MODIFIED docs/identity/conditional-access/resilience-defaults.md

Modified by John Flores on Sep 2, 2025 6:27 PM
📖 View on learn.microsoft.com

+29 / -27 lines changed

Commit: [Conditional Access] August Freshness Quality pass2

Changes:

Before

After

ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: dawoo
---
# Conditional Access: Resilience defaults
 
If there was an outage of the primary authentication service, the Microsoft Entra Backup Authentication Service can automatically issue access tokens to applications for existing sessions. This functionality significantly increases Microsoft Entra resilience, because reauthentications for existing sessions account for more than 90% of authentications to Microsoft Entra ID. The Backup Authentication Service doesn't support new sessions or authentications by guest users.
 
For authentications protected by Conditional Access, policies are reevaluated before access tokens are issued to determine:
 
1. Which Conditional Access policies apply?
1. For policies that do apply, were the required controls are satisfied?
 
During an outage, not all conditions can be evaluated in real time by the Backup Authentication Service to determine whether a Conditional Access policy should apply. Conditional Access resilience defaults are a new session control that lets admins decide between:
 
- Whether to block authentications during an outage whenever a policy condition can’t be evaluated in real-time.
- Allow policies to be evaluated using data collected at the beginning of the user’s session.
 
> [!IMPORTANT]

ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: 
---
# Conditional Access: Resilience defaults
 
If there is an outage of the primary authentication service, the Microsoft Entra Backup Authentication Service automatically issues access tokens to applications for existing sessions. This functionality significantly increases Microsoft Entra resilience because reauthentications for existing sessions account for more than 90% of authentications to Microsoft Entra ID. The Backup Authentication Service doesn't support new sessions or authentications by guest users.
 
For authentications protected by Conditional Access, policies are reevaluated before access tokens are issued to determine:
 
1. Which Conditional Access policies apply?
1. For policies that do apply, are the required controls satisfied?
 
During an outage, the Backup Authentication Service can't evaluate all conditions in real time to determine whether a Conditional Access policy applies. Conditional Access resilience defaults are a new session control that let admins decide between:
 
- Whether to block authentications during an outage whenever a policy condition can’t be evaluated in real-time.
- Allow policies to be evaluated using data collected at the beginning of the user’s session.
 
> [!IMPORTANT]

MODIFIED docs/global-secure-access/how-to-install-android-client.md

Modified by jayrusso on Sep 2, 2025 8:21 PM
📖 View on learn.microsoft.com

+26 / -25 lines changed

Commit: Sep 02 updates per Review team

Changes:

Before

After

description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
ms.service: global-secure-access
ms.topic: how-to
ms.date: 08/27/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: dougeby
1. On the **Basics** tab:
    1. Enter a **Name**.
    1. Set the **Platform** to **Android Enterprise**.
1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
    1. Set the **Targeted app** to **Microsoft Defender**. 
1. Select **Next**.
:::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Create app configuration policy on the Basics tab.":::   
 
1. On the **Settings** tab:
    1. Set **Configuration settings format** to **Use configuration designer**.
1. Use the JSON editor to configure the disabled configuration keys, and then select the **+ Add** button.
    1. In the search field, type `global` and select these configuration keys:
        - **Global Secure Access** (this key is required to enable Global Secure Access). 

description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
ms.service: global-secure-access
ms.topic: how-to
ms.date: 09/02/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: dougeby
1. On the **Basics** tab:
    1. Enter a **Name**.
    1. Set the **Platform** to **Android Enterprise**.
    1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
    1. Set the **Targeted app** to **Microsoft Defender**. 
1. Select **Next**.
:::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Create app configuration policy on the Basics tab." lightbox="media/how-to-install-android-client/create-policy-basics-expanded.png":::   
 
1. On the **Settings** tab:
    1. Set **Configuration settings format** to **Use configuration designer**.
    1. Use the JSON editor to configure the disabled configuration keys:
        1. Select the **+ Add** button.
        1. In the search field, type `global` and select these configuration keys:

MODIFIED docs/identity/conditional-access/howto-conditional-access-session-lifetime.md

Modified by John Flores on Sep 2, 2025 6:27 PM
📖 View on learn.microsoft.com

+22 / -19 lines changed

Commit: [Conditional Access] August Freshness Quality pass2

Changes:

Before

After

---
title: Configure adaptive session lifetime policies
description: Customize Microsoft Entra authentication session configuration including user sign-in frequency and browser session persistence.
 
