MODIFIED docs/id-governance/tenant-governance/how-to-create-monitor.md

Modified by tafra00 on Jul 31, 2026 2:50 PM
📖 View on learn.microsoft.com

+34 / -46 lines changed

Commit: Tenant Governance config management GA how-to updates (#13965)

Changes:

Before

After

---
title: Create a monitor
titleSuffix: Microsoft Entra ID Governance
description: Learn how to create and configure a tenant configuration monitor in Microsoft Entra Tenant Governance to track configuration drift
ms.topic: how-to
ms.date: 03/10/2026
---
 
<!-- source: Create_and_Update_Configuration_Monitor_LearnStyle.docx -->
 
# Create and update a configuration monitor
 
This article describes how to create and update a configuration monitor in the [Microsoft Entra admin center](https://entra.microsoft.com). A configuration monitor periodically evaluates your tenant configuration against a configuration baseline. It records configuration drifts when the actual state differs from the desired state.
 
## Before you begin
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).
 
1. Verify that your tenant has a license for Microsoft Entra Tenant Governance.
 

---
title: Create a configuration monitor
titleSuffix: Microsoft Entra ID Governance
description: Learn how to create a configuration monitor in Microsoft Entra Tenant Governance to evaluate a tenant against a configuration baseline and report drift
ms.topic: how-to
ms.date: 07/28/2026
---
 
<!-- source: Tenant Governance - Create a new configuration monitor how-to.docx -->
 
# Create a configuration monitor
 
Configuration monitors evaluate a tenant against a configuration baseline and report configuration drift. Use a monitor when you want to track whether a tenant stays aligned with a known-good configuration.
 
## Prerequisites
 
- The tenant has licenses for **Tenant Governance Basic** or **Tenant Governance Premium**. For current licensing requirements, see [Microsoft Entra Tenant Governance licensing](licensing.md).
- Tenant Governance Basic includes a quota for the number of resources that you can monitor. If the resources in the monitor cause the tenant to exceed its quota, monitor creation fails. An organization gets additional quota for monitored resources for each Tenant Governance Premium license it has.
- The signed-in user is in a Microsoft Entra privileged role and has permission to create configuration monitors. The user must also have read permissions for the resource types included in the monitor's configuration baseline.
- The Tenant Configuration Management service has permissions for the workloads and resource types included in the monitor baseline. To assign or remove permissions for the service, see [Configure configuration management service permissions](how-to-set-up-permissions-tenant-monitoring.md).

MODIFIED docs/id-governance/tenant-governance/how-to-see-monitor-results.md

Modified by tafra00 on Jul 31, 2026 2:50 PM
📖 View on learn.microsoft.com

+45 / -25 lines changed

Commit: Tenant Governance config management GA how-to updates (#13965)

Changes:

Before

After

---
title: See monitor results and configuration drifts
titleSuffix: Microsoft Entra ID Governance
description: Learn how to view monitor results and detect configuration drifts in Microsoft Entra Tenant Governance using the admin center
ms.topic: how-to
ms.date: 03/05/2026
---
 
# See monitor results and configuration drifts
 
This article describes how to view monitor results and configuration drifts in the [Microsoft Entra admin center](https://entra.microsoft.com). Each time the monitoring service runs (currently every six hours), it publishes run statistics as a monitor result. When the monitoring service detects that a resource's actual state differs from the configuration baseline, it creates a configuration drift.
 
## Prerequisites
 
- Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).
- Your tenant must have a license for Microsoft Entra Tenant Governance.
- At least one configuration monitor must exist in your tenant and must have run at least once.
 
## Browse to monitors
 

---
title: View monitor results and manage monitors
titleSuffix: Microsoft Entra ID Governance
description: Learn how to view monitor results and configuration drifts and manage configuration monitors in Microsoft Entra Tenant Governance
ms.topic: how-to
ms.date: 07/28/2026
---
 
<!-- source: Tenant Governance - View monitor results and manage monitors how-to.docx -->
 
# View monitor results and manage monitors
 
Use the monitor experience to review monitor definitions, monitor run results, configuration drifts, baseline details, permissions readiness, settings, and audit logs. This article describes how to use the monitor pages after a monitor is created.
 
