📋 Microsoft Entra Documentation Changes

Daily summary for changes since July 27th 2025, 8:53 PM PDT

Report generated on July 28th 2025, 8:53 PM PDT

📊 Summary

17
Total Commits
0
New Files
3
Modified Files
0
Deleted Files
8
Contributors

📝 Modified Documentation Files

Modified by Alexander Filipin on Jul 28, 2025 3:00 PM
📖 View on learn.microsoft.com
+4 / -4 lines changed
Commit: Update entitlement-management-dynamic-approval.md
Changes:
Before
After
 
# Externally determine the approval requirements for an access package using custom extensions (Preview)
 
In entitlement management, approvers for access package requests can either be directly assigned, or determined dynamically. Entitlement management natively supports approvers when they are the requestors manager, their second-level manager, or a sponsor from a connected organization:
 
:::image type="content" source="media/entitlement-management-dynamic-approval/native-support-diagram.png" alt-text="Screenshot of native support of approvers in Entitlement management." lightbox="media/entitlement-management-dynamic-approval/native-support-diagram.png":::
With the inclusion of [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview), you're able to determine approval based on each of the [ApprovalStage properties](/graph/api/resources/approvalstage?view=graph-rest-beta#properties). For example, if the user requesting an access package is in a department where leadership has recently changed, dynamic approvals can query the system and assign the new department head as the approver.
 
:::image type="content" source="media/entitlement-management-dynamic-approval/dynamic-extensibility-diagram.png" alt-text="Screenshot of example of determining approvers using custom extensions." lightbox="media/entitlement-management-dynamic-approval/dynamic-extensibility-diagram.png":::
 
}
```
 
Although the example uses a user ID, the primaryApprovers and escalationApprovers section can contain any valid [subjectSet](/graph/api/resources/subjectset). The approval section of the code must follow the parameters as shown here: [accessPackageApprovalStage](/graph/api/resources/accesspackageapprovalstage).
 
> [!NOTE]
> In Public Preview the resume call must be performed against Microsoft Graph's beta endpoint. However, the [accessPackageApprovalStage](/graph/api/resources/accesspackageapprovalstage) provided in the resume call body must follow the [v1.0 convention](/graph/api/resources/accesspackageapprovalstage) and not the [beta convention](/graph/api/resources/approvalstage).
 
## Related content
 
# Externally determine the approval requirements for an access package using custom extensions (Preview)
 
In entitlement management, approvers for access package requests can either be directly assigned, or determined dynamically. Entitlement management natively supports dynamically determining approvers such as the requestors manager, their second-level manager, or a sponsor from a connected organization:
 
:::image type="content" source="media/entitlement-management-dynamic-approval/native-support-diagram.png" alt-text="Screenshot of native support of approvers in Entitlement management." lightbox="media/entitlement-management-dynamic-approval/native-support-diagram.png":::
With the introduction of [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview) you are now able to dynamically determinie approval requirements for each access package assignment request based on your organizations specific business logic. The access package assignment request process will pause until your business logic hosted in Azure Logic Apps returns a [approval stage](/graph/api/resources/accesspackageapprovalstage?view=graph-rest-1.0) which will then be leveraged in the subequent approval process via the [My Access portal](https://myaccess.microsoft.com). For example, if access requests must be approved by the department head of the person requesting an access package this feature allows you to query an external system, such as your human resources (HR) system, to on-the-fly look up the current department head and assign them as the approver for the given access request.
 
:::image type="content" source="media/entitlement-management-dynamic-approval/dynamic-extensibility-diagram.png" alt-text="Screenshot of example of determining approvers using custom extensions." lightbox="media/entitlement-management-dynamic-approval/dynamic-extensibility-diagram.png":::
 
}
```
 
Although the example uses a user ID, the primaryApprovers and escalationApprovers section can contain any valid [subjectSet](/graph/api/resources/subjectset). The approval section of the code must follow the parameters as shown here: [accessPackageApprovalStage](/graph/api/resources/accesspackageapprovalstage?view=graph-rest-1.0).
 
