Configure Zscaler Provisioning for automatic user provisioning with Microsoft Entra ID
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Zscaler Provisioning.
Product
Microsoft Entra ID
Track documentation and Message Center changes for Microsoft Entra ID.
Microsoft Learn documentation ↗Latest Microsoft Entra ID changes
Extend Application Attributes
Provisioning
Before creating an extensibility workflow, you need a custom extension that you can link to your extensibility workflow. As mentioned previously, you can think of the custom extension as a wrapper for the Azure Logic App where your custom logic resides. When…
Product names and service plan identifiers for licensing
General
When [managing licenses in the Azure portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products) or the [Microsoft 365 admin center](https://admin.microsoft.com), you see product names that look something like *Office 365 E3*. When y…
Sms Voice Retirement
Fundamentals
To avoid sign-in disruption, make sure users register a passkey or move to another phishing-resistant authentication method before February 1, 2027. If your organization has a valid business, regulatory, or operational need to keep using SMS or voice, configu…
Microsoft Entra collaborating production tenants guidance
Architecture
Learn about Microsoft Entra tenant architecture for collaborating production tenants so that you can identify your needs and compare architectural options.
Microsoft Entra hybrid identity and isolation multitenant guide
Architecture
Learn about Microsoft Entra tenant architecture for hybrid identity and isolation so that you can identify your needs and compare architectural options.
Microsoft Entra ID: Retirement of custom CSS positioning properties in custom branding
Branding
Microsoft Entra ID will retire support for custom CSS positioning properties in company branding starting October 2026 to enhance security and phishing resistance. Existing users must remove these properties by then, as no migration path exists. Branding elements remain visible…
Microsoft Entra nonproduction environments multitenant guidance
Architecture
Learn about Microsoft Entra tenant architecture for nonproduction environments so that you can identify your needs and compare architectural options.
Microsoft Entra primary production tenant guidance
Architecture
Learn about Microsoft Entra tenant architecture for primary production tenants so that you can identify your needs and compare architectural options.
Microsoft Entra tenant estate guidance introduction
Architecture
Learn how to compose your Microsoft Entra tenant estate from common tenant architecture patterns so that you can meet your requirements with as few tenants as possible.
Microsoft Entra tenants for business partner access guidance
Architecture
Learn about Microsoft Entra tenant architecture for business partner access so that you can identify your needs and compare architectural options.
Microsoft Entra tenants for critical business systems guidance
Architecture
Learn about Microsoft Entra tenant architecture for critical business systems so that you can identify your needs and compare architectural options.
Quickstart - Access and create new tenant
Fundamentals
Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.
Road to the cloud: Introduction
Architecture
Organizations are increasingly modernizing identity, access, and device management by reducing their dependence on on-premises Active Directory and adopting cloud-native capabilities in Microsoft Entra ID. Whether the goal is complete Active Directory retirem…
Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions
Standards
Starting June 15, 2026, Conditional Access policies targeting All resources with exclusions will be enforced for sign-ins requesting only certain OIDC or directory scopes. Some users may face new challenges like MFA. Most organizations need no action, but custom apps requesting…
Sms Voice Retirement
Fundamentals
This timeline applies to public cloud environments only. Other cloud environments will follow on a later schedule, and we will provide advance communications to help customers prepare for the transition.
Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Fundamentals
Learn how to prepare for the retirement of Microsoft provided SMS and Voice authentication in Microsoft Entra ID and migrate users to passkeys.
Prerequisites
General
- Microsoft Entra Cloud Sync agent must be installed on a domain-joined server. We recommend using Windows Server 2025 or Windows Server 2022. You can also deploy Microsoft Entra Cloud Sync on older Windows Server versions that are in extended support; howeve…
Connect Health Agent Install
Security
> If you have a highly locked-down and restricted environment, you need to add more URLs than the URLs the table lists for Internet Explorer enhanced security. Also add URLs that are listed in the table in the next section.
Microsoft Entra ID: Optimizations for passkey registration experience
Authentication
Microsoft Entra ID is optimizing passkey registration via Registration Campaign, Authentication Strengths, and My Sign-Ins to improve compliance with passkey policies and prioritize local device passkeys. These changes, rolling out in late August 2026, require no user interface…
Access Token Claims Reference
Authentication
| `exp` | int, a Unix timestamp | Specifies the expiration time before which the JWT can be accepted for processing. A resource may reject the token before this time as well. The rejection can occur for a required change in authentication or when a token is r…
Use Scim To Provision Users And Groups
Standards
|Username and password (not recommended or supported by Microsoft Entra ID)|Easy to implement|Insecure - [Your Pa$$word doesn't matter](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/your-pa-word-doesn-t-matter/ba-p/731984)|Not supported…
V2 Howto App Gallery Listing
Standards
- To implement support of SCIM 2.0 Provisioning follow this tutorial: [build a SCIM endpoint and configure user provisioning with Microsoft Entra ID](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md)
Configure Azure Databricks for automatic user provisioning with Microsoft Entra ID
Standards
Learn how to configure Microsoft Entra ID to automatically provision and de-provision user accounts to Azure Databricks using SCIM.
