Microsoft Entra collaborating production tenants guidance
Architecture
Learn about Microsoft Entra tenant architecture for collaborating production tenants so that you can identify your needs and compare architectural options.
Cross-product topic
Architecture
A cross-product view of Microsoft Entra changes related to Architecture.
Latest Architecture changes
Microsoft Entra hybrid identity and isolation multitenant guide
Architecture
Learn about Microsoft Entra tenant architecture for hybrid identity and isolation so that you can identify your needs and compare architectural options.
Microsoft Entra nonproduction environments multitenant guidance
Architecture
Learn about Microsoft Entra tenant architecture for nonproduction environments so that you can identify your needs and compare architectural options.
Microsoft Entra primary production tenant guidance
Architecture
Learn about Microsoft Entra tenant architecture for primary production tenants so that you can identify your needs and compare architectural options.
Microsoft Entra tenant estate guidance introduction
Architecture
Learn how to compose your Microsoft Entra tenant estate from common tenant architecture patterns so that you can meet your requirements with as few tenants as possible.
Microsoft Entra tenants for business partner access guidance
Architecture
Learn about Microsoft Entra tenant architecture for business partner access so that you can identify your needs and compare architectural options.
Microsoft Entra tenants for critical business systems guidance
Architecture
Learn about Microsoft Entra tenant architecture for critical business systems so that you can identify your needs and compare architectural options.
Road to the cloud: Introduction
Architecture
Organizations are increasingly modernizing identity, access, and device management by reducing their dependence on on-premises Active Directory and adopting cloud-native capabilities in Microsoft Entra ID. Whether the goal is complete Active Directory retirem…
Gsa Poc Internet Access
Architecture
1. Sign in to your test device and use a private browser window to sign in to any application that is protected by Entra ID in a different tenant, using member account credentials from that tenant.
Gsa Poc Internet Access
Architecture
1. [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2). If your organization currently uses tenant restrictions v1, review the [guide for migrating to tenant restrictions v2](https://aka.ms/trv2migration).
Deployment External Operations
Architecture
Learn about edge protection, domains, subscriptions, consumer app security, and fraud tactics in security operations for Microsoft Entra External ID.
Plan for tenant recoverability
Architecture
Learn how to prepare for and execute tenant-scoped recovery under the shared responsibility model.
Governance Deployment Employee Access
Architecture
Gsa Deployment Guide Internet Access
Architecture
At this point, you completed initiate and plan stages of your Secure Access Services Edge (SASE) deployment project. You understand what you need to implement for whom. You defined which users to enable in each wave. You have a schedule for each wave's deploy…
Gsa Deployment Guide Microsoft Traffic
Architecture
1. Create end user communications to set expectations and provide an escalation path.
Gsa Deployment Guide Private Access
Architecture
1. Create end user communications to set expectations and provide an escalation path.
Id Protection Guide Introduction
Architecture
- A test user who isn't an administrator to verify that policies work as expected before you deploy real users. To create a user, follow the steps in [How to create, invite, and delete users](../fundamentals/how-to-create-delete-users.md).
Agent Id Design Patterns
Architecture
Learn how to map your AI agent architecture to Microsoft Entra Agent ID, including blueprints, agent identities, and an agent's user account.
Plan Agent Identity Architecture
Architecture
Use this decision guide to choose the right identity type, operation pattern, and blueprint and agent identity structure for your AI agents in Microsoft Entra Agent ID.
B2c Deployment Plans
Architecture
Azure Active Directory B2C deployment guide for planning, implementation, and monitoring
Backup Authentication System
Architecture
Explore the resilience features of Microsoft Entra ID's backup authentication system, designed to maintain authentication availability for users and services.
Backup Authentication System Apps
Architecture
Learn how to configure your application to support the Microsoft Entra backup authentication system for enhanced resilience and security.
Build resilience in customer identity and access management with Azure AD B2C
Architecture
Learn methods to build resilience in customer identity and access management (CIAM) using Azure AD B2C.
Configure Advanced F5 Kerberos Delegation for Multi-Tier SaaS Architectures
Architecture
A Microsoft Entra documentation page was updated: Configure Advanced F5 Kerberos Delegation for Multi-Tier SaaS Architectures.
Convert local guest accounts to Microsoft Entra B2B guest accounts
Architecture
Learn to convert local guests into Microsoft Entra B2B guest accounts by identifying apps and local guest accounts, migration, and more.