## Prerequisites
 
- At least one configuration monitor exists in the tenant.
- You can sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with a role that can view Tenant Governance monitor data.
- The Tenant Configuration Management service has the permissions required to run the monitor. If a monitor run fails because of missing service permissions, [update the service permissions](how-to-set-up-permissions-tenant-monitoring.md) before you rely on later run results.
 

MODIFIED docs/id-governance/tenant-governance/how-to-set-up-permissions-tenant-monitoring.md

Modified by tafra00 on Jul 31, 2026 2:50 PM
📖 View on learn.microsoft.com

+32 / -37 lines changed

Commit: Tenant Governance config management GA how-to updates (#13965)

Changes:

Before

After

---
title: Set up permissions for tenant monitoring
titleSuffix: Microsoft Entra ID Governance
description: Learn how to set up the required application permissions and roles for tenant monitoring in Microsoft Entra Tenant Governance
ms.topic: how-to
ms.date: 03/05/2026
---
 
# Set up permissions for tenant monitoring
 
This article describes how to manage the permissions that the configuration management service needs to access resources identified in a monitor. An administrator must assign these permissions manually. Two types of permissions can be managed in the Microsoft Entra admin center: application permissions and Microsoft Entra roles.
 
The permission type you assign depends on the services you need to monitor:
 
- **Microsoft Entra ID and Intune**: Assign application permissions. This approach is the least-privileged way to enable monitoring. For example, to monitor conditional access policies, the configuration management service needs the `Policy.Read.All` application permission. If your policies reference other resource types, you might also need permissions like `User.Read.All` or `RoleManagement.Read.All`.
- **Teams**: Assign the Teams Reader role. Teams doesn't have granular application permissions, so assigning the configuration management service to the Teams Reader role is the least-privileged way to enable monitoring.
- **Exchange, Security, and Compliance (Purview and Defender)**: Assign permissions locally within the admin experiences for those services. Built-in Microsoft Entra roles grant more permissions than needed for these monitoring scenarios.
 
> [!NOTE]
> Monitoring Exchange also requires that you assign the `Exchange.ManageAsApp` permission to the configuration management service, which enables a service principal to authenticate to Exchange APIs. This assignment is independent of any permissions you assign locally to the configuration management service.

---
title: Configure configuration management service permissions
titleSuffix: Microsoft Entra ID Governance
description: Learn how to assign or remove the application permissions and roles that the Tenant Configuration Management service uses to create snapshots and run monitors
ms.topic: how-to
ms.date: 07/28/2026
---
 
<!-- source: Tenant Governance - Configure configuration management service permissions how-to.docx -->
 
# Configure configuration management service permissions
 
Use the **Configuration management permissions** page to assign or remove permissions for the Tenant Configuration Management service. The service uses these permissions to create snapshots and run monitors.
 
Configure service permissions before you create snapshots or monitors that include the corresponding workload resources. Missing service permissions can cause a snapshot to be incomplete or a monitor run to fail.
 
When you create a monitor or snapshot, the **Permissions** step shows whether the service has the least-privilege permissions for the resource types you selected. This step is read-only. If the wizard shows that required least-privilege permissions are missing, use the **Configuration management permissions** page to add them.
 
## Prerequisites
 

MODIFIED docs/id-governance/tenant-governance/how-to-create-tenant.md

Modified by tafra00 on Jul 31, 2026 8:46 PM
📖 View on learn.microsoft.com

+18 / -5 lines changed

Commit: Clarify secure tenant creation prerequisites (#13971)

Changes:

Before

After

---
title: Create a governed workforce tenant
titleSuffix: Microsoft Entra ID Governance
description: Learn how to create a new Microsoft Entra tenant using the secure add-on tenant creation workflow in Tenant Governance
ms.topic: how-to
ms.date: 03/12/2026
---
 
# Create a governed workforce tenant
 
When you create a tenant using the **Governed Workforce** option in the Microsoft Entra admin center, the secure add-on tenant creation flow automatically:
 
- Creates the new workforce tenant
- Establishes a [governance relationship](governance-relationships.md) between your home tenant and the new tenant based on your [governance policy template](governance-policy-templates.md)
- Provisions a Microsoft Entra ID Free [billing asset](signals-metrics.md) under your selected Azure subscription and resource group
 
## Prerequisites
 
- You must have at least **Tenant Contributor** permissions on at least one Microsoft Customer Agreement (MCA) subscription.
- Enterprise Agreement (EA) subscriptions aren't supported.

