MODIFIED docs/external-id/customers/migrate-to-external-id.md

Modified by John Flores on Aug 18, 2025 7:59 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: [External ID] Migrate to External ID

Changes:

Before

After

---
title: Transitioning to Microsoft Entra External ID for CIAM
description: 'Transition to Microsoft Entra External ID for CIAM: Learn how to migrate your legacy customer identity solutions to enhance security, compliance, and scalability.'
ms.author: joflore
author: MicrosoftGuyJFlo
 
Developers building applications often control authentication and authorization for customers accessing their applications. They use customer identity access management (CIAM) solutions to avoid building and maintaining a full identity and access management (IAM) solution. Microsoft Entra External ID lets developers connect their applications to a customer-focused version of Microsoft Entra ID, a standard IAM solution. This guide gives a migration path and resources for developers and identity teams.
 
## What is Microsoft Entra External ID
 
For organizations and businesses that want to make their apps available to consumers and business customers, [Microsoft Entra External ID](overview-customers-ciam.md) lets you add CIAM features such as self-service registration, personalized sign-in experiences, and customer account management. Because these CIAM capabilities are built into Microsoft Entra ID, you benefit from platform features like enhanced security, compliance, and scalability.
 
## Why migrate from other CIAM solutions
 
Organizations might migrate to Microsoft Entra External ID from another tool based on strategic goals such as:
 

---
title: Transition to Microsoft Entra External ID for CIAM
description: 'Transition to Microsoft Entra External ID for CIAM: Learn how to migrate your legacy customer identity solutions to enhance security, compliance, and scalability.'
ms.author: joflore
author: MicrosoftGuyJFlo
 
Developers building applications often control authentication and authorization for customers accessing their applications. They use customer identity access management (CIAM) solutions to avoid building and maintaining a full identity and access management (IAM) solution. Microsoft Entra External ID lets developers connect their applications to a customer-focused version of Microsoft Entra ID, a standard IAM solution. This guide gives a migration path and resources for developers and identity teams.
 
## What is Microsoft Entra External ID?
 
For organizations and businesses that want to make their apps available to consumers and business customers, [Microsoft Entra External ID](overview-customers-ciam.md) lets you add CIAM features such as self-service registration, personalized sign-in experiences, and customer account management. Because these CIAM capabilities are built into Microsoft Entra ID, you benefit from platform features like enhanced security, compliance, and scalability.
 
## Why migrate from other CIAM solutions?
 
Organizations might migrate to Microsoft Entra External ID from another tool based on strategic goals such as:
 

MODIFIED docs/identity/enterprise-apps/manage-app-consent-policies.md

Modified by Erin Greenlee on Aug 18, 2025 7:14 PM
📖 View on learn.microsoft.com

+6 / -0 lines changed

Commit: Update manage-app-consent-policies.md

Changes:

Before

After

> [!WARNING]
> Microsoft-user-default-recommended is a Microsoft managed policy. The conditions included in the policy are automatically updated based on Microsoft's latest security recommendations for end-user consent.
 
## Multiple policies
 
A user can have more than one policy that allows them to give consent. Each policy is evaluated separately (as in, an exclusion from one policy does not affect inclusions of another policy) and the user only needs one policy to approve to be allowed to consent for a specific event. For example, an application admin can consent to everything a regular user can (thanks to the default policy applied to all users), and they also have broader permissions through the microsoft-application-admin policy, which lets them approve requests for any API permission—except Microsoft Graph app roles.

> [!WARNING]
> Microsoft-user-default-recommended is a Microsoft managed policy. The conditions included in the policy are automatically updated based on Microsoft's latest security recommendations for end-user consent.
 
## Microsoft recommended current settings
 
The setting labelled "Let Microsoft manage your consent settings," the Microsoft managed policy, will update with Microsoft's latest recommended default consent settings. This is also the default for a new tenant. The setting's rules are currently: End users can consent for any user consentable delegated permissions EXCEPT: Files.Read.All, Files.ReadWrite.All, Sites.Read.All, Sites.ReadWrite.All.
 
Updates to this consent policy will have at least 30 days of given notice.
 
## Multiple policies
 
A user can have more than one policy that allows them to give consent. Each policy is evaluated separately (as in, an exclusion from one policy does not affect inclusions of another policy) and the user only needs one policy to approve to be allowed to consent for a specific event. For example, an application admin can consent to everything a regular user can (thanks to the default policy applied to all users), and they also have broader permissions through the microsoft-application-admin policy, which lets them approve requests for any API permission—except Microsoft Graph app roles.

MODIFIED docs/global-secure-access/how-to-transport-layer-security.md

Modified by Teresa Yao on Aug 18, 2025 7:38 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update how-to-transport-layer-security.md

Changes:

Before

After

Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as a [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator).
Browse to **Global Secure Access** > **Secure** > **TLS inspection policies**.
Switch to the **TLS inspection settings** tab.
Select **+ Create certificate**.
In the **Create certificate** pane, fill in the following fields:
   - **Certificate name**: This name appears in the certificate hierarchy when viewed in a browser. It must be unique, contain no spaces, and be no more than 12 characters long. You can't reuse previous names.
   - **Common name** (CN): Common name, for example, Contoso TLS ICA, that identifies the intermediate certificate.
   - **Organizational Unit** (OU): Organization name, for example, Contoso IT.
Select **Create CSR**.
:::image type="content" source="media/how-to-transport-layer-security/create-certificate.png" alt-text="Screenshot of the Create certificate pane with fields filled and the Create CSR button highlighted.":::   
 
Sign the CSR using your PKI service. Make sure Server Auth is in Extended Key Usage and `certificate authority (CA)=true`, `keyUsage=critical,keyCertSign,cRLSign`, and `basicConstraints=critical,CA:TRUE` in Basic Extension. Save the signed certifcate in .pem format.
Select **+Upload certificate**.
In the Upload certificate form, upload the certificate.pem and chain.pem files.
Select **Upload signed certificate**.

Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as a [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator).
Browse to **Global Secure Access** > **Secure** > **TLS inspection policies**.
Switch to the **TLS inspection settings** tab.
Select **+ Create certificate**. This step starts with generating a Certificate Sign Request (CSR). 
In the **Create certificate** pane, fill in the following fields:
   - **Certificate name**: This name appears in the certificate hierarchy when viewed in a browser. It must be unique, contain no spaces, and be no more than 12 characters long. You can't reuse previous names.
   - **Common name** (CN): Common name, for example, Contoso TLS ICA, that identifies the intermediate certificate.
   - **Organizational Unit** (OU): Organization name, for example, Contoso IT.
Select **Create CSR**. This step creates a .csr file and saves it to your default download folder.
:::image type="content" source="media/how-to-transport-layer-security/create-certificate.png" alt-text="Screenshot of the Create certificate pane with fields filled and the Create CSR button highlighted.":::   
 
Sign the CSR using your PKI service. Make sure Server Auth is in Extended Key Usage and `certificate authority (CA)=true`, `keyCertSign,cRLSign`, and `basicConstraints=critical,CA:TRUE` in Basic Extension. Save the signed certifcate in .pem format.
Select **+Upload certificate**.
In the Upload certificate form, upload the certificate.pem and chain.pem files.
Select **Upload signed certificate**.

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files