Fortigate Ssl Vpn Tutorial
Standards
`https://<FortiGate IP or FQDN address>:<Custom SSL VPN port>/remote/saml/login`.
Microsoft Entra: Passwordless password change in My Sign-Ins
Authentication
Microsoft Entra will enable passwordless users to change their passwords via My Sign-Ins using strong credentials like passkeys or Windows Hello, without knowing the current password or using SSPR. This feature, disabled by default, requires admin activation and will roll out gl…
Company Branding Css Template
Branding
Reference guide for the CSS template selectors for customizing Microsoft Entra sign-in page company branding.
Customer intent: As a Microsoft Entra administrator, I want to customize the sign-in experience for my organization's users so that I can provide a c…
Branding
Instructions about how to add your organization's custom branding to the Microsoft Entra sign-in experience.
Customize the sign-in experience for your application with branding themes
Branding
Learn how to create branding themes and apply them to the sign-in experience for your application in Microsoft Entra ID.
(Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants
Fundamentals
Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing configurations migrate to a Default passkey profile with a new passkeyType property. Automatic migration and registration campaign updates rol…
General Availability: Microsoft Entra passkeys on Windows
Authentication
Microsoft Entra passkeys on Windows will be generally available from late April 2026, enabling phishing-resistant, passwordless sign-in on Windows devices without explicit opt-in. This supports corporate, personal, and shared devices, with admin controls via Authentication Metho…
Microsoft Entra: Self-service password reset CAPTCHA protection updated
Authentication
Microsoft Entra is replacing legacy CAPTCHA in self-service password reset with backend throttling and behavior-based abuse detection to enhance security and accessibility. The rollout starts early August 2026, requires no user or admin action, and maintains current password res…
Access tokens in the Microsoft identity platform
Microsoft identity platform
Access tokens are a type of security token designed for authorization, granting access to specific resources on behalf of an authenticated user. Information in access tokens determines whether a user has the right to access a particular resource, similar to k…
What's new in Microsoft Entra RBAC documentation
General
Learn about the new features and documentation improvements in Microsoft Entra role-based access control (RBAC).
Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Fundamentals
Microsoft Entra will make passkeys the default authentication method starting September 1, 2026, retiring Microsoft-provided SMS and voice authentication by February 1, 2027. Customers must configure telecom providers for SMS/voice via the Microsoft Security Store or face disrup…
Admin Control for SSO prompts
General
IT administrators can now automatically accept SSO permissions on managed Windows devices using a supported registry setting.
Configure Netskope User Authentication for automatic user provisioning with Microsoft Entra ID
Authentication
Learn how to configure Microsoft Entra ID to automatically provision and de-provision user accounts to Netskope User Authentication.
Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Fundamentals
Learn how to prepare for the retirement of Microsoft provided SMS and Voice authentication in Microsoft Entra ID and migrate users to passkeys.
Connect with the required scope
Developer
After creating a new application proxy application, grant admin consent for the **User.Read** delegated permission in the Microsoft Entra admin center or using the Microsoft Graph PowerShell.
Microsoft Entra: Improved restore experience for Authenticator passkeys on iOS
Authentication
Microsoft Entra improves the Microsoft Authenticator passkey restore experience on iOS with a clearer, guided flow for device migration, available worldwide in August 2026. It affects iOS users with iCloud backups, is enabled by default, requires no admin changes, and no action…
Dynamics 365 Contact Center - Manage users through Microsoft Entra security groups
Security
We are announcing the ability to manage users through Microsoft Entra security groups in Dynamics 365 Contact Center. This feature will reach general availability on July 24, 2026. How does this affect me? Users will be able to manage access by linking Microsoft Entra security g…
Microsoft Entra ID: Retirement of Custom Controls in Conditional Access and migration to External MFA
Standards
Microsoft Entra ID is retiring Custom Controls in Conditional Access by May 2027, replacing them with External MFA for standardized third-party MFA integration. Administrators must migrate policies by September 2026, updating Conditional Access to use External MFA to ensure cont…
Microsoft Entra: System-preferred authentication now applies to first-factor authentication
Fundamentals
Microsoft Entra now applies system-preferred authentication to first-factor sign-in for tenants in the Microsoft managed state, selecting the most secure registered method. Rollout starts late June 2026. Tenants can keep or change this setting and should update user guidance acc…
Migrate Custom Controls External Mfa
Conditional Access
- **Conditional Access**: The new policy evaluated and granted access
Connect Version History
General
This article lists all releases of Microsoft Entra Connect and Azure AD Sync.