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: how-to
ms.date: 08/13/2024
 
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: inbarc
---
# Configure adaptive session lifetime policies
 
> [!WARNING]
> If you are using the [configurable token lifetime](~/identity-platform/configurable-token-lifetimes.md) feature currently in public preview, please note that we don’t support creating two different policies for the same user or app combination: one with this feature and another one with configurable token lifetime feature. Microsoft retired the configurable token lifetime feature for refresh and session token lifetimes on January 30, 2021 and replaced it with the Conditional Access authentication session management feature.  
>
> Before enabling Sign-in Frequency, make sure other reauthentication settings are disabled in your tenant. If "Remember MFA on trusted devices" is enabled, be sure to disable it before using Sign-in frequency, as using these two settings together may lead to prompting users unexpectedly. To learn more about reauthentication prompts and session lifetime, see the article, [Optimize reauthentication prompts and understand session lifetime for Microsoft Entra multifactor authentication](~/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md).

---
title: Adaptive Session Lifetime Policies for Conditional Access
description: Learn how to configure adaptive session lifetime policies in Microsoft Entra to manage sign-in frequency and browser session persistence effectively.
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: how-to
ms.date: 09/02/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: inbarc
ms.custom:
  - ai-gen-docs-bap
  - ai-gen-title
  - ai-seo-date:09/02/2025
  - ai-gen-description
---
# Configure adaptive session lifetime policies
 
> [!WARNING]

MODIFIED docs/identity/conditional-access/troubleshoot-policy-changes-audit-log.md

Modified by John Flores on Sep 2, 2025 6:27 PM
📖 View on learn.microsoft.com

+20 / -16 lines changed

Commit: [Conditional Access] August Freshness Quality pass2

Changes:

Before

After

---
title: Troubleshoot Conditional Access policy changes
description: Diagnose changes to Conditional Access policy with the Microsoft Entra audit logs.
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: troubleshooting
ms.date: 08/13/2024
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: calebb, martinco
ms.custom: sfi-image-nochange
---
# Use audit logs to troubleshoot Conditional Access policy changes
 
The Microsoft Entra audit log is a valuable source of information when troubleshooting why and how Conditional Access policy changes happened in your environment.
 
Audit log data is only kept for 30 days by default, which might not be long enough for every organization. Organizations can store data for longer periods by changing diagnostic settings in Microsoft Entra ID to:
 
- Send data to a Log Analytics workspace

---
title: Troubleshoot Conditional Access policy changes
description: Learn how to use Microsoft Entra audit logs to identify and troubleshoot Conditional Access policy modifications in your environment.
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: troubleshooting
ms.date: 09/02/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
ms.reviewer: calebb, martinco
ms.custom:
  - sfi-image-nochange
  - ai-gen-docs-bap
  - ai-gen-description
  - ai-seo-date:09/02/2025
---
# Use audit logs to troubleshoot Conditional Access policy changes
 
The Microsoft Entra audit log is a valuable source of information when troubleshooting why and how Conditional Access policy changes happened in your environment.

MODIFIED docs/identity/conditional-access/policy-admin-phish-resistant-mfa.md

Modified by John Flores on Sep 2, 2025 6:27 PM
📖 View on learn.microsoft.com

+17 / -17 lines changed

Commit: [Conditional Access] August Freshness Quality pass2

Changes:

Before

After

ms.service: entra-id
ms.subservice: conditional-access
ms.topic: how-to
ms.date: 09/30/2024
 
ms.author: joflore
author: MicrosoftGuyJFlo
---
# Require phishing-resistant multifactor authentication for administrators
 
Accounts that are assigned privileged administrative roles are frequent targets of attackers. Requiring phishing-resistant multifactor authentication (MFA) on those accounts is an easy way to reduce the risk of those accounts being compromised.
 
> [!CAUTION]
> Before creating a policy requiring phishing-resistant multifactor authentication, ensure your administrators have the appropriate methods registered. If you enable this policy without completing this step you risk locking yourself out of your tenant. Administrators can [Configure Temporary Access Pass to register passwordless authentication methods](../authentication/howto-authentication-temporary-access-pass.md) or follow the steps in [Register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md).
 
