MODIFIED docs/identity/hybrid/how-to-group-source-of-authority-configure.md

Modified by Ortagus Winfrey on Oct 15, 2025 9:44 AM
📖 View on learn.microsoft.com

+141 / -37 lines changed

Commit: Updates

Changes:

Before

After

You can use the following PowerShell script to automate Group SOA updates by using app-based authentication.
 
```powershell
# Define your Microsoft Entra ID app details and tenant information
$tenantId = ""
$clientId = ""
$certThumbprint = ""
 
# Connect to Microsoft Graph as App-Only using a certificate. The app registration must have the Group.Read.All Group-OnPremisesSyncBehavior.ReadWrite.All permissions granted.
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateThumbprint $certThumbprint
 
#Connect to Microsoft Graph using delegated permissions
#Connect-MgGraph -Scopes "Group.Read.All Group-OnPremisesSyncBehavior.ReadWrite.All" -TenantId $tenantId
 
# Define the group name you want to query
$groupName = "HR India"
 
# Retrieve the group using group name
$group = Get-MgBetaGroup -Filter "displayName eq '$groupName'"
 

You can use the following PowerShell script to automate Group SOA updates by using app-based authentication.
 
```powershell
<#
.SYNOPSIS
    Updates groups to set isCloudManaged parameter to true for on-premises synchronized groups.
 
.DESCRIPTION
    This script reads a file containing group Ids, checks each group's OnPremisesSyncEnabled property,
    and if true, calls the onPremisesSyncBehavior API to set isCloudManaged to true.
 
.PARAMETER FilePath
    Mandatory. Path to the file containing group Ids (one per line).
 
.PARAMETER WhatIf
    Boolean parameter. When true (default), shows what would be done without making actual changes.
 
.EXAMPLE
    .\Update-GroupSoA.ps1 -FilePath "C:\temp\groups.txt"
    .\Update-GroupSoA.ps1 -FilePath "C:\temp\groups.txt" -WhatIf $false

MODIFIED docs/identity/hybrid/how-to-user-source-of-authority-configure.md

Modified by Ortagus Winfrey on Oct 15, 2025 4:39 PM
📖 View on learn.microsoft.com

+0 / -50 lines changed

Commit: Remove bulk user update from users

Changes:

Before

After

   :::image type="content" border="true" source="media/how-to-user-source-of-authority-configure/event-6956.png" alt-text="Screenshot of event ID 6956.":::
 