Increase the resilience of authentication for federated applications deployed at sites with colocated users
Architecture
Resilience guidance for application deployments with orchestration of a relying party security token service to change its identity provider
Introduction to Microsoft Entra ID Protection proof-of-concept guidance
Architecture
Learn, deploy, and test Microsoft Entra ID Protection so that you can detect, investigate, and remediate identity-based risks.
Microsoft Entra Agent ID design patterns
Architecture
Learn how to map your AI agent architecture to Microsoft Entra Agent ID, including blueprints, agent identities, and an agent's user account.
Microsoft Entra architecture icons
Architecture
Learn about the official collection of Microsoft Entra ID icons that you can use in architectural diagrams, training materials, or documentation.
Microsoft Entra External ID deployment architectures with Microsoft Entra
Architecture
Learn to securely deploy and operate Microsoft Entra External ID architectures with Microsoft Entra.
Microsoft Entra ID Protection scenario for mastering risk analysis for effective remediation
Architecture
Learn about improving risk analysis to identify risky users, discern risk event types, and examine risk levels for access and identity decisions.
Microsoft Entra ID Protection to Detect Protected Resource Risks
Architecture
Learn how identity administrators use real-time risk detection features in Microsoft Entra ID Protection to grant user access to protected resources.
Microsoft Entra ID Protection to Investigate Risk Telemetry
Architecture
Learn how Security Operations Center (SOC) admins use Microsoft Entra ID Protection to bring identity risk-related telemetry into security investigations.
Microsoft Entra ID Protection to Self-Remediate User Risk
Architecture
Learn how IT administrators use Microsoft Entra ID Protection to identify and remediate identity risks for users that access enterprise-managed resources.
Microsoft Entra Suite deployment scenario - Modernize remote access
Architecture
Configure Microsoft Entra Suite products for upgrading existing VPN solution to a scalable cloud-based solution and move towards Secure Access Service Edge (SASE).
Microsoft Entra Suite deployment scenario - Secure internet access
Architecture
Configure Microsoft Entra Suite products for strict default internet access policies to control internet access according to business requirements.
Microsoft Entra Suite deployment scenario - Workforce and guest lifecycle
Architecture
Configure Microsoft Entra Suite products for hiring new remote employees and providing them with secure and seamless access to apps and resources.
Microsoft Entra Suite deployment scenarios introduction
Architecture
The Microsoft Entra Suite deployment scenarios article series provides guidance regarding the Microsoft Entra Suite.
Microsoft Entra Suite services and integration partners
Architecture
Locate and engage partners for guidance on Microsoft Entra deployment.
Microsoft Entra Suite workshop delivery guide
Architecture
This article is for use by the delivery expert that plans on delivering the Microsoft Entra Suite Workshop to customers. It aims to provide delivery experts with a comprehensive overview of the tasks that is required to successfully deliver the Microsoft Entr…
Microsoft Security Copilot in Microsoft Entra proof-of-concept guide
Architecture
Learn to harness AI-powered insights and automation and demonstrate the value of Security Copilot in Entra in your environment.
Plan a single sign-on deployment
Architecture
Plan your single sign‑on deployment in Microsoft Entra ID. Streamline role assignments, certificate management, and licensing to ensure uninterrupted access.
Plan your agent identity architecture
Architecture
Use this decision guide to choose the right identity type, operation pattern, and blueprint and agent identity structure for your AI agents in Microsoft Entra Agent ID.
Recover From Deletions
Architecture
Understand the difference between soft and hard deletions and how to recover or recreate objects in Microsoft Entra ID.
Resilience through developer best practices using Azure AD B2C
Architecture
Resilience through developer best practices in Customer Identity and Access Management using Azure AD B2C
Resilience through monitoring and analytics using Azure AD B2C
Architecture
Resilience through monitoring and analytics using Azure AD B2C
Resilient end-user experience using Azure AD B2C
Architecture
Learn methods to build resilience in end-user experience with Azure AD B2C
Resilient interfaces with external processes using Azure AD B2C
Architecture
Learn about methods to build resilient interfaces with external processes.
Road to the cloud - Case studies to reduce your dependency on traditional on-premises Active Directory services
Architecture
Learn about case studies to reduce your dependency on traditional on-premises Active Directory services.
Road to the cloud - Move identity and access management from Active Directory Domain Services (AD DS) to a Microsoft Entra migration workstream
Architecture
Learn to plan your migration workstream of IAM from Active Directory Domain Services (AD DS) to Microsoft Entra ID.