Microsoft recommends you require phishing-resistant multifactor authentication on the following roles at a minimum:
 
[!INCLUDE [conditional-access-admin-roles](../../includes/conditional-access-admin-roles.md)]
 
Organizations might choose to include or exclude roles based on their own requirements.

ms.service: entra-id
ms.subservice: conditional-access
ms.topic: how-to
ms.date: 09/02/2025
 
ms.author: joflore
author: MicrosoftGuyJFlo
---
# Require phishing-resistant multifactor authentication for administrators
 
Accounts with privileged administrative roles are frequent targets of attackers. Requiring phishing-resistant multifactor authentication (MFA) for these accounts reduces the risk of compromise.
 
> [!CAUTION]
> Before creating a policy requiring phishing-resistant multifactor authentication, make sure your administrators register the appropriate methods. Enabling this policy without completing this step risks locking you out of your tenant. Administrators can [configure Temporary Access Pass to register passwordless authentication methods](../authentication/howto-authentication-temporary-access-pass.md) or follow the steps in [register a passkey (FIDO2)](../authentication/how-to-register-passkey-with-security-key.md).
 
Microsoft recommends requiring phishing-resistant multifactor authentication for at least the following roles:
 
[!INCLUDE [conditional-access-admin-roles](../../includes/conditional-access-admin-roles.md)]
 
Organizations can include or exclude roles based on their requirements.

MODIFIED docs/identity/conditional-access/troubleshoot-conditional-access-what-if.md

Modified by John Flores on Sep 2, 2025 6:27 PM
📖 View on learn.microsoft.com

+12 / -12 lines changed

Commit: [Conditional Access] August Freshness Quality pass2

Changes:

Before

After

 
The [What If tool](what-if-tool.md) in Conditional Access is powerful when trying to understand why a policy was or wasn't applied to a user in a specific circumstance or if a policy would apply in a known state.
 
The What If tool is located in the **Microsoft Entra admin center** > **Entra ID** > **Conditional Access** > **Policies** > **What If**.
 
![Conditional Access What If tool at default state](./media/troubleshoot-conditional-access-what-if/conditional-access-what-if-tool.png)
 
## Gathering information
 
The What If tool requires only a **User** or **Workload identity** to get started.
 
The following additional information is optional but helps narrow the scope for specific cases.
 
* Cloud apps, actions, or authentication context
* IP address
* Country/Region
* Device platform
* Client apps
* Device state
 

 
The [What If tool](what-if-tool.md) in Conditional Access is powerful when trying to understand why a policy was or wasn't applied to a user in a specific circumstance or if a policy would apply in a known state.
 
Find the What If tool in the **Microsoft Entra admin center** > **Entra ID** > **Conditional Access** > **Policies** > **What If**.
 
![Screenshot of the Conditional Access What If tool at its default state.](./media/troubleshoot-conditional-access-what-if/conditional-access-what-if-tool.png)
 
## Gathering information
 
The What If tool needs only a **User** or **Workload identity** to get started.
 
The following additional information is optional but helps narrow the scope for specific cases:
 
* Cloud apps, actions, or authentication context
* IP address
* Country/region
* Device platform
* Client apps
* Device state
 

MODIFIED docs/identity/conditional-access/concept-conditional-access-session.md

Modified by kyracatwork on Sep 2, 2025 5:39 PM
📖 View on learn.microsoft.com

+4 / -17 lines changed

Commit: Update concept-conditional-access-session.md

Changes:

Before

After

 
## Conditional Access application control
 
Conditional Access App Control uses a reverse proxy architecture and is uniquely integrated with Microsoft Entra Conditional Access. Microsoft Entra Conditional Access allows you to enforce access controls on your organization’s apps based on certain conditions. The conditions define what user or group of users, cloud apps, and locations and networks a Conditional Access policy applies to. After you determine the conditions, you can route users to where access and session controls apply.
 
### Microsoft Defender for Cloud Apps
[Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps) is where you can protect data with Conditional Access App Control by applying access and session controls.
 
