A Microsoft Entra documentation page was updated: Create a security plan for external access to resources.

A Microsoft Entra documentation page was updated: Determine your security posture for external access with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Microsoft Entra security operations for Privileged Identity Management.

manager: martinco

Microsoft Entra enables you to securely manage user access to services and resources. Included with Microsoft Entra is a family of identity management and network access capabilities. For information about Microsoft Entra features, see [What is Microsoft Entra?](~/fundamentals/whatis.md)

A Microsoft Entra documentation page was updated: Best practices for all isolation architectures.

A Microsoft Entra documentation page was updated: Control external access to resources in Microsoft Entra ID with sensitivity labels.

A Microsoft Entra documentation page was updated: Directory synchronization.

A Microsoft Entra documentation page was updated: Discover the current state of external collaboration in your organization.

A Microsoft Entra documentation page was updated: Govern on-premises service accounts.

A Microsoft Entra documentation page was updated: Govern Service Accounts.

A Microsoft Entra documentation page was updated: Introduction to delegated administration and isolated environments.

A Microsoft Entra documentation page was updated: LDAP synchronization with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Microsoft Entra fundamentals.

A Microsoft Entra documentation page was updated: Microsoft Entra integrations with synchronization protocols.

A Microsoft Entra documentation page was updated: OAuth 2.0 authorization with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Remote Desktop Gateway Services.

A Microsoft Entra documentation page was updated: Resource isolation with multiple tenants.

A Microsoft Entra documentation page was updated: SCIM synchronization with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Secure external access with groups in Microsoft Entra ID and Microsoft 365.

A Microsoft Entra documentation page was updated: Secure group managed service accounts.

A Microsoft Entra documentation page was updated: Secure on-premises computer accounts with Active Directory.

A Microsoft Entra documentation page was updated: Secure standalone managed service accounts.

A Microsoft Entra documentation page was updated: Secure user-based service accounts in Active Directory.

A Microsoft Entra documentation page was updated: Securing cloud-based service accounts.

A Microsoft Entra documentation page was updated: Securing on-premises service accounts.

A Microsoft Entra documentation page was updated: Securing service principals in Microsoft Entra ID .

- it-pro

- it-pro

author: rwike77

author: rwike77

|IssuerAndSubject | `X509:<I>DC=com,DC=contoso,CN=CONTOSO-DC-CA<S>DC=com,DC=contoso,OU=UserAccounts,CN=mfatest` | certificateUserIds | low-affinity |

1. Authenticate with a certificate that has policy OID of 3.4.5.6 and Issued by CN=CBATestRootProd. Authentication should pass and get a multifactor claim.

Deploy the new Defender for Identity sensor on Microsoft Entra Connect servers. The classic sensor is now available, enhancing visibility and security for hybrid identity environments. This update is available globally, and organizations should install the sensor for comprehensive monitoring and threat detection. No admin action is required before the rollout.

1. There are two tabs in the report: **Registration** and **Usage**.

To synchronize users from Microsoft Entra to SAP Cloud Identity Services, enable [automated user provisioning](sap-cloud-platform-identity-authentication-provisioning-tutorial.md).

* By default, the value of the Microsoft Entra user `userPrincipalName` attribute is mapped to both the `userName` and `emails[type eq "work"].value` attributes of SAP Cloud Identity Services. If user's email addresses are different from their user principal names, then you may need to change this mapping.

>[!Important]

A Microsoft Entra documentation page was updated: Header-based authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: LDAP authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Microsoft Entra integrations with authentication protocols.

A Microsoft Entra documentation page was updated: OpenID Connect authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Password-based authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: RADIUS authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: SAML authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: SSH authentication with Microsoft Entra ID.

A Microsoft Entra documentation page was updated: Windows authentication - Kerberos constrained delegation with Microsoft Entra ID.

