Administrator provisioning of security keys is in preview. See [Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users](https://aka.ms/passkeyprovision).

You can enable single sign-on to your applications using integrated Windows authentication (IWA) by giving private network connectors permission in Active Directory to impersonate users. The connectors use this permission to send and receive tokens on their behalf.

author: aanjusingh

Business logic often lives in a private Application Programming Interface (API). The API runs on premises or in a private cloud. Your native Android, iOS, Mac, or Windows apps need to interact with the API endpoints to use data or provide user interaction. Microsoft Entra application proxy and the [Microsoft Authentication Library (MSAL)](~/identity-platform/reference-v2-libraries.md) let your native apps securely access your private cloud APIs. Microsoft Entra application proxy is a faster and more secure solution than opening firewall ports and controlling authentication and authorization at the app layer.

Next, open a browser and try again to access the application. You should be prompted for authentication and be able to sign in the application. If you can authenticate, the problem is with the KCD configuration that enables SSO.

|Attribute|Type|Supported for filtering|Required by Forcepoint Cloud Security Gateway - User Authentication|

Explains requirements to prepare FIDO2 hardware for attestation with Microsoft Entra ID


1. Select **application proxy**.

| |[What is self-service password reset?](https://youtu.be/hc97Yx5PJiM)|

When a user signs in, the authentication process checks which authentication methods are registered for the user. The user is prompted to sign-in with the most secure method according to the following order. The order of authentication methods is dynamic. It's updated as the security landscape changes, and as better authentication methods emerge. Due to known issues with certificate-based authentication (CBA) and system-preferred MFA, we moved CBA to the bottom of the list. Click the link for more information about each method.

- During the preview, avoid using an account to set up the agent that requires role activation with Privileged Identity Management. Using an account that doesn't have standing permissions might cause authentication failures for the agent.

We are announcing the ability to configure Entra hybrid join for hosted machine groups in Power Automate. This feature will reach general availability on May 31, 2025.

A Microsoft Entra documentation page was updated: Sign Ins.

Learn how to add a platform to your app in Microsoft Entra to securely handle authentication tokens and enhance your application's security.

Administrators should limit the number of applications they enforce a policy requiring users to reauthenticate every time with. Triggering reauthentication too frequently can increase security friction to a point that it causes users to experience MFA fatigue and open the door to phishing. Web applications usually provide a less disruptive experience than their desktop counterparts when require reauthentication every time is enabled. We factor for five minutes of clock skew when every time is selected in policy, so that we don’t prompt users more often than once every five minutes.

$cloudCred = Get-Credential -Message 'An Active Directory user who is a member of the Hybrid Identity Administrators group for Microsoft Entra ID.'

author: justinha

Entra Connect uses the [Microsoft Entra Connector account](reference-connect-accounts-permissions.md#accounts-used-for-microsoft-entra-connect) to authenticate and sync identities from Active Directory to Entra ID. This account uses username and password to authenticate requests. To enhance the security of the service, we're rolling out an application identity that uses Oauth 2.0 client credential flow with certificate credentials. In this new method, Entra or Administrator creates a single tenant third party application in Entra ID and use one of the relevant certificate management options below for the credentials.

author: justinha

If your team has determined that native authentication is necessary for your application, follow these steps to enable native authentication in the Microsoft Entra admin center:

//...

`https://portal.cloud.hashicorp.com/sign-in?conn-id=HCP-SSO-<HCP_ORG_ID>-samlp`

author: justinha


Open PowerShell and run the following command. Replace the fictitious app ID with the correct ID.

Migrating application authentication from AD FS to Microsoft Entra ID in four stages. Plan your move, test configurations, and secure apps.

- MFA registered guest users remediate their own user risk. The guest user [resets or changes a secured password](https://aka.ms/sspr) at their home tenant (this needs MFA and self service password reset (SSPR) at the home tenant). The secured password change or reset must be initiated on Microsoft Entra ID and not on-premises.

| Scenario | Detailed scenario walk-through | OAuth 2.0 flow and grant | Audience |

author: msmimart

| `acrs` | JSON array of strings | Indicates the Auth Context IDs of the operations that the bearer is eligible to perform. Auth Context IDs can be used to trigger a demand for step-up authentication from within your application and services. Often used along with the `xms_cc` claim. |

> [!NOTE]

How to resolve issues with Microsoft Entra sign-in when the app returns an error message.