---
title: Create a governed workforce tenant
titleSuffix: Microsoft Entra ID Governance
description: Learn how to securely create a governed Microsoft Entra workforce tenant and establish governance from your home tenant.
author: tafra00
ms.author: tazkiaafra
ms.topic: how-to
ms.date: 07/29/2026
ai-usage: ai-assisted
ms.custom: msecd-doc-authoring-1018
#customer intent: As an IT administrator, I want to create a governed workforce tenant so that my organization can manage it through a governance relationship.
---
 
# Create a governed workforce tenant
 
This article is for IT administrators who need to create an add-on tenant that is governed from an existing Microsoft Entra tenant. Review the prerequisites before you use the secure add-on tenant creation flow.
 
When you create a tenant using the **Governed Workforce** option in the Microsoft Entra admin center, the secure add-on tenant creation flow automatically:
 
- Creates the new workforce tenant

MODIFIED docs/architecture/road-to-the-cloud-introduction.md

Modified by ichristian01 on Jul 31, 2026 9:33 PM
📖 View on learn.microsoft.com

+15 / -1 lines changed

Commit: Update road-to-the-cloud-introduction.md (#13968)

Changes:

Before

After

---
# Road to the cloud: Introduction
 
Some organizations set goals to remove Active Directory and their on-premises IT footprint. Others take advantage of some cloud-based capabilities to reduce the Active Directory footprint, but not to completely remove their on-premises environments. 
 
This content provides guidance to move:
 
Transformation must be aligned with and achieve business objectives, including increased productivity, reduced costs and complexity, and improved security posture. To better understand the costs versus value of moving to the cloud, see [Forrester TEI for Microsoft Entra ID](https://www.microsoft.com/security/business/forrester-tei-study) and [Cloud economics](https://azure.microsoft.com/overview/cloud-economics/).
 
## Next steps
 
* [Cloud transformation posture](road-to-the-cloud-posture.md)

---
# Road to the cloud: Introduction
 
Organizations are increasingly modernizing identity, access, and device management by reducing their dependence on on-premises Active Directory and adopting cloud-native capabilities in Microsoft Entra ID. Whether the goal is complete Active Directory retirement or a smaller, more secure on-premises footprint, this guidance helps you plan and execute that transformation. 
 
This content provides guidance to move:
 
Transformation must be aligned with and achieve business objectives, including increased productivity, reduced costs and complexity, and improved security posture. To better understand the costs versus value of moving to the cloud, see [Forrester TEI for Microsoft Entra ID](https://www.microsoft.com/security/business/forrester-tei-study) and [Cloud economics](https://azure.microsoft.com/overview/cloud-economics/).
 
## The AD minimization journey
 
Moving from Active Directory to Microsoft Entra ID progresses through five stages. Each stage describes where your environment is on the journey and is paired with a single strategic phase that describes the primary focus of work in that stage. Across every stage, three streams of progress (users and groups, applications, and devices) advance, and they can move independently of one another. 
 
1. **Cloud Attached (Identification):** Establish a baseline by discovering your current identity, application, and device landscape. Active Directory Domain Services remains authoritative while cloud identity is attached but not yet primary. The focus is on visibility and determining which workloads are ready to move. 
 
1. **Hybrid (Modernization):** Move beyond synchronizing identities and begin using cloud identity to strengthen security, resilience, and user experience while on-premises environments remain in place. Identify dependent apps and services, and enable capabilities such as conditional access and self-service password reset. 
 
1. **Cloud-First (Adoption):** Treat Microsoft Entra ID as the default authority for new investments and shift the identity control plane to the cloud. New users, groups, applications, and devices are provisioned as cloud-native by default.

