📋 Microsoft Entra Documentation Changes

1. With the `alternateUrl` property, configure the alternate URL on the [onPremisesPublishing resource type](/graph/api/resources/onpremisespublishing) of the app.

1. If you want the alternate URL to be maintained throughout the user session, call `onPremisesPublishing` and set the `useAlternateUrlForTranslationAndRedirect` flag to `true`.

### Global Secure Access web content filtering is enabled and configured

ms.date: 01/20/2026

| Microsoft 365 Copilot (Office) | N/A | ✅ | ❌ |

| Word | ✅ | ✅ | ❌ |

| PowerPoint | ✅ | ✅ | ❌ |

| Excel | ✅ | ✅ | ❌ |

| OneNote | ✅ | ✅ | ❌ |

| Loop | N/A | ✅ | ❌ |

ms.date: 03/04/2025

> [!IMPORTANT]

> Security Questions will be deprecated for Self‑Service Password Reset (SSPR) in March 2027. After that, users will not be able to use Security Questions to complete SSPR. [Learn more about setting up alternate authentication methods](tutorial-enable-sspr.md#select-authentication-methods-and-registration-options).

> Security questions should be eliminated from your authentication strategy because they introduce significant security vulnerabilities. Answers are frequently guessable, reused across sites, or discoverable through open-source intelligence (OSINT). Threat actors can enumerate or phish users to derive likely responses (family names, schools, locations), then trigger password reset flows to bypass stronger authentication methods. Once threat actors successfully reset a password—especially on accounts without multifactor authentication—they gain valid credentials, establish persistent sessions, register additional authentication methods, add forwarding rules, and exfiltrate sensitive data.

>

> While some organizations may have business reasons for continuing to use security questions, this practice is strongly discouraged due to the inherent security weaknesses of knowledge-based authentication.

| Platform/device state | Connection target | All Traffic support | Private Access only support | Notes |

|---|---|---:|---:|---|

| Windows | Always connects to the joined tenant. For non-joined tenants, user selects a tenant at first sign-in; remains connected to that tenant | From Microsoft Entra Joined and Hybrid joined device | From Microsoft Entra Registered device | For non-joined devices, multiple registrations allowed, no switching between registered tenants for now. Allows user to switch to a resource tenant using external user access(B2B collaboration). |

| macOS | User selects a tenant at first sign-in; remains connected to that tenant | Microsoft Entra Registered with and without device enrollment | ❌ | Applies to enrolled and unmanaged devices with Company Portal. |

| Android | User selects a tenant at first sign-in; remains connected to that tenant | Microsoft Entra Registered with and without device enrollment | ❌ | Applies to enrolled devices with Company Portal and unmanaged devices with Company portal and Authenticator app. |

title: Global Secure Access web content filtering is enabled and configured

Web Content Filtering in Microsoft Entra Internet Access helps organizations control access to websites based on web categories, domains, or URLs. It reduces exposure to malicious or inappropriate content. When you route traffic through Microsoft Entra Internet Access, filtering policies can block or allow entire categories like gambling or social media, or specific domains and URLs. This approach ensures safer browsing across all devices and locations.

 

Configuring these policies is critical for security and compliance. A secure configuration prevents phishing and malware risks, enforces corporate standards, and improves productivity by restricting nonbusiness sites. Web Content Filtering, combined with identity-aware Conditional Access, delivers dynamic, cloud-based protection that aligns with modern Zero Trust principles.

Implement granular internet access controls for your organization based on website categorization.

- [How to configure Global Secure Access web content filtering](/entra/global-secure-access/how-to-configure-web-content-filtering)

| [Internet Access forwarding profile is enabled](zero-trust-protect-networks.md#internet-access-forwarding-profile-is-enabled) | <!--Entra_Premium_Internet_Access--> Microsoft Entra Internet Access |

| [Global Secure Access web content filtering is enabled and configured](zero-trust-protect-networks.md#global-secure-access-web-content-filtering-is-enabled-and-configured) | <!--Entra_Premium_Internet_Access--> Microsoft Entra Internet Access |

**Q: How does a external user access an on-premises resource in the resource tenant when the resource uses AD DS and Kerberos (such as a file share or a Kerberos-integrated application)?**

A: This scenario isn't supported. Microsoft Entra B2B collaboration doesn't provide Kerberos tickets, and Global Secure Access Private Access doesn't proxy Kerberos or support Kerberos Constrained Delegation (KCD). As a result, external users can't directly access on-premises resources requiring Kerberos (for example, SMB file shares or applications using Integrated Windows Authentication).

For web applications, the only supported method for B2B users to access Kerberos-backed on-premises apps is by publishing the app through **Application Proxy with KCD**. For more information, see [Configure single sign-on with Kerberos constrained delegation](../identity/app-proxy/how-to-configure-sso-with-kcd.md).

1. If syncing only assigned users and groups (recommended), select the **Users and groups** tab. Then, assign the users or groups you want to sync.

- End-user notifications are in development.

- Transport Layer Security (TLS) inspection is in development.

- URL path-based filtering and URL categorization for HTTP and HTTPS traffic are in development.

- User-friendly end-user notifications are in development.

- URL path based filtering and URL categorization for HTTP and HTTPS traffic are in development.

Write-Host "Certificate Issuer: " $aadapAppConf1.VerifiedCustomDomainCertificatesMetadata.Issuer

$certs += "Certificate Issuer: " + $aadapAppConf1.VerifiedCustomDomainCertificatesMetadata.Issuer

value = [convert]::ToBase64String((Get-Content $certPfxFilePath -Encoding byte));