Entra Connect uses the [Microsoft Entra Connector account](reference-connect-accounts-permissions#accounts-used-for-microsoft-entra-connect.md) to authenticate and sync identities from Active Directorty to Entra ID. This account uses username and password to authenticate requests. To enhance the security of the service, we are rolling out an application identity that uses Oauth 2.0 client credential flow with certificate credentials. In this new method, Entra or Administrator will create a single tenant 3rd party application in Entra ID and use one of the relevant certificate management options below for the credentials.

Learn about OAuth 2.0 and OpenID Connect in Microsoft identity platform. Explore authentication flows, endpoints, and secure user authentication.

The **Authentication Details** tab provides the following information, for each authentication attempt:

|2519|Reinitialize Entra ID Connector account password| Shows that the AD Sync service account password was reset|

|Attribute|Type|Supported for filtering|Required by Forcepoint Cloud Security Gateway - User Authentication|

1. In your browser:

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#home) as at least a [Billing Administrator](https://go.microsoft.com/fwlink/?linkid=2254515).

A Microsoft Entra documentation page was updated: Powershell Assign Group To App.

A Microsoft Entra documentation page was updated: Powershell Assign User To App.

A Microsoft Entra documentation page was updated: Powershell Display Users Group Of App.

A Microsoft Entra documentation page was updated: Powershell Get All App Proxy Apps Basic.

A Microsoft Entra documentation page was updated: Powershell Get All App Proxy Apps By Connector Group.

A Microsoft Entra documentation page was updated: Powershell Get All App Proxy Apps Extended.

A Microsoft Entra documentation page was updated: Powershell Get All App Proxy Apps With Policy.

A Microsoft Entra documentation page was updated: Powershell Get All Connectors.

A Microsoft Entra documentation page was updated: Powershell Get All Custom Domain No Cert.

A Microsoft Entra documentation page was updated: Powershell Get All Custom Domains And Certs.

A Microsoft Entra documentation page was updated: Powershell Get All Default Domain Apps.

A Microsoft Entra documentation page was updated: Powershell Get All Wildcard Apps.

A Microsoft Entra documentation page was updated: Powershell Get Custom Domain Identical Cert.

A Microsoft Entra documentation page was updated: Powershell Get Custom Domain Replace Cert.

A Microsoft Entra documentation page was updated: Powershell Move All Apps To Connector Group.

Learn how to configure single sign-on between Microsoft Entra ID and Pexip Service.

manager: CelesteDG

| Date | Area | Description |

Here are some of the limits and constraints for restricted management administrative units.

author: garrodonnell

author: garrodonnell

>[!IMPORTANT]

| **GuestUsageGuidelinesUrl**<br>Type: `String`<br>Default: `""` | The URL of a link to the guest usage guidelines. |

> [!WARNING]

>[!IMPORTANT]

This article helps you keep track of the versions that have released and the changes in those versions.

author: joflore

> [!WARNING]

author: rolyon

author: rolyon

| Environment | URL |

| App | URL |

| **Sign-on URL** |



If you're using a Salesforce Sandbox environment, see the [Salesforce Sandbox integration article](./salesforce-sandbox-tutorial.md).

|5. Enable [your configuration](#enable-your-configuration)|Once ready, enable the configuration and users/groups will begin synchronizing|

- [Provision groups to Active Directory using Microsoft Entra Cloud Sync](cloud-sync/how-to-configure-entra-to-active-directory.md)

|Attribute|Type|Supported for filtering|Required by InformaCast|

|Attribute|Type|Supported for filtering|Required by Infor CloudSuite|

|Attribute|Type|Supported for filtering|

1. Review the user attributes that are synchronized from Microsoft Entra ID to frankli in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in frankli for update operations. If you choose to change the [matching target attribute](~/identity/app-provisioning/customize-application-attributes.md), you need to ensure that the frankli API supports filtering users based on that attribute. Select the **Save** button to commit any changes.

|Attribute|Type|Supported For Filtering|

|Attribute|Type|Supported for filtering|Required by Gong|

9. Review the user attributes that are synchronized from Microsoft Entra ID to Hoxhunt in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in Hoxhunt for update operations. If you choose to change the [matching target attribute](~/identity/app-provisioning/customize-application-attributes.md), you need to ensure that the Hoxhunt API supports filtering users based on that attribute. Select the **Save** button to commit any changes.

