MODIFIED docs/fundamentals/configure-security.md

Modified by John Flores on Oct 29, 2025 1:49 PM
📖 View on learn.microsoft.com

+9 / -9 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

 
| Check | Minimum required license |
|---|---|
| [Applications don't have client secrets configured](zero-trust-protect-identities.md#applications-dont-have-client-secrets-configured) | Microsoft Entra ID P1 |
| [Service principals don't have certificates or credentials associated with them](zero-trust-protect-identities.md#service-principals-dont-have-certificates-or-credentials-associated-with-them) | Microsoft Entra ID P1 |
| [Applications don't have certificates with expiration longer than 180 days](zero-trust-protect-identities.md#applications-dont-have-certificates-with-expiration-longer-than-180-days) | Microsoft Entra ID P1 |
| [Application Certificates need to be rotated on a regular basis](zero-trust-protect-identities.md#application-certificates-need-to-be-rotated-on-a-regular-basis) | Microsoft Entra ID P1 |
| [Enforce standards for app secrets and certificates](zero-trust-protect-identities.md#enforce-standards-for-app-secrets-and-certificates) | Microsoft Entra ID P1 |
| [Microsoft services applications don't have credentials configured](zero-trust-protect-identities.md#microsoft-services-applications-dont-have-credentials-configured) | Microsoft Entra ID P1 |
| [User consent settings are restricted](zero-trust-protect-identities.md#user-consent-settings-are-restricted) | Microsoft Entra ID P1 |
| [Admin consent workflow is enabled](zero-trust-protect-identities.md#admin-consent-workflow-is-enabled) | Microsoft Entra ID P1 |
| [High Global Administrator to privileged user ratio](zero-trust-protect-identities.md#high-global-administrator-to-privileged-user-ratio) | None (included with Microsoft Entra ID) |
| [Privileged accounts are cloud native identities](zero-trust-protect-identities.md#privileged-accounts-are-cloud-native-identities) | Microsoft Entra ID P2 |
| [All privileged role assignments are activated just in time and not permanently active](zero-trust-protect-identities.md#all-privileged-role-assignments-are-activated-just-in-time-and-not-permanently-active) | Microsoft Entra ID P2 |
| [Passkey authentication method enabled](zero-trust-protect-identities.md#passkey-authentication-method-enabled) | None (included with Microsoft Entra ID) |
| [Security key attestation is enforced](zero-trust-protect-identities.md#security-key-attestation-is-enforced) | None (included with Microsoft Entra ID) |

 
| Check | Minimum required license |
|---|---|
| [Applications don't have client secrets configured](zero-trust-protect-identities.md#applications-dont-have-client-secrets-configured) | None (included with Microsoft Entra ID) |
| [Service principals don't have certificates or credentials associated with them](zero-trust-protect-identities.md#service-principals-dont-have-certificates-or-credentials-associated-with-them) | None (included with Microsoft Entra ID) |
| [Applications don't have certificates with expiration longer than 180 days](zero-trust-protect-identities.md#applications-dont-have-certificates-with-expiration-longer-than-180-days) | None (included with Microsoft Entra ID) |
| [Application Certificates need to be rotated on a regular basis](zero-trust-protect-identities.md#application-certificates-need-to-be-rotated-on-a-regular-basis) | None (included with Microsoft Entra ID) |
| [Enforce standards for app secrets and certificates](zero-trust-protect-identities.md#enforce-standards-for-app-secrets-and-certificates) | None (included with Microsoft Entra ID) |
| [Microsoft services applications don't have credentials configured](zero-trust-protect-identities.md#microsoft-services-applications-dont-have-credentials-configured) | None (included with Microsoft Entra ID) |
| [User consent settings are restricted](zero-trust-protect-identities.md#user-consent-settings-are-restricted) | None (included with Microsoft Entra ID) |
| [Admin consent workflow is enabled](zero-trust-protect-identities.md#admin-consent-workflow-is-enabled) | None (included with Microsoft Entra ID) |
| [High Global Administrator to privileged user ratio](zero-trust-protect-identities.md#high-global-administrator-to-privileged-user-ratio) | None (included with Microsoft Entra ID) |
| [Privileged accounts are cloud native identities](zero-trust-protect-identities.md#privileged-accounts-are-cloud-native-identities) | None (included with Microsoft Entra ID) |
| [All privileged role assignments are activated just in time and not permanently active](zero-trust-protect-identities.md#all-privileged-role-assignments-are-activated-just-in-time-and-not-permanently-active) | Microsoft Entra ID P2 |
| [Passkey authentication method enabled](zero-trust-protect-identities.md#passkey-authentication-method-enabled) | None (included with Microsoft Entra ID) |
| [Security key attestation is enforced](zero-trust-protect-identities.md#security-key-attestation-is-enforced) | None (included with Microsoft Entra ID) |

MODIFIED docs/identity/domain-services/reference-domain-services-tls-enforcement.md

Modified by Francis Githae Mbui on Oct 29, 2025 2:01 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Update TLS enforcement deadline to November 30, 2025 (#58)

Changes:

Before

After

   :::image type="content" border="true" source="media/reference-domain-services-tls-enforcement/enable.png" alt-text="Screenshot that shows how to enable TLS 1.2 Only Mode for Domain Services.":::
 
>[!Note] 
>Until August 31, 2025, you can select **Disable** to temporarily allow legacy TLS traffic while you update or replace apps that might fail. Select **Enable** again to remain compliant. 
 