The per-user MFA administration experience in the Microsoft Entra admin center is recently improved. To view and manage user states, complete the following steps:

A Microsoft Entra documentation page was updated: Monitoring application sign-in health for resilience.

Explains requirements to prepare FIDO2 hardware for attestation with Microsoft Entra ID


Organizations deploying phishing-resistant passwordless typically have a need for some of their personas to use remote desktop technology to facilitate productivity, security, or administration. The two basic use cases are:

[Deploy a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-deploy-phishing-resistant-passwordless-authentication.md)

[Considerations for specific personas in a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-plan-persona-phishing-resistant-passwordless-authentication.md)

[Deploy a phishing-resistant passwordless authentication deployment in Microsoft Entra ID](how-to-deploy-phishing-resistant-passwordless-authentication.md)

$certHash = ($hashBytes|ForEach-Object ToString X2) -join ''

This section lists the custom authentication extensions events available in Microsoft Entra ID workforce and external tenants. For detailed information about the events, refer to the respective documentation.

- A familiarity and understanding of the concepts covered in [custom authentication extensions](/entra/identity-platform/custom-extension-overview).

This video provides detailed instructions on configuring Microsoft Entra custom authentication extensions and offers best practices and valuable tips for optimal implementation.

- Support for Bash scripts for custom compliance policies

This article provides information about the latest updates to Microsoft Single Sign-on for Linux.

# Add a meaningful description for search results

1. **Create a Microsoft Entra test user** - to test Microsoft Entra single sign-on with Britta Simon.

Learn how to configure single sign-on between Microsoft Entra ID and Freshdesk.

Learn how to configure single sign-on between Microsoft Entra ID and Palo Alto Networks Captive Portal.

Learn how to configure single sign-on between Microsoft Entra ID and Adaptive Insights.

9. Click the folder icon to upload your **Configuration profile file**. Choose the *kerberos.mobileconfig* file you [saved previously](#Kerberos SSO MDM profile configuration for on-premises Active Directory) after customizing the template.

> [!NOTE]

When this setting is enabled, the secure patterns are strictly enforced.

A Microsoft Entra documentation page was updated: Adobe Creative Cloud Tutorial.

A Microsoft Entra documentation page was updated: Kao Navi Tutorial.

A Microsoft Entra documentation page was updated: Tutorial V2 Android.

Open Darwinbox studio and navigate to Connector Library. Search for and install the “Microsoft” and “Microsoft Entra” connectors:

</plist>

Refer to the [Microsoft Entra ID macOS Platform SSO documentation](./macos-psso.md) to learn how to configure and deploy Platform SSO. Platform SSO should be deployed on Enterprise-managed Macs regardless of whether you choose to deploy Kerberos SSO using this guide.

- Windows Server 2016

To configure the integration of Citrix ShareFile into Microsoft Entra ID, you need to add Citrix ShareFile from the gallery to your list of managed SaaS apps.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).

manager: CelesteDG

manager: CelesteDG

- Sign-in logs

A Microsoft Entra documentation page was updated: Manage external access to resources with Conditional Access policies.

author: MicrosoftGuyJFlo

Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Protection** > **Conditional Access** > **Policies**.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator).

1. Perform the following step, if you wish to configure the application in **SP** initiated mode:

This article shows the new and updated documentation for the Microsoft Entra application management.

1. Perform the following step, if you wish to configure the application in **SP** initiated mode:

author: owinfreyATL

author: owinfreyATL

| Identity and access management | New identity categories | Network access |

manager: CelesteDG

The provisioning summary report and Provisioning logs play a key role helping admins troubleshoot various user account provisioning issues.

Refer to the following links to troubleshoot any issues that may turn up during provisioning:

To troubleshoot any issues that might turn up during provisioning, see the following articles:

* [Troubleshooting provisioning](troubleshoot.md)

- [Check the status of user provisioning](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md)

- [Skip deletion of user accounts that go out of scope in Azure Active Directory](skip-out-of-scope-deletions.md)

- Support for use of `sAMAccountName` and security identifier (SID) attributes synced from on-premises is designed to enable moving existing applications from Active Directory Federation Services (AD FS) and other identity providers. Groups managed in Microsoft Entra ID don't contain the attributes necessary to emit these claims.