|userName|String|&check;|

|Attribute|Type|Supported for filtering|Required by Island|

|Attribute|Type|Supported for filtering|Required by Humbol|

|Attribute|Type|Supported For Filtering|

|Attribute|Type|Supported For Filtering|

|Attribute|Type|Supported For Filtering|

|Attribute|Type|Supported for filtering|Required by Funnel Leasing|


|Attribute|Type|Supported for filtering|

|Attribute|Type|Supported for filtering|Required by Howspace|

|Attribute|Type|Supported for filtering|Required by Ideagen Cloud|

|Attribute|Type|Supported for filtering|

|Attribute|Type|Supported for filtering|Required by Headspace|

|Attribute|Type|Supported for filtering|

|Attribute|Type|Supported for filtering|

|Attribute|Type|Supported for filtering|

|Attribute|Type|Supported For Filtering|

|Attribute|Type|Supported for filtering|Required by GoSkills|

|Attribute|Type|Supported for filtering|

|Attribute|Type|Supported for filtering|Required by Hypervault|

|Attribute|Type|Supported for filtering|Required by Jellyfish|

|Attribute|Type|Supported for filtering|

|---|---|---|---|

|Attribute|Type|Supported for filtering|

|---|---|---|

1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses application proxy. If you need to change directories, select **Switch directory** and choose a directory that uses application proxy.

1. **Translate URL in Headers**: Choose **No**.

|Fine grained authorization |Provides access control at the URL level. Added policies can be enforced based on the URL being accessed. The internal URL configured for the app defines the scope of the app that the policy is applied to. The policy configured for the most granular path is enforced. |

ai-usage: ai-assisted

ai-usage: ai-assisted

ai-usage: ai-assisted

ai-usage: ai-assisted


- RD Gateway comes into the picture once a user launches the RDP connection. The RD Gateway handles encrypted RDP traffic coming over the internet and translates it to the on-premises server that the user is connecting to. In this scenario, the traffic the RD Gateway is receiving comes from the Microsoft Entra application proxy.

- Cross-domain scenarios rely on referrals that direct a connector host to DCs that might be outside of the local network perimeter. In these cases, it's equally important to send traffic onward to DCs that represent other respective domains. If you don't, delegation fails.

If you can't use custom domains in your tenant, there are several other options for providing this functionality. All of the other options are also compatible with custom domains and each other, so you can configure custom domains and other solutions.

Public Domain Name System (DNS) records for Microsoft Entra application proxy endpoints are chained CNAME records pointing to an A record. Setting up the records this way ensures fault tolerance and flexibility. The Microsoft Entra private network connector always accesses host names with the domain suffixes `*.msappproxy.net` or `*.servicebus.windows.net`. However, during the name resolution the CNAME records might contain DNS records with different host names and suffixes. Due to the difference, you must ensure that the device (depending on your setup - connector server, firewall, outbound proxy) can resolve all the records in the chain and allows connection to the resolved IP addresses. Since the DNS records in the chain might be changed from time to time, we can't provide you with any list DNS records.

- CORS Rules (optional) can be configured per application segment.

As a result of having only outbound traffic, there's no need to configure inbound access through your firewalls.

- `msauth://com.microsoft.powerbim/izba1HXNWrSmQ7ZvMXgqeZPtNEU%3D`

ai-usage: ai-assisted

ai-usage: ai-assisted

ai-usage: ai-assisted

ai-usage: ai-assisted

The simplest scenario is where the back-end web application doesn’t require session stickiness (session persistence). A back-end application instance handles user requests in the server farm. You can use a layer 4 load balancer and configure it with no affinity. Some options include Microsoft Network Load Balancing and Azure Load Balancer or a load balancer from another vendor. Alternatively, configure a round-robin Domain Name System (DNS) strategy.

ai-usage: ai-assisted

ai-usage: ai-assisted

ai-usage: ai-assisted

Configure user consent settings in Microsoft Entra ID to control when and how users grant permissions to your organization's data. Secure your environment with step‑by‑step guidance.

Learn about the customizable ways to deploy applications to end users in your organization with Microsoft Entra ID.

