📋 Microsoft Entra Documentation Changes

description: Enable Termination Lookahead query for your Workday-to-AD/Microsoft Entra ID provisioning job.

#customer intent: As an IT admin, I want to understand how to enable the Workday Termination Lookahead query so I can leverage it for Workday-to-AD/Microsoft Entra ID provisioning.

This adjustment ensures the termination data is available earlier for workers in time zones ahead of Pacific Time. By updating attribute mapping rules in Microsoft Entra ID, you can then implement time-zone aware terminations.

## Job configuration

### Policy inventory

 

- What are your organization's policies for governing access to the applications

- What are the compliance requirements for the applications to be integrated and properly licensed

 

- Another LDAP directory

- In other applications such as within SAP Cloud Identity Services

There are several ways that you might manage applications in Microsoft Entra ID. The easiest way to start managing an application is to use a preintegrated application from the Microsoft Entra gallery, for both SaaS and on-premises or private cloud hosted applications. Developing your own application and registering it in Microsoft Entra ID is an option.

If you want to deploy an on-premises application or continue using an existing on-premises application, but take advantage of what Microsoft Entra ID offers, connect it with Microsoft Entra ID using [Microsoft Entra Private Access](../../global-secure-access/overview-what-is-global-secure-access.md), [Microsoft Entra application proxy](/entra/identity/app-proxy) or [provisioning](../app-provisioning/user-provisioning.md), depending on the supported protocols of the application. Application Proxy can be implemented when you want to publish on-premises applications externally. Remote users who need access to internal applications can then access them in a secure manner.

You can select that all users in your tenant can access your enterprise applications without being assigned to them. However, if you want to assign the application to a set of users, configure the application to require user assignment and assign the select users to the application. For a simple example of how to create and assign a user account to an application, see [Quickstart: Create and assign a user account](add-application-portal-assign-users.md).

If included in your subscription, [assign groups to an application](assign-user-or-group-access-portal.md) or [include the application role in an access package](../../id-governance/entitlement-management-access-package-create.md) so that you can delegate ongoing access management to the group owner. You can also [bring in the existing users of an application to Microsoft Entra](../../id-governance/identity-governance-applications-existing-users.md).

> * View the audit logs

> * View the sign-ins

- A Microsoft Entra ID Governance subscription for your organization's member users, including for all employees who are reviewing access or having their access reviewed. Some capabilities within this feature might operate with a Microsoft Entra ID P2 subscription.

## View the audit logs

For more information on how to assign a group to an application role, see the documentation for [New-EntraGroupAppRoleAssignment](/powershell/module/microsoft.entra.groups/new-entragroupapproleassignment).

To enhance its resilience posture, the backup authentication system can't perform fresh revocation checks. Instead, it relies on the state of the certificate revocation list (CRL) check that's performed when the session was last backed up. If you need to revoke before this backup expires, you should explicitly revoke the session instead of waiting for the CRL.

You can select up to 10 recipients to receive notifications. You can select a group to receive the notifications, but the membership of that group can't exceed 10 users. If you select a group that has fewer than 10 users but more are added later, the group no longer receives notifications. Similarly, the notifications can only be sent to five objects, such as a combination of individual users or groups. To stop receiving notifications, remove your user object or the group you're included in from the recipient's list.