If an adversary is able to successfully steal a token, organizations can enable certain capabilities to automatically reduce the

[Build a SCIM endpoint and configure provisioning when creating your own app](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md)

Redirect URIs for SPAs that use the auth code flow require special configuration.

Learn how to integrate Darwinbox HR with Microsoft Entra ID to automate user provisioning, manage lifecycle workflows, and streamline HR-driven processes.

author: henrymbuguakiarie

A Microsoft Entra documentation page was updated: Howto Configure Recommendation Email Notifications.

author: shlipsey3

author: shlipsey3

1. Select **My Access settings for end users**.

$createdDateTime = $_.CreatedDateTime -replace "\\/Date\((\d+)\)\\/", '$1'

1. On the Add an Action pane, select **HTTP**.

- At least the [Entitlement Management Catalog owner](../id-governance/entitlement-management-delegate.md#entitlement-management-roles) role of the catalog where the custom extension will be created.

Assigning Microsoft Entra roles through access packages helps to efficiently manage role assignments at scale and improves the role assignment lifecycle.

No. Access reviews capture a snapshot of access at the start of each review instance. Any changes made to user assignments, group membership, or reviewer configuration after the review begins won't be reflected in that instance.

In this article, you find questions to commonly asked questions about [access reviews](access-reviews-overview.md). Check back to this page frequently as changes happen often, and answers are continually being added.

author: csmulligan

Within the same cloud, which clouds can cross-tenant synchronization be used in?

author: msmimart

1. Select **Add**.

A Microsoft Entra documentation page was updated: Onboard external users to line of business applications using Microsoft Entra B2B.

A Microsoft Entra documentation page was updated: Plan a Microsoft Entra B2B collaboration deployment.

A Microsoft Entra documentation page was updated: Transition to governed collaboration with Microsoft Entra B2B collaboration.

Registration of passkey (FIDO2) credentials isn't supported for internal or external guest users, including B2B collaboration users in the resource tenant.

The video explains step-up authentication and tenant configuration. In step-up authentication, users sign in with minimal authentication steps, like a username and password, or a social identity. However, upon risky actions, like high-value transactions or accessing sensitive data, the application requires more verification.

::: zone-end

author: rwike77

internal class Program

A Microsoft Entra documentation page was updated: Service Accounts Managed Identities.

A Microsoft Entra documentation page was updated: Service Principal Table.

Learn how workload identify federation enables secre access to Microsoft Entra protected resources from external software workloads without managing secrets.

You can configure the lifetime of access, ID, or Security Assertion Markup Language (SAML) tokens issued by the Microsoft identity platform. Token lifetimes can be set for all apps in your organization, multitenant applications, or specific service principals. Configuring token lifetimes for [managed identity service principals](~/identity/managed-identities-azure-resources/overview.md) isn't supported.

This article provides troubleshooting guidance for the Global Secure Access client for Windows. It explores each tab of the Advanced diagnostics utility.

**Objective:** Verify that the connector machine, backend proxy, and firewall support the certificate the connector created. Also, verify the certificate is valid.

- A **Security Administrator** role is required to export Global Secure Access Network Traffic Logs in Diagnostic Settings.

Content-type: application/json

manager: femila

| View traffic logs and alerts | ✅ | ✅ | ✅ | | | | | ✅ |

- For the initial agent enablement/setup, you will need to be either a [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator) or [Global Administrator](../role-based-access-control/permissions-reference.md#global-administrator) role during the preview. These roles also have [access to Security Copilot by default](/copilot/security/authentication). After setup, you can assign Conditional Access Administrators with Security Copilot access. This will give your Conditional Access Administrators the ability to use the agent as well.