In this article, you learn how to enable self-service application access using the Microsoft Entra admin center.

|`aud` | String, an App ID GUID | Identifies the intended recipient of the token. In `id_tokens`, the audience is your app's Application ID, assigned to your app in the Azure portal. This value should be validated. The token should be rejected if it fails to match your app's Application ID. |

In Microsoft Entra ID, configuring a large number of on-premises applications can quickly become unmanageable and introduces unnecessary risks for configuration errors if many of them require the same settings. With [Microsoft Entra application proxy](overview-what-is-app-proxy.md), you can address this issue by using wildcard application publishing to publish and manage many applications at once. The solution provides:

An end-to-end guide for planning the deployment of application proxy within your organization

- **Cost-effective**. On-premises solutions typically require you to setup and maintain demilitarized zones (DMZs), edge servers, or other complex infrastructures. Application proxy runs in the cloud, which makes it easy to use. To use application proxy, you don't need to change the network infrastructure or install more appliances in your on-premises environment.

1. In the Microsoft Entra admin center, select **Microsoft Entra ID > Enterprise applications** and select **New application**.

**Type:** New feature

author: jenniferf-skc

ai-usage: ai-assisted

A Microsoft Entra documentation page was updated: Navigate.

A Microsoft Entra documentation page was updated: Audit Logs.

A Microsoft Entra documentation page was updated: Sign Ups.

author: MicrosoftGuyJFlo

A Microsoft Entra documentation page was updated: Configure Security.

**Type:** New feature

| January | | 99.998% | 99.998% | 99.999% | 99.998% |

1. Confirm your settings and set **Enable policy** to **Report-only**.


ai-usage: ai-assisted

A Microsoft Entra documentation page was updated: Howto Analyze Activity Logs With Microsoft Graph.

The required licenses vary based on the monitoring and health capability.

`https://app.highground.com/#/login/<company-slug>`

Microsoft Entra is a platform that allows you to create and manage applications for your organization. You can grant different permissions to your applications, such as accessing data, or performing actions. It's important to review these permissions periodically to ensure they remain appropriate and secure.

To configure single sign-on on **My IBISWorld** side, you need to send the **App Federation Metadata Url** to your IBISWorld Client Relationship Manager. We'll need this to have the SAML SSO connection set properly on both sides.

ai-usage: ai-assisted

> You may also choose to enable SAML-based single sign-on for Harness by following the instructions in the [Harness single sign-on article](./harness-tutorial.md). You can configure single sign-on independent of automatic user provisioning, although these two features complement each other.

In this tutorial, learn how to manage federation certificates in Microsoft Entra ID by customizing expiration dates and renewing certificates for seamless SAML single sign‑on (SSO).

:::zone-end

1. Login with your admin account to Fortes Change Cloud. Select the **Settings icon** and then navigate to **User Provisioning (SCIM)**.

|Attribute|Type|Supported for filtering|Required by Insightly SAML|

1. On the **Basic SAML Configuration** section, perform the following steps:

The first thing to check is the connector. To learn how to debug a private network connector, see [Debug private network connector issues](application-proxy-debug-connectors.md). If you still have issues connecting to your application, return to this article to troubleshoot the application.

This article explains how to troubleshoot issues with Microsoft Entra application proxy. Use the flowchart to fix remote access issues for an on-premises web application.

| AADSTS50102 | Unable to load CustomClaimsTransformer '{type}' was specified for principal '{principalId}'. |

A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I want to learn how to troubleshoot sign-up errors for various scenarios and using different tools so that I can resolve sign-up issues quickly..

Apple's app-site-association domains are critical for SSO extension functioning. (*) You only need to allow sovereign cloud domains if you rely on those in your environment. (**) Maintaining communications with the Experimentation Configuration Service (ECS) ensures that Microsoft can respond to a severe bug in a timely manner.

| AADSTS50088 | Limit on telecom MFA calls reached. Please try again in a few minutes. |

Apple's app-site-association domains are critical for SSO extension functioning. (*) You only need to allow sovereign cloud domains if you rely on those in your environment. (**) Maintaining communications with the Experimentation Configuration Service (ECS) ensures that Microsoft can respond to a severe bug in a timely manner.

**Remediation action**

| Management area | On-premises (Active Directory) feature | Equivalent Microsoft Entra feature |

Locate and engage partners for guidance on Microsoft Entra deployment.

|Partner|Description|

Plan your single sign‑on deployment in Microsoft Entra ID. Streamline role assignments, certificate management, and licensing to ensure uninterrupted access.