 
## Bulk updates for user SOA
 
You can use the following PowerShell script to automate User SOA updates by using app-based authentication.
 
```powershell
# Define your Microsoft Entra ID app details and tenant information
$tenantId = ""
$clientId = ""
$certThumbprint = ""
 
# Connect to Microsoft Graph as App-Only using a certificate. The app registration must have the User.Read.All User-OnPremisesSyncBehavior.ReadWrite.All permissions granted.
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateThumbprint $certThumbprint
 
#Connect to Microsoft Graph using delegated permissions
#Connect-MgGraph -Scopes "User.Read.All User-OnPremisesSyncBehavior.ReadWrite.All" -TenantId $tenantId
 
# Define the user name you want to query

   :::image type="content" border="true" source="media/how-to-user-source-of-authority-configure/event-6956.png" alt-text="Screenshot of event ID 6956.":::
 
### Status of attributes after you transfer SOA
 
The following table explains the status for *isCloudManaged* and *onPremisesSyncEnabled* attributes after you transfer the SOA of an object.

MODIFIED docs/global-secure-access/troubleshoot-connectors.md

Modified by Sumeet Mittal on Oct 15, 2025 3:57 PM
📖 View on learn.microsoft.com

+6 / -2 lines changed

Commit: Update connector diagnostics tool documentation

Changes:

Before

After

 
The tool also provides additional information, such as certificate details (if the cert is valid), tenant and connector ID, and TLS versions. To ensure that no checks are missed due to network or intermittent issues, the tool contains retries and prints out exception messages for any connectivity failures.
 
**How to get the tool:** The connector diagnostics tool is available in the connector installation package starting version 1.5.4287.0. Previous versions don't contain the tool. A new connector installation is needed to get the tool if you are using the previous version. 
 
**How to use the tool:** After verifying successful installation, the tool can be found in the connector installation folder, located by default in C:/Program Files/Microsoft Entra Private Network Connector. Double click the application "ConnectorDiagnosticsTool" to launch the tool. 
 
![Screenshot showing the "ConnectorDiagnosticsTool" application selected in file explorer.](https://github.com/user-attachments/assets/76feaf98-9f2c-492c-bb66-7d65fa4dc576)
 
Sample Output:
 
![Screenshot showing the "ConnectorDiagnosticsTool" application output.](https://github.com/user-attachments/assets/93cec4e8-58bd-4656-8ff6-c4299e7d5b82)
 
## Verify connectivity to the cloud application proxy service and Microsoft sign in page
 
**Objective:** Verify that the connector machine can connect to the application proxy registration endpoint and the Microsoft sign-in page.

 
The tool also provides additional information, such as certificate details (if the cert is valid), tenant and connector ID, and TLS versions. To ensure that no checks are missed due to network or intermittent issues, the tool contains retries and prints out exception messages for any connectivity failures.
 
**How to get the tool:** The connector diagnostics tool is available in the connector installation package starting version 1.5.4287.0. Previous versions don't contain the tool. A new connector installation is needed to get the tool if you are using the previous version. A user interface is also introduced starting version 1.5.4522.0. 
 
**How to use the tool:** After verifying successful installation, the tool can be found in the connector installation folder, located by default in C:/Program Files/Microsoft Entra Private Network Connector. Double click the application "ConnectorDiagnosticsTool" to launch the tool. 
 
![Screenshot showing the "ConnectorDiagnosticsTool" application selected in file explorer.](https://github.com/user-attachments/assets/76feaf98-9f2c-492c-bb66-7d65fa4dc576)
 
Sample PowerShell Output:
 
![Screenshot showing the "ConnectorDiagnosticsTool" application output.](https://github.com/user-attachments/assets/93cec4e8-58bd-4656-8ff6-c4299e7d5b82)
 
Sample User Interface Output (Starting version 1.5.4522.0):
 
![Screenshot showing the "ConnectorDiagnosticsTool" application UI output.](https://github.com/user-attachments/assets/e04fd857-3495-48d0-a4f8-5938d19785ac)
 
## Verify connectivity to the cloud application proxy service and Microsoft sign in page
 
**Objective:** Verify that the connector machine can connect to the application proxy registration endpoint and the Microsoft sign-in page.

MODIFIED docs/identity/enterprise-apps/manage-app-consent-policies.md

Modified by Erin Greenlee on Oct 15, 2025 5:08 PM
📖 View on learn.microsoft.com

+5 / -0 lines changed

Commit: Revise consent policy for MS Graph permissions

Changes:

Before

After

 
Updates to this consent policy will have at least 30 days of given notice.
 
## Multiple policies
 
A user can have more than one policy that allows them to give consent. Each policy is evaluated separately (as in, an exclusion from one policy does not affect inclusions of another policy) and the user only needs one policy to approve to be allowed to consent for a specific event. For example, an application admin can consent to everything a regular user can (thanks to the default policy applied to all users), and they also have broader permissions through the microsoft-application-admin policy, which lets them approve requests for any API permission—except Microsoft Graph app roles.

 
Updates to this consent policy will have at least 30 days of given notice.
 
> [!NOTE]
> Starting at the end of October 2025, the Microsoft managed policy will be updated to require admin consent for the following MS Graph permissions: Mail.Read, Mail.ReadWrite, Mail.ReadBasic, Mail.Read.Shared, Mail.ReadBasic.Shared, Mail.ReadWrite.Shared, MailboxItem.Read, Calendars.Read, Calendars.ReadBasic, Calendars.ReadWrite, Calendars.Read.Shared, Calendars.ReadBasic.Shared, Calendars.ReadWrite.Shared, Chat.Read, Chat.ReadWrite, ChannelMessage.Read.All,OnlineMeetings.Read, OnlineMeetings.ReadWrite, OnlineMeetingTranscript.Read.All, OnlineMeetingsRecording.Read.All. At the end of November 2025, this will expand to include EAS.AccessAsUser.All, EWS.AccessAsUser.All, IMAP.AcessAsUser.All, POP.AccessAsUser.All
 
## Multiple policies
 
A user can have more than one policy that allows them to give consent. Each policy is evaluated separately (as in, an exclusion from one policy does not affect inclusions of another policy) and the user only needs one policy to approve to be allowed to consent for a specific event. For example, an application admin can consent to everything a regular user can (thanks to the default policy applied to all users), and they also have broader permissions through the microsoft-application-admin policy, which lets them approve requests for any API permission—except Microsoft Graph app roles.

MODIFIED docs/external-id/customers/overview-solutions-customers.md

Modified by csmulligan on Oct 15, 2025 9:56 AM
📖 View on learn.microsoft.com

+3 / -0 lines changed

Commit: Added Woodgrove note.

Changes:

Before

After

 
Microsoft Entra External ID offers solutions that let you quickly add intuitive, user-friendly sign-up and sign-up experiences for your consumer and business customer apps. The Woodgrove Groceries demo environment illustrates several of the most common authentication experiences that can be configured for your apps.
 
## Use cases
 
### Sign-up with an email and password

 
Microsoft Entra External ID offers solutions that let you quickly add intuitive, user-friendly sign-up and sign-up experiences for your consumer and business customer apps. The Woodgrove Groceries demo environment illustrates several of the most common authentication experiences that can be configured for your apps.
 
> [!NOTE]
> The Woodgrove demo is currently unavailable and may work intermittently. This is a temporary issue while we implement a permanent fix. We apologize for the inconvenience.
 
## Use cases
 
### Sign-up with an email and password

MODIFIED docs/identity/hybrid/what-is-inter-directory-provisioning.md

Modified by Jackline Omondi on Oct 15, 2025 11:33 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update link to common scenarios in documentation

Changes:

Before

After

 
### Common scenarios
For a list of common hybrid synchronization scenarios, see [Common scenarios](#common-scenarios).
 
## Next steps 
- [What is identity lifecycle management](~/id-governance/scenarios/govern-the-employee-lifecycle.md)

 
### Common scenarios
For a list of common hybrid synchronization scenarios, see [Common scenarios](common-scenarios.md).
 
## Next steps 
- [What is identity lifecycle management](~/id-governance/scenarios/govern-the-employee-lifecycle.md)

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files