πŸ“‹ Microsoft Entra Documentation Changes

Daily summary for changes since October 7th 2025, 8:05 PM PDT

Report generated on October 8th 2025, 8:05 PM PDT

πŸ“Š Summary

17
Total Commits
0
New Files
2
Modified Files
0
Deleted Files
6
Contributors

πŸ“ Modified Documentation Files

+3 / -15 lines changed
Commit: Update concept-authentication-methods-customers.md
Changes:
Before
After
 
## Issuer acceleration
 
When you use identity providers (IdPs) such as Facebook, Google, Apple, custom OpenID Connect (OIDC), or SAML, customers typically see the Microsoft sign-in page where they choose their social IdP. To streamline the sign-in experience, use the `domain_hint` parameter in the URL to skip directly to the sign-in page of the specified IdP.
 
Issuer acceleration is supported for the following social identity providers:
 
- **Facebook**: for example, `&domain_hint=facebook`.
- **Google**: for example, `&domain_hint=google`.
- **Apple**: for example, `&domain_hint=apple`.
 
### Issuer acceleration for custom OIDC providers
 
For custom identity providers, the `domain_hint` parameter depends on the app type not the identity provider type. The `domain_hint` parameter's role in issuer acceleration applies only to OIDC apps.
 
For example, if an OIDC app is using a SAML IdP to authenticate users, then you can use `domain_hint` for issuer acceleration. Conversely, if your SAML app uses an OIDC IdP, then you can't use `domain_hint` for issuer acceleration.
 
To find the correct domain value for the `domain_hint` parameter, look at the identity provider settings in your external tenant. For OIDC, set `domain_hint` to the domain specified in the **Issuer URI**.
For example, `&domain_hint=contoso.com`.
 
 
## Issuer acceleration
 
When you use identity providers such as Facebook, Google, Apple, custom OIDC, or SAML, users usually see the Microsoft sign-in page first. From there, they choose their identity provider. To simplify this experience, you can use the `domain_hint` parameter in the sign-in URL. This parameter lets you skip the Microsoft sign-in page and go directly to the selected identity provider’s sign-in page.
 
### Issuer acceleration for custom OIDC providers
 
For a custom OIDC identity provider, use the domain part of the **Issuer URI** in the `domain_hint`syntax.
 
:::image type="content" source="media/concept-authentication-methods-customers/domain-issuer-open-id-connect.png" alt-text="Screenshot showing the domain part of the issuer URI.":::
 
### Issuer acceleration for custom SAML providers
 
For a custom SAML identity provider, use the domain specified in the **Domain name of federating IdP** field in the `domain_hint` syntax.
 
:::image type="content" source="media/concept-authentication-methods-customers/domain-issuer-saml.png" alt-text="Screenshot showing the domain name of the federating IdP.":::
 
 
 
 
+1 / -1 lines changed
Commit: Clarify prerequisites for configuring domain controllers
Changes:
Before
After
 
## Prerequisites
 
To configure Microsoft Entra Private Access for Active Directory Domain Controllers, you must have:
 
- The **Global Secure Access Administrator** role in Microsoft Entra ID.
- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
 
## Prerequisites
 
To configure Microsoft Entra Private Access for Active Directory Domain Controllers, you must have the following:
 
- The **Global Secure Access Administrator** role in Microsoft Entra ID.
- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).