MODIFIED docs/identity/devices/macos-psso-integration-guide.md

Modified by Gearoid O'Donnell on Aug 13, 2025 10:40 AM
📖 View on learn.microsoft.com

+12 / -12 lines changed

Commit: Acrolinx scorecard fixes

Changes:

Before

After

# Integrate macOS Platform Single Sign-On (PSSO) into your MDM solution
Platform Single Sign-On (PSSO) for macOS devices is a feature that allows users to sign in to macOS devices using their Microsoft Entra credentials. This feature provides a seamless sign-in experience for users and helps organizations manage access to resources on macOS devices.
 
In this guide, you will learn how to integrate macOS Platform SSO into your MDM solution. This guide is intended for developers of 3rd party MDM solutions who want to support Platform SSO for macOS devices.
 
## Prerequisites
Before getting started, we recommend that you familiarize yourself with the following articles:
* Any documentation you were provided by Intune for Partner Managed Device Compliance Integration APIs
* [Microsoft Enterprise SSO plug-in for Apple devices](../../identity-platform/apple-sso-plugin.md).
* [macOS Platform Single Sign-on overview](./macos-psso.md).
 
## Minimum required payload properties
 
The following settings and payload properties are required for use with the [Microsoft Enterprise SSO plug-in for Apple devices](../../identity-platform/apple-sso-plugin.md). Please ensure these are configured with the following values and add other settings as required to ensure proper SSO for your apps.
 
| **Setting** | **Value(s)** |
|---|---|
| Use Shared Device Keys  | Enable “Use Shared Device Keys” for the best PSSO experience and to avoid unnecessary re-registration experiences if enabled later.  |
 
## Event notifications

# Integrate macOS Platform Single Sign-On (PSSO) into your MDM solution
Platform Single Sign-On (PSSO) for macOS devices is a feature that allows users to sign in to macOS devices using their Microsoft Entra credentials. This feature provides a seamless sign-in experience for users and helps organizations manage access to resources on macOS devices.
 
In this guide, you learn how to integrate macOS Platform Single Sign-On (PSSO) into your MDM solution. This guide is intended for developers of 3rd party MDM solutions who want to support PSSO for macOS devices.
 
## Prerequisites
Before getting started, we recommend that you familiarize yourself with the following articles:
* Any documentation you were provided by Intune for Partner Managed Device Compliance Integration APIs
* [Microsoft Enterprise Single Sign-On (SSO) plug-in for Apple devices](../../identity-platform/apple-sso-plugin.md).
* [macOS Platform Single Sign-on overview](./macos-psso.md).
 
## Minimum required payload properties
 
The following settings and payload properties are required for use with the [Microsoft Enterprise Single Sign-On (SSO) plug-in for Apple devices](../../identity-platform/apple-sso-plugin.md). Ensure these settings are configured with the following values and add other settings as required to ensure proper SSO for your apps.
 
| **Setting** | **Value(s)** |
|---|---|
| Use Shared Device Keys  | Enable “Use Shared Device Keys” for the best PSSO experience and to avoid unnecessary re-registration experiences if enabled later.  |
 
## Event notifications

MODIFIED docs/identity/authentication/howto-mfa-nps-extension.md

Modified by Miguel Ferreira on Aug 13, 2025 3:08 PM
📖 View on learn.microsoft.com

+3 / -8 lines changed

Commit: Learn Editor: Update howto-mfa-nps-extension.md

Changes:

Before

After

 
* `https://onegetcdn.azureedge.net`
* `https://graph.microsoft.com`
 
* `https://go.microsoft.com`
 
* `https://provisioningapi.microsoftonline.com`
 
* `https://www.powershellgallery.com`
 
* `https://aadcdn.msauth.net`
 
* `https://aadcdn.msftauthimages.net`
 
The following table describes the ports and protocols required for the NPS extension. TCP 443 (inbound and outbound) is the only port needed from the NPS Extension server to Entra ID. The RADIUS ports are needed between the access point and the NPS Extension server.
 
```powershell
Connect-MgGraph -Scopes 'Application.ReadWrite.All'
New-MgServicePrincipal -AppId 00001111-aaaa-2222-bbbb-3333cccc4444 -DisplayName "Azure Multi-Factor Auth Client"
```

 
* `https://onegetcdn.azureedge.net`
* `https://graph.microsoft.com`
* `https://go.microsoft.com`
* `https://provisioningapi.microsoftonline.com`
* `https://www.powershellgallery.com`
* `https://aadcdn.msauth.net`
* `https://aadcdn.msftauthimages.net`
 
The following table describes the ports and protocols required for the NPS extension. TCP 443 (inbound and outbound) is the only port needed from the NPS Extension server to Entra ID. The RADIUS ports are needed between the access point and the NPS Extension server.
 
```powershell
Connect-MgGraph -Scopes 'Application.ReadWrite.All'
New-MgServicePrincipal -AppId 981f26a1-7f43-403b-a875-f8b09b8cd720 -DisplayName "Azure Multi-Factor Auth Client"
```
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Administrator](../role-based-access-control/permissions-reference.md#application-administrator).
 