Secure Generative AI with Microsoft Entra
Architecture
Learn how to mitigate specific security challenges that Generative AI (Gen AI) poses to ensure organizational security with Microsoft Entra.
Security operations for privileged accounts in Microsoft Entra ID
Architecture
Learn about baselines, and how to monitor and alert on potential security issues with privileged accounts in Microsoft Entra ID.
Configure Advanced F5 Kerberos Delegation for Multi-Tier SaaS Architectures
Architecture
In this article, learn the steps you need to perform to integrate F5 with Microsoft Entra ID.
Plan Your Microsoft Entra Conditional Access Deployment
Architecture
Plan your Conditional Access policies to balance security and productivity. Learn how to design and deploy effective policies for your organization.
Id Protection Guide Introduction
Architecture
- [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator)
Recover from deletions in Microsoft Entra ID
Architecture
Understand the difference between soft and hard deletions and how to recover or recreate objects in Microsoft Entra ID.
Recoverability Overview
Architecture
- [Microsoft Graph APIs](/graph/overview) can be used to export the current state of many Microsoft Entra configurations.
Resilience In Credentials
Architecture
|Certificate Based Authentication (CBA)|In most cases (depending on configuration) CBA will require a revocation check. This adds an external dependency on the CRL distribution point (CDP) |[Understanding the certificate revocation process](~/identity/authent…
Agent Id Design Patterns
Architecture
This article describes common AI agent deployment patterns and how they map to Microsoft Entra Agent ID. The article starts with a review of key identity concepts, describes permisssions and trust boundaries, and then walks through common deployment patterns.
Microsoft Entra Agent ID design patterns
Architecture
Learn how to map your AI agent architecture to Microsoft Entra Agent ID, including blueprints, agent identities, and an agent's user account.
Plan your agent identity architecture
Architecture
Use this decision guide to choose the right identity type, operation pattern, and blueprint and agent identity structure for your AI agents in Microsoft Entra Agent ID.
Secure Generative Ai
Architecture
Enforce least privilege principles and apply the right access controls to keep your organization secure with [Conditional Access policies](../identity/conditional-access/plan-conditional-access.md). Think of Conditional Access policies as if-then statements w…
Recoverability Overview
Architecture
- Use a least privilege model. Ensure that each member of your team has the least privileges necessary to complete their usual tasks. Require a process to escalate privileges for more unusual tasks.
Security Copilot Entra Proof Of Concept
Architecture
Publish on-premises apps with Microsoft Entra application proxy
Architecture
Learn about the architecture, connectors, authentication methods, and security benefits of Microsoft Entra application proxy.
Security considerations for Microsoft Entra application proxy
Architecture
Learn about security considerations and architecture for using Microsoft Entra application proxy.
Onboard new remote employees using ID verification
Architecture
A design pattern describing how to onboard new employees remotely
Verified helpdesk with Microsoft Entra Verified ID
Architecture
A design pattern describing how to verify in helpdesk scenarios
B2c Deployment Plans
Architecture
- See, [Tutorial: Create an Azure Active Directory B2C tenant](/azure/active-directory-b2c/tutorial-create-tenant)
Pim Deployment Plan
Architecture
You assign users the role with the [least privileges necessary to perform their tasks](~/identity/role-based-access-control/delegate-by-task.md). This practice minimizes the number of Global Administrators and instead uses specific administrator roles for cer…
10 Secure Local Guest
Architecture
Learn more: [Invite internal users to B2B collaboration](~/external-id/invite-internal-users.md)
Guide For Independent Software Developers
Architecture
Microsoft Entra Verified ID architecture overview
Architecture
Learn foundational information to plan and design your solution
Onboard new remote employees using ID verification
Architecture
A design pattern describing how to onboard new employees remotely
Verified helpdesk with Microsoft Entra Verified ID
Architecture
A design pattern describing how to verify in helpdesk scenarios
On Premises Application Provisioning Architecture
Architecture
Presents an overview of on-premises application provisioning architecture.
Publish on-premises apps with Microsoft Entra application proxy
Architecture
Understand why to use application proxy to publish on-premises web applications externally to remote users. Learn about application proxy architecture, connectors, authentication methods, and security benefits.
Multi Tenant Common Considerations
Architecture
A Microsoft Entra documentation page was updated: Multi Tenant Common Considerations.
