MODIFIED docs/fundamentals/whats-new-archive.md

Modified by Ortagus Winfrey on Aug 4, 2025 12:57 PM
📖 View on learn.microsoft.com

+151 / -0 lines changed

Commit: January 2025 added to archive

Changes:

Before

After

 
---
 
## December 2024
 
### General Availability - What's new in Microsoft Entra

 
---
 
## January 2025
 
### Public Preview - Manage Lifecycle Workflows with Microsoft Security CoPilot in Microsoft Entra
 
**Type:** New feature    
**Service category:** Lifecycle Workflows    
**Product capability:** Identity Governance    
 
Customers can now manage, and customize, Lifecycle Workflows using natural language with Microsoft Security CoPilot. Our Lifecycle Workflows (LCW) Copilot solution provides step-by-step guidance to perform key workflow configuration and execution tasks using natural language. It allows customers to quickly get rich insights to help monitor, and troubleshoot, workflows for compliance. For more information, see: [Manage employee lifecycle using Microsoft Security Copilot (Preview)](../fundamentals/copilot-entra-lifecycle-workflow.md).
 
---
 
### General Availability - Microsoft Entra PowerShell
 
**Type:** New feature    
**Service category:** MS Graph

MODIFIED docs/fundamentals/whats-new.md

Modified by Ortagus Winfrey on Aug 4, 2025 12:57 PM
📖 View on learn.microsoft.com

+0 / -140 lines changed

Commit: January 2025 added to archive

Changes:

Before

After

 
---
 
## January 2025
 
### Public Preview - Manage Lifecycle Workflows with Microsoft Security CoPilot in Microsoft Entra
 
**Type:** New feature    
**Service category:** Lifecycle Workflows    
**Product capability:** Identity Governance    
 
Customers can now manage, and customize, Lifecycle Workflows using natural language with Microsoft Security CoPilot. Our Lifecycle Workflows (LCW) Copilot solution provides step-by-step guidance to perform key workflow configuration and execution tasks using natural language. It allows customers to quickly get rich insights to help monitor, and troubleshoot, workflows for compliance. For more information, see: [Manage employee lifecycle using Microsoft Security Copilot (Preview)](../fundamentals/copilot-entra-lifecycle-workflow.md).
 
### General Availability - Microsoft Entra PowerShell
 
**Type:** New feature

---

MODIFIED docs/identity/authentication/concept-mandatory-multifactor-authentication.md

Modified by Justinha on Aug 4, 2025 7:19 PM
📖 View on learn.microsoft.com

+21 / -36 lines changed

Commit: revised implementation section

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 07/29/2025
ms.author: justinha
author: justinha
manager: dougeby
That's why, starting in 2024, we'll enforce mandatory MFA for all Azure sign-in attempts. For more background about this requirement, see our [blog post](https://aka.ms/azuremfablogpost). This topic covers which applications and accounts are affected, how enforcement gets rolled out to tenants, and other common questions and answers.
 
> [!Important]
> If a user can't sign in to Azure and other admin portals after rollout of mandatory MFA, a Global Administrator can run a script to postpone the MFA requirement and allow users to sign in. For more information, see [How to postpone enforcement for a tenant where users are unable to sign in after rollout of mandatory multifactor authentication (MFA) requirement for the the Azure portal, Microsoft Entra admin center, or Microsoft Intune admin center](how-to-unlock-users-for-mandatory-multifactor-authentication.md).
 
There's no change for users if your organization already enforces MFA for them, or if they sign in with stronger methods like passwordless or passkey (FIDO2). To verify that MFA is enabled, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md). 
 
 
Starting September 15, 2025, MFA enforcement will gradually begin for accounts that sign in to Azure CLI, Azure PowerShell, Azure mobile app, IaC tools, and REST API endpoints to perform any Create, Update, or Delete operation. Read operations won't require MFA. 
 
Some customers may use a user account in Microsoft Entra ID as a service account. It's recommended to migrate these user-based service accounts to [secure cloud based service accounts](/entra/architecture/secure-service-accounts) with [workload identities](~/workload-id/workload-identities-overview.md). 
 
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
ms.date: 08/04/2025
ms.author: justinha
author: justinha
manager: dougeby
That's why, starting in 2024, we'll enforce mandatory MFA for all Azure sign-in attempts. For more background about this requirement, see our [blog post](https://aka.ms/azuremfablogpost). This topic covers which applications and accounts are affected, how enforcement gets rolled out to tenants, and other common questions and answers.
 
> [!Important]
> If a user can't sign in to Azure and other admin portals after rollout of mandatory MFA, a Global Administrator can run a script to postpone the MFA requirement and allow users to sign in. For more information, see [How to postpone enforcement for a tenant where users are unable to sign in after rollout of mandatory multifactor authentication (MFA) requirement for the Azure portal, Microsoft Entra admin center, or Microsoft Intune admin center](how-to-unlock-users-for-mandatory-multifactor-authentication.md).
 
There's no change for users if your organization already enforces MFA for them, or if they sign in with stronger methods like passwordless or passkey (FIDO2). To verify that MFA is enabled, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md). 
 
 
Starting September 15, 2025, MFA enforcement will gradually begin for accounts that sign in to Azure CLI, Azure PowerShell, Azure mobile app, IaC tools, and REST API endpoints to perform any Create, Update, or Delete operation. Read operations won't require MFA. 
 