Conditional Access App Control enables user app access and sessions to be monitored and controlled in real time based on access and session policies. Access and session policies are used within the Defender for Cloud Apps portal to refine filters and set actions to take. With the access and session policies, you can:
 
- Prevent data exfiltration: You can block the download, cut, copy, and print of sensitive documents on, for example, unmanaged devices.
- Protect on download: Instead of blocking the download of sensitive documents, you can require documents to be labeled and protected with Azure Information Protection. This action ensures the document is protected and user access is restricted in a potentially risky session.
- Prevent upload of unlabeled files: Before a sensitive file is uploaded, distributed, and used, it’s important to make sure that the file has the right label and protection. You can ensure that unlabeled files with sensitive content are blocked from being uploaded until the user classifies the content.
- Monitor user sessions for compliance (Preview): Risky users are monitored when they sign into apps and their actions are logged from within the session. You can investigate and analyze user behavior to understand where, and under what conditions, session policies should be applied in the future.
- Block access (Preview): You can granularly block access for specific apps and users depending on several risk factors. For example, you can block them if they're using client certificates as a form of device management.
- Block custom activities: Some apps have unique scenarios that carry risk, for example, sending messages with sensitive content in apps like Microsoft Teams or Slack. In these kinds of scenarios, you can scan messages for sensitive content and block them in real time.
 
For more information, see the article [Deploy Conditional Access App Control for featured apps](/defender-cloud-apps/proxy-deployment-aad).
 
### Microsoft Purview Data Loss Prevention

 
## Conditional Access application control
 
Conditional Access App Control uses a reverse proxy architecture and is uniquely integrated with Microsoft Entra Conditional Access. Microsoft Entra Conditional Access allows you to enforce access controls on your organization’s apps based on certain conditions. The conditions define what user or group of users, cloud apps, and locations and networks a Conditional Access policy applies to. After you determine the conditions, you can route users to Microsoft Defender for Cloud Apps where you can protect data with Conditional Access App Control by applying access and session controls.
 
Conditional Access App Control enables user app access and sessions to be monitored and controlled in real time based on access and session policies. Access and session policies are used within the Defender for Cloud Apps portal to refine filters and set actions to take. 
 
This control can be enforced with [Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps), where Admins can [Deploy Conditional Access App Control for featured apps](/defender-cloud-apps/proxy-deployment-aad) and [use Microsoft Defender for Cloud Apps session policies](/defender-cloud-apps/session-policy-aad).
 
For Microsoft Edge for Business, this control can be enforced with [Microsoft Purview Data Loss Prevention](/purview/dlp-browser-dlp-learn), where Admins can [help prevent users from sharing sensitive info with Cloud Apps in Edge for Business](/purview/dlp-create-policy-prevent-cloud-sharing-from-edge-biz). The Conditional Access App Control **Custom** setting is required for apps included in these policies.
 
## Sign-in frequency

MODIFIED docs/identity/saas-apps/timetabling-solutions-tutorial.md

Modified by omondiatieno on Sep 2, 2025 10:17 AM
📖 View on learn.microsoft.com

+5 / -6 lines changed

Commit: Update console name

Changes:

Before

After

ms.service: entra-id
ms.subservice: saas-apps
ms.topic: how-to
ms.date: 05/20/2025
ms.author: gideonkiratu
ms.custom: sfi-image-nochange
# Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Timetabling Solutions so that I can control who has access to Timetabling Solutions, enable automatic sign-in with Microsoft Entra accounts, and manage my accounts in one central location.
 
## Configure Timetabling Solutions SSO
 
In this section, you populate the relevant SSO values in the Timetabling Solutions Administration Console.
 
1. In the [Administration Console](https://admin.timetabling.education/), select **5 Settings**, and then select the **SAML SSO** tab.
1. Perform the following steps in the **SAML SSO** section:
 
    ![Screenshot for SSO settings.](./media/timetabling-solutions-tutorial/timetabling-configuration.png)
    
    f. **Save** the settings. 
 
 

ms.service: entra-id
ms.subservice: saas-apps
ms.topic: how-to
ms.date: 09/02/2025
ms.author: gideonkiratu
ms.custom: sfi-image-nochange
# Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Timetabling Solutions so that I can control who has access to Timetabling Solutions, enable automatic sign-in with Microsoft Entra accounts, and manage my accounts in one central location.
 
## Configure Timetabling Solutions SSO
 
In this section, you populate the relevant SSO values in the Timetabling Solutions Management Portal.
 
1. In the [Management Portal](https://admin.timetabling.education/), select **5 Settings**, and then select the **SAML SSO** tab.
1. Perform the following steps in the **SAML SSO** section:
 
    ![Screenshot for SSO settings.](./media/timetabling-solutions-tutorial/timetabling-configuration.png)
    
    f. **Save** the settings. 
 
