MODIFIED docs/identity-platform/apple-sso-plugin.md

Modified by Ortagus Winfrey on Aug 5, 2025 12:04 PM
📖 View on learn.microsoft.com

+24 / -13 lines changed

Commit: Token protection image update

Changes:

Before

After

> For this flag to take effect, it must be applied to a new registration. It will not impact devices that have already been registered unless they re-register.
 
- **Key**: `use_most_secure_storage`
- **Type**: `Boolean`
- **Value**: True
 
Alternatively:
 
 
- **Key**: `use_most_secure_storage`
- **Type**: `Integer`
- **Value**: 1
 
The screenshot below shows the configuration page and settings for enabling Secure Enclave in Microsoft Intune. 
 
 
In cases where you must troubleshoot issues with Secure Enclave, it can be disabled by updating the following key in your Apple device's MDM configuration:
 
- **Key**:: `use_most_secure_storage`
- **Type**: `Boolean`

> For this flag to take effect, it must be applied to a new registration. It will not impact devices that have already been registered unless they re-register.
 
- **Key**: `use_most_secure_storage`
- **Type**: `Integer`
- **Value**: 1
 
Alternatively:
 
- **Key**: `use_most_secure_storage`
- **Type**: `Boolean`
- **Value**: True
 
 
The screenshot below shows the configuration page and settings for enabling Secure Enclave in Microsoft Intune. 
 
 
In cases where you must troubleshoot issues with Secure Enclave, it can be disabled by updating the following key in your Apple device's MDM configuration:
 
- **Key**: `use_most_secure_storage`
- **Type**: `Integer`

MODIFIED docs/identity/hybrid/how-to-active-directory-group-cleanup.md

Modified by Justinha on Aug 5, 2025 4:25 AM
📖 View on learn.microsoft.com

+11 / -22 lines changed

Commit: Github copilot fixes

Changes:

Before

After

author: Justinha
manager: dougeby
ms.topic: how-to
ms.date: 08/01/2025
ms.author: justinha
ms.reviewer: justinha
---
 
# Clean up unused Active Directory Domain Services groups in a single domain
 
One challenge many organizations face is the proliferation of groups, particularly security groups, in their Active Directory Domain Services (AD DS) domains. An organization might create security groups for projects, but over time, they're no longer needed. These groups can linger unmaintained in the domain. 
 
There's no way to confirm if a particular group is needed to access an app or a file. So we need another way to identify and clean up these groups that are no longer needed.
 
This article outlines how to use a *scream test* methodology to clean up groups from an AD DS domain. Cleanup reduces administrative burden, and the risk of unmanaged groups in that domain. It also prevents these groups from being synced into Microsoft Entra. 
 
First you determine whether each group needs to be managed with an AD DS-based management tool like **Active Directory Users and Computers**, or managed in the cloud with Microsoft Entra admin center or Exchange Online, or if it might not be needed. If the group might not be needed, you can run multiple scream tests to determine if it's active. If it's no longer active, you can delete it from the AD DS domain.
 
There are multiple ways to determine whether a group is no longer needed. In some cases, the scream test indicates that a group is still required, and whether to manage it in Microsoft Entra ID or the AD DS domain.
 

author: Justinha
manager: dougeby
ms.topic: how-to
ms.date: 08/04/2025
ms.author: justinha
ms.reviewer: justinha
---
 
# Clean up unused Active Directory Domain Services groups in a single domain
 
One challenge many organizations face is the proliferation of groups in their Active Directory Domain Services (AD DS) domains, particularly security groups. An organization might create security groups for projects, but they're no longer needed over time. These groups can linger unmaintained in the domain. 
 
Group cleanup reduces administration and risk, and it prevents sync of unused groups into Microsoft Entra. This article outlines how to analyze groups and use a *scream test* methodology to identify and remove unused groups from an AD DS domain. 
 
First you determine whether each group needs to be managed with an AD DS-based management tool like **Active Directory Users and Computers**, or managed in the cloud with Microsoft Entra admin center or Exchange Online, or if it might not be needed. In some cases, the scream test indicates that a group is still required, and whether to manage it in Microsoft Entra ID or the AD DS domain. If the group might not be needed, you can run multiple scream tests to determine if it's active. If it's no longer active, you can delete it from the AD DS domain.
 
## Types of groups in scope for cleanup
 
- Security and Distribution List (DL) groups in an AD DS topology, with a single forest, single domain. Multiforest or multidomain environments, workgroups, local groups on domain-joined computers, or other environments are outside the scope of this article.
 