MODIFIED docs/fundamentals/create-new-tenant.md

Modified by tafra00 on Jul 31, 2026 8:46 PM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Clarify secure tenant creation prerequisites (#13971)

Changes:

Before

After

title: Quickstart - Access and create new tenant
description: Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.
ms.topic: quickstart
ms.date: 06/19/2026
ai-usage: ai-assisted
ms.custom: it-pro, fasttrack-edit, mode-other, sfi-image-nochange
ms.collection: M365-identity-device-management
#Customer Intent: As an IT admin, I want to create a new Microsoft Entra tenant so that I can set up a directory for my organization or development environment.
---
>
> - If you're unable to create a Microsoft Entra ID or Azure AD B2C tenant, review your user settings page to ensure that tenant creation isn't switched off. If it isn't enabled you must be assigned at least the [Tenant Creator](../identity/role-based-access-control/permissions-reference.md#tenant-creator) role.
> - This article doesn't cover creating an *external* tenant configuration for consumer-facing apps; learn more about using [Microsoft Entra External ID](~/external-id/customers/overview-customers-ciam.md) for your customer identity and access management (CIAM) scenarios.
> - If you're unable to create a Governed Workforce tenant, verify your billing account permissions. You must have at least Tenant Contributor permissions on at least one Microsoft Customer Agreement (MCA) subscription. Enterprise Agreement (EA) subscriptions aren't currently supported for this scenario.
 
### To create a new tenant
 
   - Select your desired cloud subscription and resource group for storing the Microsoft Entra ID Free billing asset for your new tenant.
 
   > [!NOTE]
   > The subscription must be a Microsoft Customer Agreement (MCA) subscription. Other subscription types aren't currently supported.

title: Quickstart - Access and create new tenant
description: Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.
ms.topic: quickstart
ms.date: 07/29/2026
ai-usage: ai-assisted
ms.custom: it-pro, fasttrack-edit, mode-other, sfi-image-nochange, msecd-doc-authoring-1018
ms.collection: M365-identity-device-management
#Customer Intent: As an IT admin, I want to create a new Microsoft Entra tenant so that I can set up a directory for my organization or development environment.
---
>
> - If you're unable to create a Microsoft Entra ID or Azure AD B2C tenant, review your user settings page to ensure that tenant creation isn't switched off. If it isn't enabled you must be assigned at least the [Tenant Creator](../identity/role-based-access-control/permissions-reference.md#tenant-creator) role.
> - This article doesn't cover creating an *external* tenant configuration for consumer-facing apps; learn more about using [Microsoft Entra External ID](~/external-id/customers/overview-customers-ciam.md) for your customer identity and access management (CIAM) scenarios.
> - If you're unable to create a Governed Workforce tenant, verify that you have either an [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [Pay-As-You-Go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) subscription. Both [Microsoft Online Subscription Agreement (MOSA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-online-services-program) and [Microsoft Customer Agreement (MCA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-customer-agreement) billing accounts are supported. You also need the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts).
 
### To create a new tenant
 
   - Select your desired cloud subscription and resource group for storing the Microsoft Entra ID Free billing asset for your new tenant.
 
   > [!NOTE]
   > Use either an [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [Pay-As-You-Go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) subscription. Both [Microsoft Online Subscription Agreement (MOSA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-online-services-program) and [Microsoft Customer Agreement (MCA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-customer-agreement) billing accounts are supported. You also need the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts).

MODIFIED docs/id-governance/tenant-governance/deployment-guide.md

Modified by tafra00 on Jul 31, 2026 8:46 PM
📖 View on learn.microsoft.com

+5 / -3 lines changed

Commit: Clarify secure tenant creation prerequisites (#13971)

Changes:

Before

After

titleSuffix: Microsoft Entra ID Governance
description: Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring
ms.topic: how-to
ms.date: 03/17/2026
---
 
# Deploy Microsoft Entra Tenant Governance end to end
- A Microsoft Entra tenant with the appropriate license for Tenant Governance. For details, see [Microsoft Entra licensing](~/fundamentals/licensing.md#microsoft-entra-tenant-governance).
- An account with the Tenant Governance Administrator or Global Administrator role.
- For configuration management: an account with the Global Administrator or Privileged Role Administrator role.
- For secure tenant creation: at least Tenant Contributor permissions on a Microsoft Customer Agreement (MCA) subscription. Enterprise Agreement (EA) subscriptions aren't supported.
 