### How can I verify that my client certificate is associated to my tenant in Microsoft Entra ID?
 

MODIFIED docs/identity/authentication/how-to-authentication-methods-manage.md

Modified by Tim Larson on Aug 13, 2025 1:33 PM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Update how-to-authentication-methods-manage.md

Changes:

Before

After

ms.service: entra-id
ms.subservice: authentication
ms.topic: upgrade-and-migration-article
ms.date: 03/04/2025
ms.author: justinha
author: justinha
ms.reviewer: jpettere
manager: dougeby
ms.custom: sfi-image-nochange
# Customer intent: As an identity administrator, I want to understand what authentication options are available in Microsoft Entra ID and how I can manage them.
 
:::image type="content" border="false" source="media/how-to-authentication-methods-manage/legacy-sspr-policy.png" alt-text="Screenshot that shows the legacy Microsoft Entra SSPR policy." lightbox="media/how-to-authentication-methods-manage/legacy-sspr-policy.png":::
 
Record which users are in scope for SSPR (either all users, one specific group, or no users) and the authentication methods they can use. While security questions aren't yet available to manage in the Authentication methods policy, make sure you record them for later when they are. You can find this information by going to **Entra ID** > **Users** > **Password reset** > **Properties**.
 
| SSPR authentication methods | Authentication method policy |
|-----------------------------|------------------------------|
 
### Security questions
 

ms.service: entra-id
ms.subservice: authentication
ms.topic: upgrade-and-migration-article
ms.date: 08/13/2025
ms.author: justinha
author: justinha
ms.reviewer: jpettere, tilarso
manager: dougeby
ms.custom: sfi-image-nochange
# Customer intent: As an identity administrator, I want to understand what authentication options are available in Microsoft Entra ID and how I can manage them.
 
:::image type="content" border="false" source="media/how-to-authentication-methods-manage/legacy-sspr-policy.png" alt-text="Screenshot that shows the legacy Microsoft Entra SSPR policy." lightbox="media/how-to-authentication-methods-manage/legacy-sspr-policy.png":::
 
Record which users are in scope for SSPR (either all users, one specific group, or no users) and the authentication methods they can use. Security questions aren't yet available to manage in the Authentication methods policy, and will remain manageable in the legacy SSPR Authentication Methods settings. You can review current security question information by going to **Entra ID** > **Users** > **Password reset** > **Properties**.
 
| SSPR authentication methods | Authentication method policy |
|-----------------------------|------------------------------|
 
### Security questions
 

MODIFIED docs/includes/licensing-pim.md

Modified by barclayn on Aug 13, 2025 5:50 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: removing sentence about PIM licensing checks

Changes:

Before

After

---
author: barclayn
ms.author: barclayn
ms.date: 01/31/2025
manager: femila
ms.service: entra-id
ms.topic: include
---
 
To use Microsoft Entra Privileged Identity Management, a tenant must have a valid license. Licenses must also be assigned to the administrators and relevant users. This article describes the license requirements to use Privileged Identity Management. To use Privileged Identity Management, you must have one of the following licenses:
 
 
### Valid licenses for PIM

---
author: barclayn
ms.author: barclayn
ms.date: 08/13/2025
manager: pmwongera
ms.service: entra-id
ms.topic: include
---
 
To use Microsoft Entra Privileged Identity Management, a tenant must have a valid license. This article describes the license requirements to use Privileged Identity Management. To use Privileged Identity Management, you must have one of the following licenses:
 
 
### Valid licenses for PIM

MODIFIED docs/global-secure-access/reference-role-based-permissions.md

Modified by Ken Withee on Aug 13, 2025 5:01 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Spells out GSA as Global Secure Access.