Architecture overview
Architecture
Learn about the architecture of Microsoft Entra ID, including service design, scalability, availability, and data consistency.
Conceptual Deployment Plan
Architecture
An end-to-end guide for planning the deployment of application proxy within your organization
Helpdesk With Verified Id
Architecture
A design pattern describing how to verify in helpdesk scenarios
Plan a Lifecycle Workflow deployment
Architecture
Planning guide for a successful Lifecycle Workflow deployment.
Plan a Microsoft Entra access reviews deployment
Architecture
Planning guide for a successful access reviews deployment.
What Is App Proxy
Architecture
Understand why to use application proxy to publish on-premises web applications externally to remote users. Learn about application proxy architecture, connectors, authentication methods, and security benefits.
8 Secure Access Sensitivity Labels
Architecture
Team members who need to create sensitivity labels require permissions to:
Gsa Deployment Guide Internet Access
Architecture
- [Microsoft Global Secure Access deployment guide for Microsoft Traffic](gsa-deployment-guide-microsoft-traffic.md)
Road To The Cloud Ad Minimization
Architecture
A Microsoft Entra documentation page was updated: Road To The Cloud Ad Minimization.
Licensing Governance
Architecture
|[Automated provisioning to on-premises apps](~/identity/app-provisioning/on-premises-application-provisioning-architecture.md)|| :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
Secure Best Practices
Architecture
The following are design considerations for all isolation configurations. Throughout this content, there are many links. We link to content, rather than duplicate it here, so you'll always have access to the most up-to-date information.
Deployment Scenario Remote Access
Architecture
Follow these steps to create an Entitlement management catalog:
Deployment Scenario Workforce Guest
Architecture
Follow these steps to create an Entitlement management catalog for the scenario.
Id Protection Guide Analyze
Architecture
A Log Analytics workspace is a data store to collect log data types from Azure and non-Azure resources and applications. We recommend you send all log data to one Log Analytics workspace.
Microsoft Entra: Soft deletion and restoration for cloud security groups
Architecture
Microsoft Entra introduces soft deletion and restoration for cloud security groups, allowing recovery within 30 days while preserving settings, ownership, and membership. Rollout begins in late October 2025 (preview) and February 2026 (general availability). Deleted groups remov…
Backup Authentication System
Architecture
To enhance its resilience posture, the backup authentication system can't perform fresh revocation checks. Instead, it relies on the state of the certificate revocation list (CRL) check that's performed when the session was last backed up. If you need to revo…
Recover from deletions in Microsoft Entra ID
Architecture
Understand the difference between soft and hard deletions and how to recover or recreate objects in Microsoft Entra ID.
Conditional Access Session
Architecture
Conditional Access App Control uses a reverse proxy architecture and is uniquely integrated with Microsoft Entra Conditional Access. Microsoft Entra Conditional Access allows you to enforce access controls on your organization’s apps based on certain conditio…
Gsa Poc Private Access
Architecture
When customers deploy the 3P solution, they might want to use Microsoft Entra Private Access while using other solutions for internet access. For guidance, see [Partner ecosystem overview](../global-secure-access/partner-ecosystems-overview.md).
Id Protection Guide Detect
Architecture
To [configure and enable risk policies](../id-protection/howto-identity-protection-configure-risk-policies.md), factor Sign-in risk and User [risk policies](../id-protection/concept-identity-protection-policies.md) in Microsoft Entra Conditional Access. If yo…
Id Protection Guide Introduction
Architecture
Understanding the products and their core concepts is the first step toward running a successful PoC. Start with learning about the product features in this section:
Id Protection Guide Investigate
Architecture
Detect and investigate identity threats in the Microsoft Entra admin center or with Microsoft Graph APIs:
Id Protection Guide Remediate
Architecture
- [Use real-time risk detection to grant access to protected resources](id-protection-guide-detect.md)
Governance Deployment Employee Access
Architecture
Governance Deployment Employee Lifecycle
Architecture
* [Microsoft Entra ID Governance](../id-governance/identity-governance-overview.md)
Governance Deployment Guest Access
Architecture
The following products and services appear in this guide:
Governance Deployment Privileged Identities
Architecture
The following products and services appear in this guide:
Microsoft Entra deployment plans
Architecture
Azure Active Directory is now [Microsoft Entra ID](~/fundamentals/what-is-entra.md), which can safeguard your organization with cloud identity and access management. The solution connects employees, customers, and partners to their apps, devices, and data.