MODIFIED docs/fundamentals/copilot-entra-security-scenarios.md

Modified by Chris Werner on Aug 5, 2025 8:47 AM
📖 View on learn.microsoft.com

+20 / -0 lines changed

Commit: add extra info to CA, adding Devices

Changes:

Before

After

- [Privileged Identity Management (PIM)](#privileged-identity-management-pim): Manage and monitor privileged access in your organization using natural language queries.
- [Microsoft Entra domains](#microsoft-entra-domains): Simplify domain management by accessing domain information, verifying DNS records, and managing domain settings using natural language queries.
- [Microsoft Entra tenants](#microsoft-entra-tenants): Get quick access to your Microsoft Entra ID organization information, including tenant ID, display name, active licenses, and contacts.
- [Microsoft Entra Role Based Access Control (RBAC)](#microsoft-entra-role-based-access-control-rbac): Investigate roles within a directory, such as which roles a user or group has, who has a specific role, or details about a particular role.
- [License Usage](#license-usage): Track licenses purchased and actual usage across your Microsoft Entra tenant using natural language queries.
 
 
Microsoft Entra Conditional Access applies the capabilities of Microsoft Security Copilot to help admins easily understand and evaluate their Conditional Access policies.  By combining Conditional Access APIs with the power of generative AI, Security Copilot enables analysts to ask natural language questions, such as identifying what policies apply to users or what policies use certain controls, and receive clear insights in seconds. 
 
- List active MFA Conditional Access policies in my tenant.
- Which MFA policies are enforced in my tenant?
- Which Conditional Access policies are enabled in my tenant?
- *Who is the technical contact for my tenant?*
- *Who is the security compliance contact for my tenant?*
 
### Microsoft Entra Role Based Access Control (RBAC)
 
Microsoft Entra role-based access control (RBAC) helps you manage who has access to Microsoft Entra resources by assigning roles to users, groups, or applications. You can use built-in roles or create custom roles with specific permissions to meet your organization's needs. You can now use Microsoft Security Copilot to investigate roles within a directory. For example, you can ask which roles a user or group has, who has a specific role, or get details about a particular role. This makes it easier for administrators and analysts to understand and manage role assignments across your environment.
 
 

- [Privileged Identity Management (PIM)](#privileged-identity-management-pim): Manage and monitor privileged access in your organization using natural language queries.
- [Microsoft Entra domains](#microsoft-entra-domains): Simplify domain management by accessing domain information, verifying DNS records, and managing domain settings using natural language queries.
- [Microsoft Entra tenants](#microsoft-entra-tenants): Get quick access to your Microsoft Entra ID organization information, including tenant ID, display name, active licenses, and contacts.
- [Microsoft Entra devices](#microsoft-entra-devices): Use natural language to investigate your Microsoft Entra ID devices.
- [Microsoft Entra Role Based Access Control (RBAC)](#microsoft-entra-role-based-access-control-rbac): Investigate roles within a directory, such as which roles a user or group has, who has a specific role, or details about a particular role.
- [License Usage](#license-usage): Track licenses purchased and actual usage across your Microsoft Entra tenant using natural language queries.
 
 
Microsoft Entra Conditional Access applies the capabilities of Microsoft Security Copilot to help admins easily understand and evaluate their Conditional Access policies.  By combining Conditional Access APIs with the power of generative AI, Security Copilot enables analysts to ask natural language questions, such as identifying what policies apply to users or what policies use certain controls, and receive clear insights in seconds. 
 
Using this feature requires at least the roles of [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator), [Global Reader](/entra/identity/role-based-access-control/permissions-reference#global-reader), or [Security Reader](/entra/identity/role-based-access-control/permissions-reference#security-reader). You will also need a [Microsoft Entra ID P1 license](/entra/id-protection/overview-identity-protection#license-requirements) and a tenant with Conditional Access policies configured.
 
- List active MFA Conditional Access policies in my tenant.
- Which MFA policies are enforced in my tenant?
- Which Conditional Access policies are enabled in my tenant?
- *Who is the technical contact for my tenant?*
- *Who is the security compliance contact for my tenant?*
 
### Microsoft Entra devices
 

MODIFIED docs/identity/authentication/how-to-authentication-external-method-manage.md

Modified by emakedon23 on Aug 5, 2025 2:44 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update how-to-authentication-external-method-manage.md

Changes:

Before

After

 
### How users register their EAM by using the registration wizard
 
When a user signs in, a registration wizard helps them register the EAMs they're enabled to use. If they enabled other methods for sign-in, they might need to select **I want to set up a different method** > **External Auth methods** to proceed. They need to authenticate with their EAM provider to register the EAM in Microsoft Entra ID. 
 
If the authentication succeeds, a message confirms registration completed and the EAM is registered. 
The user is redirected to the resource they wanted to access.

 
### How users register their EAM by using the registration wizard
 
When a user signs in, a registration wizard helps them register the EAMs they're enabled to use. If they are enabled for other authentication methods, they might need to select **I want to set up a different method** > **External Auth methods** to proceed. They need to authenticate with their EAM provider to register the EAM in Microsoft Entra ID. 
 
If the authentication succeeds, a message confirms registration completed and the EAM is registered. 
The user is redirected to the resource they wanted to access.

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files