Some customers may use a user account in Microsoft Entra ID as a service account. It's recommended to migrate these user-based service accounts to [secure cloud-based service accounts](/entra/architecture/secure-service-accounts) with [workload identities](~/workload-id/workload-identities-overview.md).
 
 

MODIFIED docs/identity-platform/apple-sso-plugin.md

Modified by Ortagus Winfrey on Aug 4, 2025 6:52 PM
📖 View on learn.microsoft.com

+33 / -5 lines changed

Commit: Troubleshoot secure enclave updates

Changes:

Before

After

 
## Device Identity Key Storage
 
In March 2024, Microsoft announced that Microsoft Entra ID will transition from using Apple’s Keychain to Apple’s Secure Enclave for storing device identity keys. Beginning July 2025, all new device registrations will require Secure Enclave for key storage.
 
If your applications or MDM solutions depend on accessing Workplace Join keys through Keychain, you must update them to use the Microsoft Authentication Library (MSAL) and the Enterprise SSO plug-in to maintain compatibility with the Microsoft identity platform.
 
#### Troubleshoot Secure Enclave
 
In cases where you must troubleshoot issues with Secure Enclave, it can be disabled by updating the following key in your Apple device's MDM configuration:
 
- **Key**: `use_most_secure_storage`
- **Type**: `Boolean`
- **Value**: False
 
> [!NOTE]
> Disabling Secure Enclave should only be done during troubleshooting.
 
### Scenarios impacted

 
## Device Identity Key Storage
 
In March 2024, Microsoft announced that Microsoft Entra ID will transition from using Apple’s Keychain to Apple’s Secure Enclave for storing device identity keys. Beginning July 2025, new device registrations will require Secure Enclave for key storage.
 
If your applications or MDM solutions depend on accessing Workplace Join keys through Keychain, you must update them to use the Microsoft Authentication Library (MSAL) and the Enterprise SSO plug-in to maintain compatibility with the Microsoft identity platform.
 
#### Troubleshoot Secure Enclave
 
In cases where you must troubleshoot issues with Secure Enclave, it can be disabled by updating the following key in your Apple device's MDM configuration:
 
- **Key**:: `use_most_secure_storage`
- **Type**: `Boolean`
- **Value**: False
 
Alternatively:
 
- **Key**: `use_most_secure_storage`
- **Type**: `Integer`
- **Value**: 0

MODIFIED docs/identity/hybrid/cloud-sync/tutorial-group-provisioning.md

Modified by Justinha on Aug 4, 2025 3:31 PM
📖 View on learn.microsoft.com

+16 / -16 lines changed

Commit: image updates and AD DS updates

Changes:

Before

After

manager: mwongerapk
ms.service: entra-id
ms.topic: how-to
ms.date: 08/01/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
ms.custom: no-azure-ad-ps-ref, sfi-image-nochange
To add synced users, follow these steps:
 
>[!NOTE]
>Only synced user member references are provisioned to AD. 
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Hybrid Identity Administrator](~/identity/role-based-access-control/permissions-reference.md#hybrid-identity-administrator).
2. Browse to **Entra ID** > **Groups** > **All groups**.
When you convert the **Source of Authority (SOA)** to cloud for an on-premises group, that group becomes eligible for group provisioning to AD DS.
 
For example, in the following diagram, **SOATestGroup1** SOA is converted to the cloud.
As a result, it becomes available for the **GPAD job scope**.
 
:::image type="content" border="true" source="media/tutorial-group-provision/in-scope.png" alt-text="Screenshot of job in scope." lightbox="media/tutorial-group-provision/entry-level-error.png":::

manager: mwongerapk
ms.service: entra-id
ms.topic: how-to
ms.date: 08/04/2025
ms.subservice: hybrid-cloud-sync
ms.author: jomondi
ms.custom: no-azure-ad-ps-ref, sfi-image-nochange
To add synced users, follow these steps:
 
>[!NOTE]
>Only synced user member references are provisioned to AD DS. 
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Hybrid Identity Administrator](~/identity/role-based-access-control/permissions-reference.md#hybrid-identity-administrator).
2. Browse to **Entra ID** > **Groups** > **All groups**.
When you convert the **Source of Authority (SOA)** to cloud for an on-premises group, that group becomes eligible for group provisioning to AD DS.
 
For example, in the following diagram, **SOATestGroup1** SOA is converted to the cloud.
As a result, it becomes available for the job scope in group provisioning to AD DS.
 
:::image type="content" border="true" source="media/tutorial-group-provision/in-scope.png" alt-text="Screenshot of job in scope." lightbox="media/tutorial-group-provision/group-scope.png":::

MODIFIED docs/identity/monitoring-health/reference-sla-performance.md

Modified by YalingQing on Aug 4, 2025 9:09 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Learn Editor: Update reference-sla-performance.md

Changes:

Before

After

| April     | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|
| May       | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |
| June      | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |
| July      | 99.999% | 99.999% | 99.999% | 99.999% |         |
| August    | 99.999% | 99.999% | 99.999% | 99.999% |         |
| September | 99.999% | 99.998% | 99.999% | 99.999% |         |
| October   | 99.999% | 99.999% | 99.999% | 99.998% |         |

| April     | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|
| May       | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |
| June      | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |
| July      | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |
| August    | 99.999% | 99.999% | 99.999% | 99.999% |         |
| September | 99.999% | 99.998% | 99.999% | 99.999% |         |
| October   | 99.999% | 99.999% | 99.999% | 99.998% |         |

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files