Transfer Microsoft Authenticator to a new phone
Authentication
Learn how to back up and restore Microsoft Authenticator account entries when you switch to a new phone, including passkey setup steps.
Completed: Conditional Access enforcement update for policies with resource exclusions
Standards
Conditional Access enforcement update completed in your tenantThe rollout of the Conditional Access enforcement update for policies targeting All resources with resource exclusions has now been completed in your tenant.As previously communicated, this update improves enforcement…
Customer intent: As an identity administrator, I want to plan for mandatory MFA for users who sign in to Azure portal so that my organization is prep…
Fundamentals
Learn about mandatory multifactor authentication (MFA) enforcement for Azure, Microsoft 365, and other admin portals, and how to prepare your tenant.
Enable and support passkeys in Authenticator for Microsoft Entra ID
Troubleshooting
Learn about Authenticator-specific requirements, configuration, and troubleshooting for passkeys in Microsoft Authenticator for Microsoft Entra ID.
Enable Microsoft Entra passkey on Windows (preview)
Authentication
Learn how Microsoft Entra passkey on Windows enables phishing-resistant authentication with work or school accounts by using Windows Hello as a FIDO2 passkey provider.
Enable synced passkeys in Microsoft Entra ID
Authentication
Learn about synced passkeys in Microsoft Entra ID, including how to configure, register, and sign in with synced passkeys.
FIDO2 security key sign-in to Windows
Authentication
Learn how to enable passwordless security key sign-in to Windows with Microsoft Entra ID using FIDO2 security keys.
Macos Psso Deployment Eocustomers
General
* [Federated MFA](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa)
Register a Microsoft Entra passkey on Windows (preview)
Authentication
Learn how to register a Microsoft Entra passkey on Windows by using Windows Hello as a FIDO2 passkey provider for phishing-resistant sign-in.
Register a passkey with a FIDO2 security key
Authentication
Learn how to register a passkey with a FIDO2 security key in Microsoft Entra ID. Use Security info or a prompted sign-in flow.
Register a synced passkey (FIDO2)
Authentication
Learn how to register a synced passkey (FIDO2) as an authentication method on Windows, iOS, or Android by using a browser for phishing-resistant sign-in.
Register Passkey Mobile
Authentication
A Microsoft Entra documentation page was updated: Register Passkey Mobile.
Register passkeys in Authenticator on Android and iOS devices
Authentication
Learn how to register passkeys in Microsoft Authenticator on Android and iOS. Sign in to the app, use Security info, or register cross-device.
Sign in with a FIDO2 security key
Authentication
Learn how to sign in to Microsoft Entra ID with a FIDO2 security key. Sign in to web apps, Windows, and on-premises resources.
Sign in with a Microsoft Entra passkey on Windows (preview)
Authentication
Learn how to sign in with a Microsoft Entra passkey on Windows by using Windows Hello as a FIDO2 passkey provider for phishing-resistant authentication.
Sign in with a synced passkey (FIDO2)
Authentication
Learn how to sign in to Microsoft Entra ID with a synced passkey (FIDO2) for your work or school account by using a browser on Windows, iOS, or Android.
Sign in with passkeys in Authenticator for Android and iOS devices
Authentication
Learn how to sign in with passkeys in Microsoft Authenticator for Android and iOS. Use same-device, cross-device, or native app authentication.
Snowflake Provisioning Tutorial
Provisioning
With Privileged Identity Management (PIM) for Groups, you can provide just-in-time access to groups in Snowflake and reduce the number of users who have permanent access to privileged groups in Snowflake.
Support Authenticator Passkey
Authentication
A Microsoft Entra documentation page was updated: Support Authenticator Passkey.