## Create Timetabling Solutions test user

MODIFIED docs/includes/entra-policy-exclude-user.md

Modified by John Flores on Sep 2, 2025 7:09 PM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: [Includes] Update

Changes:

Before

After

ms.service: entra-id
ms.subservice: conditional-access
ms.topic: include
ms.date: 09/17/2024
 
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
---
Conditional Access policies are powerful tools, we recommend excluding the following accounts from your policies:
 
- **Emergency access** or **break-glass** accounts to prevent lockout due to policy misconfiguration. In the unlikely scenario all administrators are locked out, your emergency-access administrative account can be used to log in and take steps to recover access.
   - More information can be found in the article, [Manage emergency access accounts in Microsoft Entra ID](~/identity/role-based-access-control/security-emergency-access.md).
- **Service accounts** and **Service principals**, such as the Microsoft Entra Connect Sync Account. Service accounts are non-interactive accounts that aren't tied to any particular user. They're normally used by back-end services allowing programmatic access to applications, but are also used to sign in to systems for administrative purposes. Calls made by service principals won't be blocked by Conditional Access policies scoped to users. Use Conditional Access for workload identities to define policies targeting service principals.
   - If your organization has these accounts in use in scripts or code, consider replacing them with [managed identities](~/identity/managed-identities-azure-resources/overview.md).

ms.service: entra-id
ms.subservice: conditional-access
ms.topic: include
ms.date: 09/02/2025
 
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
---
Conditional Access policies are powerful tools. We recommend excluding the following accounts from your policies:
 
- **Emergency access** or **break-glass** accounts to prevent lockout due to policy misconfiguration. In the unlikely scenario where all administrators are locked out, your emergency access administrative account can be used to sign in and recover access.
   - More information can be found in the article, [Manage emergency access accounts in Microsoft Entra ID](~/identity/role-based-access-control/security-emergency-access.md).
- **Service accounts** and **Service principals**, such as the Microsoft Entra Connect Sync Account. Service accounts are noninteractive accounts that aren't tied to any specific user. They're typically used by backend services to allow programmatic access to applications, but they're also used to sign in to systems for administrative purposes. Calls made by service principals aren't blocked by Conditional Access policies scoped to users. Use Conditional Access for workload identities to define policies that target service principals.
   - If your organization uses these accounts in scripts or code, replace them with [managed identities](~/identity/managed-identities-azure-resources/overview.md).

MODIFIED docs/fundamentals/whats-new.md

Modified by Ortagus Winfrey on Sep 2, 2025 4:24 PM
📖 View on learn.microsoft.com

+10 / -0 lines changed

Commit: Remove all access packages added to whats new

Changes:

Before

After

 
## August 2025
 
### Plan for change - New end user homepage in My Account
 
**Type:** New feature

 
## August 2025
 
### Public preview - Lifecycle Workflows task now supports setting Access Package assignments expiration
 
**Type:** New feature      
**Service category:** Lifecycle Workflows    
**Product capability:** Identity Governance  
 
Customers can now configure the remove all access packages task in Lifecycle Workflows to automatically expire access packages assignments after a specified number of days when employees leave the organization. For more information, see: [Remove all access package assignments for user](../id-governance/lifecycle-workflow-tasks.md#remove-all-access-package-assignments-for-user).
 
---
 
### Plan for change - New end user homepage in My Account
 
**Type:** New feature

MODIFIED docs/includes/conditional-access-report-only-mode.md

Modified by John Flores on Sep 2, 2025 7:09 PM
📖 View on learn.microsoft.com

+5 / -4 lines changed

Commit: [Includes] Update

Changes:

Before

After

---
ms.author: joflore
author: MicrosoftGuyJFlo
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: include
ms.date: 02/03/2025
---
After administrators evaluate the policy settings using [policy impact or report-only mode](../identity/conditional-access/concept-conditional-access-report-only.md#reviewing-results), they can move the **Enable policy** toggle from **Report-only** to **On**.
 

---
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: include
ms.date: 09/02/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
---
After confirming your settings using [policy impact or report-only mode](../identity/conditional-access/concept-conditional-access-report-only.md#reviewing-results), move the **Enable policy** toggle from **Report-only** to **On**.