Changes:

Before

After

ms.author: kenwith
manager: dougeby
ms.topic: reference
ms.date: 06/12/2025
ai-usage: ai-assisted
ms.service: global-secure-access
ms.custom: sfi-ga-nochange
 
### Global Secure Access Log Reader
 
**Read-only access**: This role is primarily intended for security and network personnel who need read-only visibility into traffic logs and related insights to effectively monitor and analyze network activity without the ability to make changes to the environment. Users with this role can view detailed GSA traffic logs, including session, connection, and transaction data, as well as access and review alerts and reports in the GSA portal.
 
### Security Reader and Global Reader
 
The following Microsoft Entra ID admin roles have access to Global Secure Access:
 
 
| Permissions | Global Admin | [Security Admin](#security-administrator) | [GSA Admin](#global-secure-access-administrator) | [CA Admin](#conditional-access-administrator) | [Apps Admin](#application-administrator) | [Global Reader](#security-reader-and-global-reader) | [Security Reader](#security-reader-and-global-reader) | [GSA Log Reader](#global-secure-access-log-reader)
| --- | --- | --- | --- | --- | --- | --- | --- |
| Configure Private Access (Quick Access, private network connectors, application segments, and enterprise apps) | ✅ |  |  |  | ✅ |  |  |

ms.author: kenwith
manager: dougeby
ms.topic: reference
ms.date: 08/13/2025
ai-usage: ai-assisted
ms.service: global-secure-access
ms.custom: sfi-ga-nochange
 
### Global Secure Access Log Reader
 
**Read-only access**: This role is primarily intended for security and network personnel who need read-only visibility into traffic logs and related insights to effectively monitor and analyze network activity without the ability to make changes to the environment. Users with this role can view detailed Global Secure Access traffic logs, including session, connection, and transaction data, as well as access and review alerts and reports in the Global Secure Access area of the Microsoft Entra admin center.
 
### Security Reader and Global Reader
 
The following Microsoft Entra ID admin roles have access to Global Secure Access:
 
 
| Permissions | Global Admin | [Security Admin](#security-administrator) | [Global Secure Access Admin](#global-secure-access-administrator) | [CA Admin](#conditional-access-administrator) | [Apps Admin](#application-administrator) | [Global Reader](#security-reader-and-global-reader) | [Security Reader](#security-reader-and-global-reader) | [Global Secure Access Log Reader](#global-secure-access-log-reader)
| --- | --- | --- | --- | --- | --- | --- | --- |
| Configure Private Access (Quick Access, private network connectors, application segments, and enterprise apps) | ✅ |  |  |  | ✅ |  |  |

MODIFIED docs/identity/enterprise-apps/delete-application-portal.md

Modified by TheWriteDoc on Aug 13, 2025 5:16 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: leftnavedits2

Changes:

Before

After

   - One of the following roles: 
   - Cloud Application Administrator
   - Application Administrator
   - owner of the service principal
- An [enterprise application added to your tenant](add-application-portal.md).
 
:::zone pivot="portal"
## Delete an enterprise application using Microsoft Entra admin center
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator).
1. Browse to **Entra ID** > **Enterprise apps** > **All applications**.
1. Enter the name of the existing application in the search box, and then select the application from the search results. In this article, we use the **Microsoft Entra SAML Toolkit 1** as an example.
1. In the **Manage** section of the left menu, select **Properties**.
1. At the top of the **Properties** pane, select **Delete**, and then select **Yes** to confirm you want to delete the application from your Microsoft Entra tenant.

   - One of the following roles: 
   - Cloud Application Administrator
   - Application Administrator
   - Owner of the service principal
- An [enterprise application added to your tenant](add-application-portal.md).
 
:::zone pivot="portal"
## Delete an enterprise application using Microsoft Entra admin center
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator).
1. Browse to **Identity** > **Applications** > **Enterprise applications** > **All applications**.
1. Enter the name of the existing application in the search box, and then select the application from the search results. In this article, we use the **Microsoft Entra SAML Toolkit 1** as an example.
1. In the **Manage** section of the left menu, select **Properties**.
1. At the top of the **Properties** pane, select **Delete**, and then select **Yes** to confirm you want to delete the application from your Microsoft Entra tenant.

MODIFIED docs/id-governance/privileged-identity-management/pim-how-to-change-default-settings.md

Modified by Barclay Neira on Aug 13, 2025 4:45 PM
📖 View on learn.microsoft.com

+0 / -4 lines changed

Commit: Update pim-how-to-change-default-settings.md

Changes:

Before

After

 
We recommend requiring approval for activation of an eligible assignment. The approver doesn't have to have any roles. When you use this option, select at least one approver. We recommend that you select at least two approvers. If no specific approvers are selected, active Privileged Role Administrators/Global Administrators become the default approvers.
 