App Manifest
Standards
Specifies whether this web app can request OAuth2.0 implicit flow ID tokens. The default is false. This flag is used for browser-based apps, like JavaScript single-page apps. We, however, discourage the use of implicit grant even in SPAs and recommend using t…
Azure Active Directory Graph App Manifest Deprecation
Monitoring
| `logoUrl` | Relocated as a property of the `info` attribute |
V2 Protocols Oidc
Developer
1. Under Redirect URIs, add the redirect URI of your application. For example, `https://localhost:8080/`.
Configure Microsoft Entra Connect for an existing tenant
Provisioning
Learn how Microsoft Entra Connect matches and synchronizes on-premises objects with an existing Microsoft Entra tenant, and how to resolve hard match conflicts.
What's new in Microsoft Entra application management
Developer
This article shows the new and updated documentation for the Microsoft Entra application management.
Entra Customer Lockbox Approver
General
A Microsoft Entra documentation page was updated: Entra Customer Lockbox Approver.
Office 365 Application Contents
Fundamentals
- [Office 365 app in Conditional Access](concept-conditional-access-cloud-apps.md#office-365)
Access activity logs in Microsoft Entra ID
Monitoring
How to choose the right method for accessing and integrating the activity logs in Microsoft Entra ID.
Configure Harness for automatic user provisioning with Microsoft Entra ID
Provisioning
Learn how to configure Microsoft Entra ID to automatically provision and deprovision user accounts to Harness.
Entra Id Scim Api Reference
Standards
Before you can call the SCIM API endpoints described in this article, you must enable the SCIM Provisioning API feature, configure billing, set up credentials, and obtain an access token. For step-by-step instructions, see [Enable the SCIM Provisioning API in…
Microsoft identity platform OIDC extensibility reference
Standards
Map each Microsoft identity platform OpenID Connect (OIDC) extensibility surface to the configuration article and the Microsoft Graph API resource that programs it.
OAuth 2.0 and OpenID Connect protocols
Standards
Learn about OAuth 2.0 and OpenID Connect in Microsoft identity platform. Explore authentication flows, endpoints, and secure user authentication.
OpenID Connect (OIDC) on the Microsoft identity platform
Standards
Sign in Microsoft Entra users by using the Microsoft identity platform's implementation of the OpenID Connect extension to OAuth 2.0.
Troubleshooting
Troubleshooting
- The object or property isn't supported for preview in the current release.
Configure Visa Spend Clarity for Enterprise for automatic user provisioning with Microsoft Entra ID
Provisioning
Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Visa Spend Clarity for Enterprise.
Microsoft Entra: Blocking new assignments to partner tier support roles
Governance
Microsoft Entra will block new assignments to Partner Tier1 and Tier2 Support roles starting August 3, 2026, as these roles are retired. Existing assignments remain valid. Admins should update scripts and use alternative roles like User Administrator. No impact if these roles ar…
Ad Group Enforcement
Monitoring
.\Set-CloudSyncSOAPolicy.ps1 -EnforcementMode Audit -Credential (Get-Credential -Message "Enter Domain Admin credentials (format: DOMAIN\Username)")
Alertmedia Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to AlertMedia.
Archive for Microsoft Entra releases and announcements
Fundamentals
The What's new release notes in the Overview section of this content set contain six months of activity. After six months, the items are removed from the main article and put into this archive article.
Atlassian Cloud Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Atlassian Cloud.
Auditboard Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to AuditBoard.
Automate User provisioning into ThousandEyes with Microsoft Entra ID
Provisioning
Learn how to configure Microsoft Entra ID to automatically provision and de-provision user accounts to ThousandEyes.
Bentley Automatic User Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Bentley - Automatic User Provisioning.
Bic Cloud Design Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to BIC Cloud Design.
Blogin Provisioning Tutorial
Provisioning
Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to BlogIn.
Boxcryptor Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Boxcryptor.
Bpanda Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Bpanda.
Browserstack Single Sign On Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to BrowserStack Single Sign-on.
Bullseyetdp Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to BullseyeTDP.
Certificate Based Authentication Certificate Revocation List
Fundamentals
A Microsoft Entra documentation page was updated: Certificate Based Authentication Certificate Revocation List.
Checkproof Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to CheckProof.
Cisco User Management For Secure Access Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Cisco User Management for Secure Access.
Clarizen One Provisioning Tutorial
Provisioning
Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Clarizen One.
Clebex Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Clebex.
Cloud Academy Sso Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to QA.
Coda Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Coda.
Code42 Provisioning Tutorial
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Code42.
Configure Acunetix 360 for automatic user provisioning with Microsoft Entra ID
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Acunetix 360.
Configure Adobe Identity Management (OIDC) for automatic user provisioning with Microsoft Entra ID
Provisioning
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Adobe Identity Management (OIDC).