MODIFIED docs/global-secure-access/how-to-install-ios-client.md

Modified by jayrusso on Sep 2, 2025 8:21 PM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Sep 02 updates per Review team

Changes:

Before

After

description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the iOS client app.
ms.service: global-secure-access
ms.topic: how-to
ms.date: 08/08/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: dougeby
ms.reviewer: dhruvinrshah
ms.custom: sfi-image-nochange
# Customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for iOS devices.
---
        |  |0 |Private Access isn't enabled and the toggle option isn't visible to user. |
        |  |1 |The Private Access toggle is visible and defaults to disabled state. User can enable or disable. |
        |  |2 |The Private Access toggle is visible and defaults to enabled state. User can enable or disable. |
        |  |3 |The Private Access toggle is visible but greyed out, and defaults to enabled state. The user **can't** disable Private Access. |
 
1. Continue filling out the VPN form:  
    - **Type of Automatic VPN**: On-demand VPN
## Troubleshooting
- The Global Secure Access tile doesn't appear in the Defender app after onboarding the tenant:

description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the iOS client app.
ms.service: global-secure-access
ms.topic: how-to
ms.date: 09/02/2025
ms.author: jayrusso
author: HULKsmashGithub
manager: dougeby
ms.reviewer: cagautham
ms.custom: sfi-image-nochange
# Customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for iOS devices.
---
        |  |0 |Private Access isn't enabled and the toggle option isn't visible to user. |
        |  |1 |The Private Access toggle is visible and defaults to disabled state. User can enable or disable. |
        |  |2 |The Private Access toggle is visible and defaults to enabled state. User can enable or disable. |
        |  |3 |The Private Access toggle is visible but grayed out, and defaults to enabled state. The user **can't** disable Private Access. |
 
1. Continue filling out the VPN form:  
    - **Type of Automatic VPN**: On-demand VPN
## Troubleshooting
- The Global Secure Access tile doesn't appear in the Defender app after onboarding the tenant:

MODIFIED docs/includes/entra-policy-deploy-template.md

Modified by John Flores on Sep 2, 2025 7:09 PM
📖 View on learn.microsoft.com

+5 / -3 lines changed

Commit: [Includes] Update

Changes:

Before

After

---
author: joflore
ms.service: entra-id
ms.topic: include
ms.date: 07/18/2023
ms.author: joflore
---
## Template deployment
 
Organizations can choose to deploy this policy using the steps outlined below or using the [Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md).
 
 

---
ms.service: entra-id
ms.subservice: conditional-access
ms.topic: include
ms.date: 09/02/2025
ms.author: joflore
author: MicrosoftGuyJFlo
manager: dougeby
---
## Template deployment
 
Organizations can deploy this policy by following the steps outlined below or by using the [Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md).

MODIFIED docs/identity/saas-apps/acunetix-360-provisioning-tutorial.md

Modified by omondiatieno on Sep 2, 2025 11:18 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: update ms.author, reviewer and manager alias

Changes:

Before

After

---
title: Configure Acunetix 360 for automatic user provisioning with Microsoft Entra ID
description: Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Acunetix 360.
author: adimitui
manager: jeedes
ms.service: entra-id
ms.subservice: saas-apps
ms.topic: how-to
ms.date: 03/25/2025
ms.author: addimitu
 
# Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Acunetix 360 so that I can streamline the user management process and ensure that users have the appropriate access to Acunetix 360.
 

---
title: Configure Acunetix 360 for automatic user provisioning with Microsoft Entra ID
description: Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Acunetix 360.
author: jeevansd
manager: pmwongera
ms.service: entra-id
ms.subservice: saas-apps
ms.topic: how-to
ms.date: 03/25/2025
ms.author: jeedes
 
# Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Acunetix 360 so that I can streamline the user management process and ensure that users have the appropriate access to Acunetix 360.
 

MODIFIED docs/identity/saas-apps/airbase-provisioning-tutorial.md

Modified by omondiatieno on Sep 2, 2025 11:18 AM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: update ms.author, reviewer and manager alias

Changes:

Before

After

---
title: Configure Airbase for automatic user provisioning with Microsoft Entra ID
description: Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Airbase.
author: adimitui
manager: jeedes
ms.service: entra-id
ms.subservice: saas-apps
ms.topic: how-to
ms.date: 03/25/2025
ms.author: addimitu
 
# Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Airbase so that I can streamline the user management process and ensure that users have the appropriate access to Airbase.
 

---
title: Configure Airbase for automatic user provisioning with Microsoft Entra ID
description: Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Airbase.
author: jeevansd
manager: pmwongera
ms.service: entra-id
ms.subservice: saas-apps
ms.topic: how-to
ms.date: 03/25/2025
ms.author: jeedes
 
# Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Airbase so that I can streamline the user management process and ensure that users have the appropriate access to Airbase.
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files