## Phase 1: Enable related tenant discovery
 
 
Use the secure add-on tenant creation feature to create new tenants that are immediately governed.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with at least Tenant Contributor permissions on a Microsoft Customer Agreement subscription.
1. Create a new tenant using the **Governed Workforce** option.
1. Select the Azure subscription and resource group for the Microsoft Entra ID Free billing asset.

titleSuffix: Microsoft Entra ID Governance
description: Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring
ms.topic: how-to
ms.date: 07/29/2026
ai-usage: ai-assisted
ms.custom: msecd-doc-authoring-1018
---
 
# Deploy Microsoft Entra Tenant Governance end to end
- A Microsoft Entra tenant with the appropriate license for Tenant Governance. For details, see [Microsoft Entra licensing](~/fundamentals/licensing.md#microsoft-entra-tenant-governance).
- An account with the Tenant Governance Administrator or Global Administrator role.
- For configuration management: an account with the Global Administrator or Privileged Role Administrator role.
- For secure tenant creation: either a paid [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [Pay-As-You-Go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) subscription. Both [Microsoft Online Subscription Agreement (MOSA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-online-services-program) and [Microsoft Customer Agreement (MCA)](/azure/cost-management-billing/manage/view-all-accounts#microsoft-customer-agreement) billing accounts are supported. You also need the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts).
 
## Phase 1: Enable related tenant discovery
 
 
Use the secure add-on tenant creation feature to create new tenants that are immediately governed.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) with the Tenant Contributor or Subscription Owner/Creator role for the selected subscription.

MODIFIED docs/id-governance/how-to-lifecycle-workflow-unsponsored-guest-removal.md

Modified by Kristina Smith on Jul 31, 2026 4:06 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: docs: move guest billing note under prerequisites

Changes:

Before

After

 
This article walks you through managing unsponsored guests using the **Unsponsored guest cleanup (Preview)** workflow template.
 
> [!IMPORTANT]
> This functionality is subject to the guest billing model. For details, see [Microsoft Entra ID Governance licensing for guest users](microsoft-entra-id-governance-licensing-for-guest-users.md).
 
## Prerequisites
 
[!INCLUDE [Microsoft Entra ID Governance license](~/includes/entra-entra-governance-license.md)]
 
## Manage unsponsored guests using the Microsoft Entra admin center
 
To create a workflow for managing unsponsored guests:

 
This article walks you through managing unsponsored guests using the **Unsponsored guest cleanup (Preview)** workflow template.
 
## Prerequisites
 
[!INCLUDE [Microsoft Entra ID Governance license](~/includes/entra-entra-governance-license.md)]
 
> [!IMPORTANT]
> This functionality is subject to the guest billing model. For details, see [Microsoft Entra ID Governance licensing for guest users](microsoft-entra-id-governance-licensing-for-guest-users.md).
 
## Manage unsponsored guests using the Microsoft Entra admin center
 
To create a workflow for managing unsponsored guests:

MODIFIED docs/identity/app-provisioning/customize-application-attributes.md

Modified by Adelle Ingrid Dimitui on Jul 31, 2026 7:24 PM
📖 View on learn.microsoft.com

+3 / -1 lines changed

Commit: added notes about custom call-outs to existing attribute mappings article

Changes:

Before

After

  > [!NOTE]
  > The maximum supported length for a single attribute mapping expression is **10,000 characters**.
 
- **None** - the target attribute is left unmodified. However, if the target attribute is ever empty, it populates with the default value that you specify.
 
Along with these four basic types, custom attribute-mappings support the concept of an optional **default** value assignment. The default value assignment ensures that a target attribute is populated with a value if there's not a value in Microsoft Entra ID or on the target object. The most common configuration is to leave this blank. For more information about mapping attributes, see [How Application Provisioning works in Microsoft Entra ID](~/identity/app-provisioning/how-provisioning-works.md#mapping-attributes).
- **The value in the source and the target don't have to match exactly:** The value in the target can be a function of the value in the source. So, one could have an emailAddress attribute in the source and the userPrincipalName in the target, and match by a function of the emailAddress attribute that replaces some characters with some constant value.  
- **Matching based on a combination of attributes isn't supported:** Most applications don't support querying based on two properties. Therefore, it's not possible to match based on a combination of attributes. It's possible to evaluate single properties on after another.
- **All users must have a value for at least one matching attribute:** If you define one matching attribute, all users must have a value for that attribute in the source system. If for example, you define userPrincipalName as the matching attribute, all users must have a userPrincipalName. If you define multiple matching attributes (for example, both extensionAttribute1 and mail), not all users have to have the same matching attribute. One user could have a extensionAttribute1 but not mail while another user could have mail but no extensionAttribute1. 
- **The target application must support filtering on the matching attribute:** Application developers allow filtering for a subset of attributes on their user or group API. For applications in the gallery, we ensure that the default attribute mapping is for an attribute that the target application's API does support filtering on. When changing the default matching attribute for the target application, check the non-Microsoft API documentation to ensure that the attribute can be filtered on.  
 