Use custom extensions to create workflows using tools like Azure Logic Apps. For workflows, you can enable custom task extensions to call out to external systems. For example, a Joiner workflow with a custom task extension assigns a Microsoft Teams number. Or, when a user becomes a Leaver, a separate workflow grants access to an email account for their manager.

You don't need to open inbound connections to the corporate network.

- A Microsoft Entra tenant with a plan that includes application proxy. Learn more about [Microsoft Entra ID plans and pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing).

ai-usage: ai-assisted

Provide the credentials for an Application Administrator in your Microsoft Entra directory. The Microsoft Entra Application Administrator credentials are often different from your Azure credentials in the portal.

For more information on application protection policies, see:

manager: femila

The following conditions are required: identity, target resource, device platform, and client app. All other conditions are optional and are assumed to be set to **none** by default if no value is provided. For definitions of these conditions, see the article [Building a Conditional Access policy](concept-conditional-access-policies.md).

Learn how the Microsoft Entra Conditional Access optimization agent can help secure your organization.

1. Select **View details** under the Conditional Access Optimization Agent, then select **Start agent** to begin your first run.

In the Azure app registration for the client application:

A Microsoft Entra documentation page was updated: Scenario Spa App Registration.

- You can control your branding and create the URLs you want. A custom domain can help build your users' confidence, because users see and use a familiar name instead of *`msappproxy.net`*.

A Microsoft Entra documentation page was updated: Identity Protection Risks.

author: shlipsey3

| Role | Can do | Can't do |

Frequently asked questions about Access Reviews.

