MODIFIED docs/architecture/deployment-external-operations.md

Modified by rolyon on Sep 10, 2025 6:34 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Update links for monitor and insights

Changes:

Before

After

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 09/09/2025
ms.author: gasinh

#customer intent: I need to understand subscriptions and billing, consumer app security, and how to prevent fraud tactics in Microsoft Entra External ID. 

Microsoft Entra External ID stores sign-in and audit logs for 30 days. For retention and analysis, export this information to an external storage or tool. 

Configure [Azure Monitor](/azure/azure-monitor/fundamentals/overview) as a bridge to export logs. See the following diagram of Microsoft Entra External ID log exports with Azure Monitor. 

   [ ![Diagram of log exports with Azure Monitor.](media/deployment-external/log-export.png)](media/deployment-external/log-export-expanded.png#lightbox)


### Dashboards: Operational telemetry and security insights

Microsoft Entra External ID has built-in dashboards with useful telemetry from key areas such as authentication trends, MFA usage, and protections related to SMS verification. Use insights to maintain visibility into your identity system health and threat posture. For your deployment and operational strategy, we recommended you incorporate regular metrics monitoring. Detect anomalies, assess risk exposure, and ensure the effectiveness of security controls. Use the following table to see metrics and details.

|Metric|Details|

manager: martinco
ms.service: entra-external-id
ms.topic: concept-article
ms.date: 09/10/2025
ms.author: gasinh

#customer intent: I need to understand subscriptions and billing, consumer app security, and how to prevent fraud tactics in Microsoft Entra External ID. 

Microsoft Entra External ID stores sign-in and audit logs for 30 days. For retention and analysis, export this information to an external storage or tool. 

Configure Azure Monitor as a bridge to export logs. See the following diagram of Microsoft Entra External ID log exports with Azure Monitor. For more information, see [Set up Azure Monitor in external tenants](../external-id/customers/how-to-azure-monitor.md).

   [ ![Diagram of log exports with Azure Monitor.](media/deployment-external/log-export.png)](media/deployment-external/log-export-expanded.png#lightbox)


### Dashboards: Operational telemetry and security insights

Microsoft Entra External ID has built-in dashboards with useful telemetry from key areas such as authentication trends, MFA usage, and protections related to SMS verification. Use insights to maintain visibility into your identity system health and threat posture. For your deployment and operational strategy, we recommended you incorporate regular metrics monitoring. Detect anomalies, assess risk exposure, and ensure the effectiveness of security controls. Use the following table to see metrics and details. For more information, see [Gain insights into your app users' activity](../external-id/customers/how-to-user-insights.md).

|Metric|Details|

MODIFIED docs/identity/managed-identities-azure-resources/grant-managed-identity-recource-access-powershell.md

Modified by Sherman Ouko on Sep 10, 2025 12:01 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Refactor MSI docs

Changes:

Before

After

---
title: Assign a managed identity access to an Azure resource or another resource
description: Step-by-step instructions for assigning a managed identity access to an Azure resource or another resource.
 
author: SHERMANOUKO
manager: CelesteDG
ms.author: shermanouko
---
 
# Use Azure portal to grant a managed identity access to a resource
 
This article shows you how to use PowerShell to give a managed identity access to an Azure resource. In this article, we use the example of an Azure virtual machine (Azure VM) managed identity accessing an Azure storage account. Once you've configured an Azure resource with a managed identity, you can then give the managed identity access to another resource, similar to any security principal.
 

---
title: Use PowerShell to grant a managed identity access to a resource
description: Step-by-step instructions on using PowerShell to assign a managed identity access to an Azure resource or another resource.
 
author: SHERMANOUKO
manager: CelesteDG
ms.author: shermanouko
---
 
# Use PowerShell to grant a managed identity access to a resource
 
This article shows you how to use PowerShell to give a managed identity access to an Azure resource. In this article, we use the example of an Azure virtual machine (Azure VM) managed identity accessing an Azure storage account. Once you've configured an Azure resource with a managed identity, you can then give the managed identity access to another resource, similar to any security principal.
 