## Editing group attribute-mappings
 
 
 

  > [!NOTE]
  > The maximum supported length for a single attribute mapping expression is **10,000 characters**.
 
- **LCW extensibility workflow** - The target attribute is populated with the value generated by an Azure Logic app, which is triggered by an LCW extensibility workflow.
- **None** - the target attribute is left unmodified. However, if the target attribute is ever empty, it populates with the default value that you specify.
 
Along with these four basic types, custom attribute-mappings support the concept of an optional **default** value assignment. The default value assignment ensures that a target attribute is populated with a value if there's not a value in Microsoft Entra ID or on the target object. The most common configuration is to leave this blank. For more information about mapping attributes, see [How Application Provisioning works in Microsoft Entra ID](~/identity/app-provisioning/how-provisioning-works.md#mapping-attributes).
- **The value in the source and the target don't have to match exactly:** The value in the target can be a function of the value in the source. So, one could have an emailAddress attribute in the source and the userPrincipalName in the target, and match by a function of the emailAddress attribute that replaces some characters with some constant value.  
- **Matching based on a combination of attributes isn't supported:** Most applications don't support querying based on two properties. Therefore, it's not possible to match based on a combination of attributes. It's possible to evaluate single properties on after another.
- **All users must have a value for at least one matching attribute:** If you define one matching attribute, all users must have a value for that attribute in the source system. If for example, you define userPrincipalName as the matching attribute, all users must have a userPrincipalName. If you define multiple matching attributes (for example, both extensionAttribute1 and mail), not all users have to have the same matching attribute. One user could have a extensionAttribute1 but not mail while another user could have mail but no extensionAttribute1. 
- **The target application must support filtering on the matching attribute:** Application developers allow filtering for a subset of attributes on their user or group API. For applications in the gallery, we ensure that the default attribute mapping is for an attribute that the target application's API does support filtering on. When changing the default matching attribute for the target application, check the non-Microsoft API documentation to ensure that the attribute can be filtered on.
- **An attribute with the LCW extensibility workflow mapping type cannot be used as a matching attribute:** If the value of an attribute is set using the LCW extensibility workflow mapping type (where an Azure Logic app generates the value), the attribute cannot be used as a matching attribute.
 
## Editing group attribute-mappings
 

MODIFIED docs/id-governance/tenant-governance/automatic-governance-relationships.md

Modified by tafra00 on Jul 31, 2026 8:46 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Clarify secure tenant creation prerequisites (#13971)

Changes:

Before

After

 
## Microsoft Entra ID Free billing asset
 
When you create a new Microsoft Entra tenant using the secure add-on tenant creation feature, you're prompted to select an existing [Microsoft Customer Agreement (MCA) subscription](/azure/cost-management-billing/manage/create-subscription) and resource group from your billing account. When you create your new tenant, Microsoft generates a new billing asset called **Entra ID Free** under that subscription and resource group, which links to the newly created tenant.
 
The subscription tracks new tenants created with the same billing account, allowing you to maintain an inventory of all new tenants. The subscription also helps prove tenant ownership and helps regain administrative access if you ever lose it. To learn more, see [Microsoft Entra ID Free](/azure/cost-management-billing/manage/microsoft-entra-id-free).

 
## Microsoft Entra ID Free billing asset
 
When you create a new Microsoft Entra tenant using the secure add-on tenant creation feature, you're prompted to select an existing subscription and resource group from your billing account. When you create your new tenant, Microsoft generates a new billing asset called **Entra ID Free** under that subscription and resource group, which links to the newly created tenant.
 
The subscription tracks new tenants created with the same billing account, allowing you to maintain an inventory of all new tenants. The subscription also helps prove tenant ownership and helps regain administrative access if you ever lose it. To learn more, see [Microsoft Entra ID Free](/azure/cost-management-billing/manage/microsoft-entra-id-free).

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files