While there's no direct "**Stop**" button for a series, you can edit the series to set an earlier end date. This prevents new review instances from being generated after that date.

```powershell

Privileged Identity Management (PIM) in Microsoft Entra ID, enables you to view activity, activations, and audit history for Azure resources roles within your organization. This includes subscriptions, resource groups, and even virtual machines. Any resource within the Microsoft Entra admin center that uses the Azure role-based access control functionality can take advantage of the security and lifecycle management capabilities in Privileged Identity Management. If you want to keep, audit data for longer than the default retention period, you can use Azure Monitor to route it to an Azure storage account. For more information, see [Archive Microsoft Entra logs to an Azure storage account](~/identity/monitoring-health/howto-archive-logs-to-storage-account.md).

In My Access, Microsoft Entra ID Governance users can see a curated list of suggested access packages in My Access. This capability allows users to quickly view the most relevant access packages for them based off their peers' access packages and previous assignments without scrolling through all their available access packages.

Follow these steps to make a user eligible member or owner of a group. You need permissions to manage groups. For role-assignable groups, you need to be at least a Privileged Role Administrator role or be an Owner of the group. For non-role-assignable groups, you need to be at least a Directory Writer, Groups Administrator, or Identity Governance Administrator, User Administrator role, or be an Owner of the group. Role assignments for administrators should be scoped at directory level (not administrative unit level).

>[!NOTE]

>[!IMPORTANT]

A Microsoft Entra documentation page was updated: Groups Approval Workflow.

A Microsoft Entra documentation page was updated: Groups Role Settings.

A Microsoft Entra documentation page was updated: Pim Apis.

A Microsoft Entra documentation page was updated: Pim Create Roles And Resource Roles Review.

A Microsoft Entra documentation page was updated: Pim How To Use Audit Log.

A how-to guide on dynamically determining the approval requirements for an access package externally using a custom extension.

Once updated, you can go to the edited policy, and confirm the change by selecting **Approval stage details**:

An how-to guide on dynamically determining the approval requirements for an access package externally using a custom extension.

* **Groups**- Anyone in a group to get just-in-time access to Microsoft Entra roles and Azure roles. For Microsoft Entra roles, the group must be a newly created cloud group that’s marked as assignable to a role while for Azure roles, the group can be any Microsoft Entra security group. We don't recommend assigning/nesting a group to a PIM for Groups.

The following diagram shows a typical governance lifecycle of an external user gaining access to an access package, with an expiration.

In entitlement management, approvers for access package requests can either be directly assigned, or determined dynamically. While entitlement management natively supports dynamic approvers such as the requestor's manager, second-level manager, or sponsor from a connected organization, these options don't cover all scenarios. With [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview), you're able to determine approval requirements for access packages at the time of request through an external system. With this external call, you're able to determine approval requirements based on each of the [ApprovalStage properties](/graph/api/resources/approvalstage?view=graph-rest-beta#properties). This article walks you through making a custom extension, its underlying Azure Logic App, setting its system-assigned identity and role in the catalog, editing the logic app action to perform business logic, and testing to see if it runs successfully.

- [Microsoft Entra External ID frequently asked questions](faq-customers.md) - Added clarification on tenant creation

New and updated documentation for the Microsoft Entra External ID.

Welcome to what's new in documentation for Microsoft Entra External ID in external tenants. This article lists new docs that were added and docs that were significantly updated in the last three months.

> [!div class="checklist"]

Tenant Restrictions v2 is supported on all clouds however TRv2 is not enforced with request going across cross clouds.

- Allow the use of unenlightened apps, but block them from accessing Microsoft resources using a special WDAC policy, called an “AppIdTagging policy”.

In this tutorial, learn how to require multifactor authentication when you use Microsoft Entra B2B to collaborate with external users and partner organizations.

Reference documentation for a custom authentication extension that invokes the OnAttributeCollectionStart event for External ID customer configurations.

Reference documentation for a custom authentication extension that invokes the OnAttributeCollectionSubmit event for External ID customer configurations.

- Cross-tenant synchronization is supported within the commercial cloud and Azure Government.

Include file

1. At the top of the page, select **New configuration**.

1. Install the [WDAC wizard](/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard)

- Enable client signaling using Windows GPO. You need to check 'Enable firewall protection on MIcrosoft endpoints' and WDAC enablement. See [Block Chrome, Firefox and .NET applications like PowerShell](#block-chrome-firefox-and-net-applications-like-powershell).

"AllowNativeFederation": true,

Microsoft Entra Internet Access protects access to internet and SaaS apps with an identity-based Secure Web Gateway (SWG), blocking threats, unsafe content, and malicious traffic.

Learn to configure and establish a Secure Shell (SSH) connection using Microsoft Entra Private Access for enhanced security.

manager: femila

manager: femila

manager: femila

manager: femila

manager: femila

manager: femila

manager: femila

A Microsoft Entra documentation page was updated: Linkedin Employment Verification.

author: barclayn

manager: femila

manager: femila

manager: femila

manager: femila

- An account in the resource tenant with at least the **Application administrator** or **Cloud application administrator** role assigned.

In this set up, the customer administrator manages the application that is used by Entra Connect Sync to authenticate to Entra, the application permissions and certificate credential used by the application. The administrator [registers a Microsoft Entra app and creates a service principal.](graph/tutorial-applications-basics?tabs=http#register-an-application-with-microsoft-entra-id.md). The application should be assigned the required [permissions](#microsoft-graph-permissions-for-byoa)

Reference table that maps application IDs to applications and their service principal usage from the sign-in logs.

manager: femila

> - Mulit-Geo doesn't support Japan region selection through Microsoft Entra admin center.

> [!NOTE]

This article tracks the changes in each released version of the Global Secure Access client for Windows.

This article tracks the changes in each released version of the Global Secure Access client for Windows.

- Only the Global Secure Access client for Windows, starting with version 1.8.239.0, is aware of Universal CAE. On other platforms, the Global Secure Access client uses regular access tokens.

manager: femila

manager: femila

Administrators can create policies that target specific network locations as a signal along with other conditions in their decision making process. They can include or exclude these network locations as part of their policy configuration. These network locations might include public IPv4 or IPv6 network information, countries/regions, unknown areas that don't map to specific countries/regions, or [Global Secure Access' compliant network](../../global-secure-access/how-to-compliant-network.md).

1. User requests a DNS query for `app.contoso.com`. If not cached locally, the DNS query is sent to the DNS proxy at the GSA edge.


1. Navigate to **Global Secure Access** > **Monitor** > **Deployment logs**.

Discover how to use advanced diagnostics to resolve issues with the Global Secure Access mobile client for Android and iOS.

Troubleshoot the Global Secure Access client using the health check tab in the advanced diagnostics utility.

Organizations who use Conditional Access along with the Global Secure Access, can prevent malicious access to Microsoft apps, third-party SaaS apps, and private line-of-business (LoB) apps using multiple conditions to provide defense-in-depth. These conditions might include device compliance, location, and more to provide protection against user identity or token theft. Global Secure Access introduces the concept of a compliant network within Microsoft Entra ID Conditional Access. This compliant network check ensures users connect via the Global Secure Access service for their specific tenant and are compliant with security policies enforced by administrators.