## [**PowerShell**](#tab/powershell)
 
- Some apps provide logs or error messages when TLS handshakes fail. Use application-level diagnostics to  look for errors related to unsupported protocols.
 
- Until August 31, 2025, you can modify the following PowerShell example to temporarily allow legacy TLS traffic while you update or replace apps:
 
  ```powershell
  Update-AzADDomainService -Name $domainService.Name -ResourceGroupName $domainService.ResourceGroupName -DomainSecuritySettingTlsV1 Enabled

   :::image type="content" border="true" source="media/reference-domain-services-tls-enforcement/enable.png" alt-text="Screenshot that shows how to enable TLS 1.2 Only Mode for Domain Services.":::
 
>[!Note] 
>Until November 30, 2025, you can select **Disable** to temporarily allow legacy TLS traffic while you update or replace apps that might fail. Select **Enable** again to remain compliant. 
 
## [**PowerShell**](#tab/powershell)
 
- Some apps provide logs or error messages when TLS handshakes fail. Use application-level diagnostics to  look for errors related to unsupported protocols.
 
- Until November 30, 2025, you can modify the following PowerShell example to temporarily allow legacy TLS traffic while you update or replace apps:
 
  ```powershell
  Update-AzADDomainService -Name $domainService.Name -ResourceGroupName $domainService.ResourceGroupName -DomainSecuritySettingTlsV1 Enabled

MODIFIED docs/includes/secure-recommendations/21770.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect engineering systems
# category: Access control
# risklevel: Medium
 

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: P1
# sfipillar: Protect engineering systems
# category: Access control
# risklevel: Medium

MODIFIED docs/includes/secure-recommendations/21771.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect engineering systems
# category: Application management
# risklevel: High
 

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: P1
# sfipillar: Protect engineering systems
# category: Application management
# risklevel: High

MODIFIED docs/includes/secure-recommendations/21772.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.date: 07/14/2025
ms.author: joflore
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: High
 

ms.date: 07/14/2025
ms.author: joflore
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: High

MODIFIED docs/includes/secure-recommendations/21773.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: Medium
 

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: Medium

MODIFIED docs/includes/secure-recommendations/21774.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 06/06/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: High
 

ms.topic: include
ms.date: 06/06/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: High

MODIFIED docs/includes/secure-recommendations/21775.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 10/09/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: Medium
 

ms.topic: include
ms.date: 10/09/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: Medium

MODIFIED docs/includes/secure-recommendations/21776.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 07/07/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: High
 

ms.topic: include
ms.date: 07/07/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: High

MODIFIED docs/includes/secure-recommendations/21777.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.date: 06/13/2025
manager: dougeby
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect tenants and isolate production systems
# category: Access control
# risklevel: High
 

ms.date: 06/13/2025
manager: dougeby
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect tenants and isolate production systems
# category: Access control
# risklevel: High

MODIFIED docs/includes/secure-recommendations/21780.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 10/23/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: Medium
 

ms.topic: include
ms.date: 10/23/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: Free
# sfipillar: Protect identities and secrets
# category: Application management
# risklevel: Medium

MODIFIED docs/includes/secure-recommendations/21781.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Monitor and detect cyberthreats
# 21781, 21782, 21783 are the same content. Enable method, enforce method, report on method
# category: Privileged access
 

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: P1
# sfipillar: Monitor and detect cyberthreats
# 21781, 21782, 21783 are the same content. Enable method, enforce method, report on method
# category: Privileged access

MODIFIED docs/includes/secure-recommendations/21782.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# 21781, 21782, 21783 are the same content. Enable method, enforce method, report on method
# category: Privileged access
 

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: P1
# sfipillar: Protect identities and secrets
# 21781, 21782, 21783 are the same content. Enable method, enforce method, report on method
# category: Privileged access

MODIFIED docs/includes/secure-recommendations/21783.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# 21781, 21782, 21783 are the same content. Enable method, enforce method, report on method
# category: Access control
 

ms.topic: include
ms.date: 02/03/2025
ms.custom: Identity-Secure-Recommendation
# minimumlicense: P1
# sfipillar: Protect identities and secrets
# 21781, 21782, 21783 are the same content. Enable method, enforce method, report on method
# category: Access control

MODIFIED docs/includes/secure-recommendations/21786.md

Modified by John Flores on Oct 29, 2025 2:16 PM
📖 View on learn.microsoft.com

+1 / -0 lines changed

Commit: [Secure Entra] October Additions

Changes:

Before

After

ms.date: 06/13/2025
manager: dougeby
ms.custom: Identity-Secure-Recommendation
# sfipillar: Protect identities and secrets
# category: Access control
# risklevel: High
 

ms.date: 06/13/2025
manager: dougeby
ms.custom: Identity-Secure-Recommendation
# minimumlicense: P1
# sfipillar: Protect identities and secrets
# category: Access control
# risklevel: High

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files