms.date: 07/22/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: femila
ms.reviewer: joroja
ms.custom:
  - ai-gen-docs-bap

ms.date: 07/22/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: joroja
ms.custom:
  - ai-gen-docs-bap

MODIFIED docs/fundamentals/concept-secure-remote-workers.md

Modified by John Flores on Jul 24, 2025 8:25 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: [BULK] Update manager name

Changes:

Before

After

ms.date: 07/21/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: femila
ms.reviewer: lhuangnorth, martinco
ms.custom:
  - zt-include

ms.date: 07/21/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: lhuangnorth, martinco
ms.custom:
  - zt-include

MODIFIED docs/fundamentals/security-defaults.md

Modified by John Flores on Jul 24, 2025 8:25 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: [BULK] Update manager name

Changes:

Before

After

ms.date: 07/21/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: femila
ms.reviewer: sama
ms.custom:
  - sfi-ga-nochange, sfi-image-nochange

ms.date: 07/21/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: sama
ms.custom:
  - sfi-ga-nochange, sfi-image-nochange

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files