> [!NOTE]
> In Public Preview the resume call must be performed against Microsoft Graph's beta endpoint. However, the [approval stage](/graph/api/resources/accesspackageapprovalstage?view=graph-rest-1.0) provided in the resume call body must follow the [v1.0 convention](/graph/api/resources/accesspackageapprovalstage?view=graph-rest-1.0) and not the [beta convention](/graph/api/resources/approvalstage?view=graph-rest-beta).
 
## Related content
Modified by shlipsey3 on Jul 28, 2025 4:42 PM
📖 View on learn.microsoft.com
+4 / -2 lines changed
Commit: fine-tune
Changes:
Before
After
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: lhuangnorth
ms.date: 07/25/2025
 
ms.service: entra-id
ms.subservice: conditional-access
- "Exclude users in the "Break Glass" group from any policy that requires multifactor authentication."
- "Exclude user with Object ID dddddddd-3333-4444-5555-eeeeeeeeeeee from all policies"
 
For more information about how to use custom instructions, check out the following video. Please note that some of the content in the video is subject to change as the agent is updated frequently.
 
> [!VIDEO 5879a0f7-3644-4e34-a8ce-b186b8e5f128]
 
## Remove agent
 
If you no longer wish to use the Conditional Access optimization agent, select **Remove agent** from the top of the agent window. The existing data (agent activity, suggestions, and metrics) is removed but any policies created or updated based on the agent suggestions remain intact. Previously applied suggestions remain unchanged so you can continue to use the policies created or modified by the agent.
 
 
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: lhuangnorth
ms.date: 07/28/2025
 
ms.service: entra-id
ms.subservice: conditional-access
- "Exclude users in the "Break Glass" group from any policy that requires multifactor authentication."
- "Exclude user with Object ID dddddddd-3333-4444-5555-eeeeeeeeeeee from all policies"
 
For more information about how to use custom instructions, check out the following video.
 
> [!VIDEO 5879a0f7-3644-4e34-a8ce-b186b8e5f128]
 
Please note that some of the content in the video is subject to change as the agent is updated frequently.
 
## Remove agent
 
If you no longer wish to use the Conditional Access optimization agent, select **Remove agent** from the top of the agent window. The existing data (agent activity, suggestions, and metrics) is removed but any policies created or updated based on the agent suggestions remain intact. Previously applied suggestions remain unchanged so you can continue to use the policies created or modified by the agent.
Modified by Tracey Torble on Jul 28, 2025 1:58 PM
📖 View on learn.microsoft.com
+1 / -1 lines changed
Commit: Update docs/identity-platform/single-sign-on-saml-protocol.md
Changes:
Before
After
| Parameter | Type | Description |
| --- | --- | --- |
| `ID` | Required | Microsoft Entra ID uses this attribute to populate the `InResponseTo` attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "ID" to the string representation of a GUID. For example, `id6c1c178c166d486687be4aaf5e482730` is a valid ID. |
| `Version` | Required | This parameter should be set to `2.0`. |<img width="1677" height="510" alt="image" src="https://github.com/user-attachments/assets/619badf7-92d8-40c6-8f9d-359ec5fc9acf" />
 
| `IssueInstant` | Required | This is a DateTime string with a UTC value and [round-trip format ("o")](/dotnet/standard/base-types/standard-date-and-time-format-strings). Microsoft Entra ID expects a DateTime value of this type, but doesn't evaluate or use the value. |
| `AssertionConsumerServiceURL` | Optional | If provided, this parameter must match the `RedirectUri` of the cloud service in Microsoft Entra ID. Entra ID will honor the ACS URL if it is present in the SAML Request.|
| Parameter | Type | Description |
| --- | --- | --- |
| `ID` | Required | Microsoft Entra ID uses this attribute to populate the `InResponseTo` attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "ID" to the string representation of a GUID. For example, `id6c1c178c166d486687be4aaf5e482730` is a valid ID. |
| `Version` | Required | This parameter should be set to `2.0`. |
 
| `IssueInstant` | Required | This is a DateTime string with a UTC value and [round-trip format ("o")](/dotnet/standard/base-types/standard-date-and-time-format-strings). Microsoft Entra ID expects a DateTime value of this type, but doesn't evaluate or use the value. |
| `AssertionConsumerServiceURL` | Optional | If provided, this parameter must match the `RedirectUri` of the cloud service in Microsoft Entra ID. Entra ID will honor the ACS URL if it is present in the SAML Request.|