If all Privileged Role Administrators/Global Administrators have eligible assignments, approval is required for activation. If the list of approvers is not configured, you will be locked out of the tenant. Only active Privileged Role Administrators/Global Administrators can approve activation and you won’t have them due to a circular dependency. Avoid this situation by configuring [emergency access accounts](~/identity/role-based-access-control/security-emergency-access.md) and configuring specific approvers.
 
> [!IMPORTANT]
> You will be locked out of your tenant if all of the following conditions are true:
> - All Privileged Role Administrators/Global Administrators have eligible assignments, but none are active.
> - No approvers are configured.
> <br><strong>Avoid this situation</strong> by configuring [emergency access accounts](~/identity/role-based-access-control/security-emergency-access.md) and configuring specific approvers.
 
In this scenario, there are no active users who can approve activation, creating a circular dependency. To avoid this, configure emergency access accounts and specify approvers.
 
To learn more about approvals, see [Approve or deny requests for Microsoft Entra roles in Privileged Identity Management](./pim-approval-workflow.md).
 
### Assignment duration

 
We recommend requiring approval for activation of an eligible assignment. The approver doesn't have to have any roles. When you use this option, select at least one approver. We recommend that you select at least two approvers. If no specific approvers are selected, active Privileged Role Administrators/Global Administrators become the default approvers.
 
> [!IMPORTANT]
> You will be locked out of your tenant if all of the following conditions are true:
> - All Privileged Role Administrators/Global Administrators have eligible assignments, but none are active.
> - No approvers are configured.
> <br><strong>Avoid this situation</strong> by configuring [emergency access accounts](~/identity/role-based-access-control/security-emergency-access.md) and configuring specific approvers.
 
To learn more about approvals, see [Approve or deny requests for Microsoft Entra roles in Privileged Identity Management](./pim-approval-workflow.md).
 
### Assignment duration

MODIFIED docs/identity/authentication/concept-authentication-strengths.md

Modified by Gearoid O'Donnell on Aug 13, 2025 9:25 AM
📖 View on learn.microsoft.com

+3 / -1 lines changed

Commit: Addding lightbox

Changes:

Before

After

 
- Microsoft Entra certificate-based authentication (Multifactor)
 
:::image type="content" border="true" source="./media/concept-authentication-strengths/authentication-strength-definitions.png" alt-text="Screenshot showing the phishing-resistant MFA strength definition.":::
 
The combinations of authentication methods for each built-in authentication strength are listed in the following table. These combinations include methods that need to be registered by users and enabled in the Authentication methods policy or the legacy MFA settings policy.

 
- Microsoft Entra certificate-based authentication (Multifactor)
 
:::image type="content" border="true" source="./media/concept-authentication-strengths/authentication-strength-definitions.png" alt-text="Screenshot showing the phishing-resistant MFA strength definition." lightbox="./media/concept-authentication-strengths/authentication-strength-definitions.png":::
 
The combinations of authentication methods for each built-in authentication strength are listed in the following table. These combinations include methods that need to be registered by users and enabled in the Authentication methods policy or the legacy MFA settings policy.

MODIFIED docs/id-governance/configure-logic-app-lifecycle-workflows.md

Modified by Alexander Filipin on Aug 13, 2025 2:12 PM
📖 View on learn.microsoft.com

+3 / -0 lines changed

Commit: Update configure-logic-app-lifecycle-workflows.md

Changes:

Before

After

-	For `Issuer`, ensure you included the slash after your Tenant ID
-	For `appid`, ensure the custom claim is `appid` in all lowercase. The `appid` value represents Lifecycle Workflows and is always the same.
 
## Configure authorization policy for custom task extension with normal security token type
 
If the security token type is **Normal** for your custom task extension, you'd set the authorization policy by following these steps:

-	For `Issuer`, ensure you included the slash after your Tenant ID
-	For `appid`, ensure the custom claim is `appid` in all lowercase. The `appid` value represents Lifecycle Workflows and is always the same.
 
> [!NOTE]
> To compile with RFC 8725 this document and future Logic Apps created via the Lifecycle Workflows custom task extensions experience have been updated to include the audience claim in the authorization policy configuration. Previously created authorization policy configurations without the audience claim remain secure as they already include the u claim and Logic Apps validates the domain component of the u claim aligns with the audience.
 