MODIFIED docs/identity/managed-identities-azure-resources/grant-managed-identity-resource-access-azure-portal.md

Modified by Stacy Chambers on Sep 10, 2025 4:05 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: pencil edit

Changes:

Before

After

 
## Use Azure RBAC to assign a managed identity access to another resource using the Azure portal
 
The steps outlined below show is how you grant access to a service using Azure RBAC. Check specific service documentation on how to grant access; for example, check [Azure Data Explorer](/azure/data-explorer/data-explorer-overview) for instructions. Some Azure services are in the process of adopting Azure RBAC on the data plane.
 
1. Sign in to the [Azure portal](https://portal.azure.com) using an account associated with the Azure subscription for which you've configured the managed identity.

 
## Use Azure RBAC to assign a managed identity access to another resource using the Azure portal
 
The steps outlined below show how you grant access to a service using Azure RBAC. Check specific service documentation on how to grant access; for example, check [Azure Data Explorer](/azure/data-explorer/data-explorer-overview) for instructions. Some Azure services are in the process of adopting Azure RBAC on the data plane.
 
1. Sign in to the [Azure portal](https://portal.azure.com) using an account associated with the Azure subscription for which you've configured the managed identity.

MODIFIED docs/identity/managed-identities-azure-resources/manage-user-assigned-managed-identities-azure-cli.md

Modified by Stacy Chambers on Sep 10, 2025 4:04 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: pencil edit

Changes:

Before

After

 
    Deleting a user-assigned managed identity won't remove the reference from any resource it was assigned to. Remove those from the resource itself. For example, for a VM or virtual machine scale set, use the `az vm/vmss identity remove` command.
 
## Related conmtent
 
For a full list of Azure CLI identity commands, see [az identity](/cli/azure/identity).

 
    Deleting a user-assigned managed identity won't remove the reference from any resource it was assigned to. Remove those from the resource itself. For example, for a VM or virtual machine scale set, use the `az vm/vmss identity remove` command.
 
## Related content
 
For a full list of Azure CLI identity commands, see [az identity](/cli/azure/identity).

MODIFIED docs/identity/managed-identities-azure-resources/assign-app-role-managed-identity-azure-cli.md

Modified by Sherman Ouko on Sep 10, 2025 12:01 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Refactor MSI docs

Changes:

Before

After

 
## Prerequisites
 
- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](../overview.md). 
- Review the [difference between a system-assigned and user-assigned managed identity](/azure/logic-apps/authenticate-with-managed-identity).
- If you don't already have an Azure account, [sign up for a free account](https://azure.microsoft.com/free/) before continuing.

 
## Prerequisites
 
- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](./overview.md). 
- Review the [difference between a system-assigned and user-assigned managed identity](/azure/logic-apps/authenticate-with-managed-identity).
- If you don't already have an Azure account, [sign up for a free account](https://azure.microsoft.com/free/) before continuing.

MODIFIED docs/identity/managed-identities-azure-resources/assign-app-role-managed-identity-powershell.md

Modified by Sherman Ouko on Sep 10, 2025 12:01 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Refactor MSI docs

Changes:

Before

After

 
## Prerequisites
 
- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](../overview.md). 
- Review the [difference between a system-assigned and user-assigned managed identity](/azure/logic-apps/authenticate-with-managed-identity).
- If you don't already have an Azure account, [sign up for a free account](https://azure.microsoft.com/free/) before continuing.

 
## Prerequisites
 
- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](./overview.md). 
- Review the [difference between a system-assigned and user-assigned managed identity](/azure/logic-apps/authenticate-with-managed-identity).
- If you don't already have an Azure account, [sign up for a free account](https://azure.microsoft.com/free/) before continuing.

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files

🗑️ Deleted Documentation Files