## Configure authorization policy for custom task extension with normal security token type
 
If the security token type is **Normal** for your custom task extension, you'd set the authorization policy by following these steps:

MODIFIED docs/id-governance/privileged-identity-management/pim-how-to-add-role-to-user.md

Modified by Barclay Neira on Aug 13, 2025 4:48 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update pim-how-to-add-role-to-user.md

Changes:

Before

After

 
Follow these steps to update or remove an existing role assignment.  
You can't remove the last active role assignment for Global Administrators. We recommend having an emergency access account with active permanent role assignment for Global Administrator role. See more [details.](~/identity/role-based-access-control/security-emergency-access.md)  
You can't remove the eligible role assignment for Global Administrators if there are no assigned role assignments for the Global Administrator role left.
This is done to minimize risks of administrators locking themselves out of the tenant inadvertently.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).

 
Follow these steps to update or remove an existing role assignment.  
You can't remove the last active role assignment for Global Administrators. We recommend having an emergency access account with active permanent role assignment for Global Administrator role. See more [details.](~/identity/role-based-access-control/security-emergency-access.md)  
You can't remove the eligible role assignment for Global Administrators if there would be no assigned role assignments for the Global Administrator role left.
This is done to minimize risks of administrators locking themselves out of the tenant inadvertently.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Privileged Role Administrator](~/identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).

MODIFIED docs/identity/devices/macos-psso.md

Modified by Ortagus Winfrey on Aug 13, 2025 4:18 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: macOS Platform bug test

Changes:

Before

After

 
macOS Platform Single Sign-on (PSSO) is a new feature powered by Microsoft’s Enterprise SSO plug-in, Platform Credentials for macOS that enables users to sign in to Mac devices using their Microsoft Entra ID credentials. This feature provides benefits for admins by simplifying the sign-in process for users and reducing the number of passwords they need to remember. It also allows users to authenticate with Microsoft Entra ID with a smart card or hardware-bound key. This feature improves the end-user experience by not having to remember two separate passwords and diminishes the need for admins to manage the local account password. 
 
There are three different authentication methods that determine the end-user experience;
 
* **Platform Credential for macOS**: Provisions a secure enclave backed hardware-bound cryptographic key that is used for SSO across apps that use Microsoft Entra ID for authentication. The user’s local account password isn't affected and is required to sign in to the Mac.
* **Smart card**: The user signs in to the machine using an external smart card, or smart card-compatible hard token (for example, Yubikey). Once the device is unlocked, the smart card is used with Microsoft Entra ID to grant SSO across apps that use Microsoft Entra ID for authentication.

 
macOS Platform Single Sign-on (PSSO) is a new feature powered by Microsoft’s Enterprise SSO plug-in, Platform Credentials for macOS that enables users to sign in to Mac devices using their Microsoft Entra ID credentials. This feature provides benefits for admins by simplifying the sign-in process for users and reducing the number of passwords they need to remember. It also allows users to authenticate with Microsoft Entra ID with a smart card or hardware-bound key. This feature improves the end-user experience by not having to remember two separate passwords and diminishes the need for admins to manage the local account password. 
 
There are three different authentication methods that determine the end-user experience; 
 
* **Platform Credential for macOS**: Provisions a secure enclave backed hardware-bound cryptographic key that is used for SSO across apps that use Microsoft Entra ID for authentication. The user’s local account password isn't affected and is required to sign in to the Mac.
* **Smart card**: The user signs in to the machine using an external smart card, or smart card-compatible hard token (for example, Yubikey). Once the device is unlocked, the smart card is used with Microsoft Entra ID to grant SSO across apps that use Microsoft Entra ID for authentication.

MODIFIED docs/identity/devices/troubleshoot-macos-platform-single-sign-on-extension.md

Modified by Gearoid O'Donnell on Aug 13, 2025 9:21 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: PR review feedback

Changes:

Before

After

 
There's a known concurrency issue on macOS 15+ (Sequoia) that can cause the PSSO device configuration to become corrupted. The device configuration can be corrupted by simultaneous updates from the system AppSSOAgent and AppSSODaemon processes. The corrupted configuration causes the operating system to trigger its re-registration remediation flow, resulting in unexpected registration prompts for users.
 
This issue is currently being investigated by Apple..
 
Sysdiagnose logs from affected users contain the following error:

 
There's a known concurrency issue on macOS 15+ (Sequoia) that can cause the PSSO device configuration to become corrupted. The device configuration can be corrupted by simultaneous updates from the system AppSSOAgent and AppSSODaemon processes. The corrupted configuration causes the operating system to trigger its re-registration remediation flow, resulting in unexpected registration prompts for users.
 
This issue is currently being investigated by Apple.
 
Sysdiagnose logs from affected users contain the following error:

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files