How to transition off of Microsoft Entra Permissions Management for the anticipated product deprecation.

View the latest public preview and general availability of features in Permissions Management.

How to add an account/subscription/project to Permissions Management after onboarding is complete.

How to add or remove a user in Microsoft Entra Permissions Management through the Microsoft Enter admin center.

How to configure AWS IAM Identity Center as an identity provider.

How to configure Okta as an identity provider in Microsoft Entra Permissions Management.

How to create a rule in the Autopilot dashboard in Microsoft Entra Permissions Management.

How to create and view activity alerts and alert triggers in Microsoft Entra Permissions Management.

How to create and view permission analytics triggers in the Permission analytics tab in Permissions Management.

How to create and view rule-based anomaly alerts and alert triggers in Permissions Management.

How to create and view statistical anomaly alerts and alert triggers in the Statistical Anomaly tab in Permissions Management.

How to create folders to organize Authorization Systems - accounts, subscriptions, and projects - in Microsoft Entra Permissions Management.

How to define and manage users, roles, and access levels in the Permissions Management User management dashboard.

How to enable Microsoft Entra Permissions Management in your organization.

How to enable or disable the controller in Permissions Management after onboarding is complete.

Frequently asked questions (FAQs) about Microsoft Entra Permissions Management.

How to generate, view, and apply rule recommendations in the Microsoft Entra Permissions Management Autopilot dashboard.

How to manage users and groups in the User management dashboard in Permissions Management.

Microsoft Entra Permissions Management glossary

View current Microsoft Entra Permissions Management partners and their websites.

Quickstart guide - How to quickly onboard your Microsoft Entra Permissions Management product

Review roles and the level of permissions assigned in Microsoft Entra Permissions Management.

How to onboard a Google Cloud Platform (GCP) project on Permissions Management.

How to a Microsoft Azure subscription on Permissions Management.

How to onboard an Amazon Web Services (AWS) account to Permissions Management.

How to select group-based permissions settings with the User management dashboard.

How to view analytic information about access keys in Permissions Management.

How to view usage analytics about active resources in Permissions Management.

How to view analytic information about active tasks in Permissions Management.

How to view analytic information about groups in Permissions Management.

How to view analytic information about serverless functions in Permissions Management.

How to view analytic information about users in Permissions Management.

How to use the Analytics dashboard in Permissions Management to view details about users, groups, active resources, active tasks, access keys, and serverless functions.

How to view and configure settings for collecting data from your authorization system.

How to view current billable resources in your authorization system in Microsoft Entra Permissions Management.

How to view data about the activity in your authorization system in the Microsoft Entra Permissions Management Dashboard.

How to view information about active and completed tasks in the Activities pane in Permissions Management.

How to view information about alerts and alert triggers in the Alerts dashboard in Permissions Management.

How to view information about rules in the Autopilot dashboard in Permissions Management.

How to view statistics and data about your authorization system in the Permissions Management.

How to view personal and organization information in the Account settings dashboard in Microsoft Entra Permissions Management.

How to view current privileged role assignments in the Microsoft Entra Insights tab.

How to view information about identities that can access accounts from an external account in Permissions Management.

A Microsoft Entra documentation page was updated: Microsoft 365 Migration Administrator.

A Microsoft Entra documentation page was updated: Ai Administrator.

A Microsoft Entra documentation page was updated: Attack Payload Author.

A Microsoft Entra documentation page was updated: Attack Simulation Administrator.

A Microsoft Entra documentation page was updated: Attribute Assignment Administrator.

A Microsoft Entra documentation page was updated: Attribute Assignment Reader.

A Microsoft Entra documentation page was updated: Attribute Definition Administrator.

A Microsoft Entra documentation page was updated: Attribute Definition Reader.

A Microsoft Entra documentation page was updated: Azure Devops Administrator.

A Microsoft Entra documentation page was updated: Billing Administrator.

A Microsoft Entra documentation page was updated: Cloud Device Administrator.

A Microsoft Entra documentation page was updated: Compliance Administrator.

A Microsoft Entra documentation page was updated: Compliance Data Administrator.

A Microsoft Entra documentation page was updated: Customer Lockbox Access Approver.

A Microsoft Entra documentation page was updated: Desktop Analytics Administrator.

A Microsoft Entra documentation page was updated: Directory Readers.

A Microsoft Entra documentation page was updated: Directory Writers.

A Microsoft Entra documentation page was updated: Domain Name Administrator.

A Microsoft Entra documentation page was updated: Dynamics 365 Administrator.

A Microsoft Entra documentation page was updated: Dynamics 365 Business Central Administrator.

A Microsoft Entra documentation page was updated: Edge Administrator.

A Microsoft Entra documentation page was updated: Exchange Administrator.

A Microsoft Entra documentation page was updated: Exchange Recipient Administrator.

A Microsoft Entra documentation page was updated: Extended Directory User Administrator.

A Microsoft Entra documentation page was updated: Fabric Administrator.

A Microsoft Entra documentation page was updated: Global Administrator.

A Microsoft Entra documentation page was updated: Global Reader.

A Microsoft Entra documentation page was updated: Groups Administrator.

A Microsoft Entra documentation page was updated: Guest Inviter.

A Microsoft Entra documentation page was updated: Helpdesk Administrator.

A Microsoft Entra documentation page was updated: Hybrid Identity Administrator.

A Microsoft Entra documentation page was updated: Insights Administrator.

A Microsoft Entra documentation page was updated: Insights Analyst.

A Microsoft Entra documentation page was updated: Insights Business Leader.

A Microsoft Entra documentation page was updated: Intune Administrator.

A Microsoft Entra documentation page was updated: Iot Device Administrator.

A Microsoft Entra documentation page was updated: Kaizala Administrator.

A Microsoft Entra documentation page was updated: Knowledge Administrator.

A Microsoft Entra documentation page was updated: Knowledge Manager.

A Microsoft Entra documentation page was updated: License Administrator.

A Microsoft Entra documentation page was updated: Message Center Privacy Reader.

A Microsoft Entra documentation page was updated: Message Center Reader.

A Microsoft Entra documentation page was updated: Microsoft 365 Backup Administrator.

A Microsoft Entra documentation page was updated: Microsoft Entra Joined Device Local Administrator.

A Microsoft Entra documentation page was updated: Microsoft Graph Data Connect Administrator.

A Microsoft Entra documentation page was updated: Microsoft Hardware Warranty Administrator.

A Microsoft Entra documentation page was updated: Microsoft Hardware Warranty Specialist.

A Microsoft Entra documentation page was updated: Network Administrator.

A Microsoft Entra documentation page was updated: Office Apps Administrator.

A Microsoft Entra documentation page was updated: Organizational Data Source Administrator.

A Microsoft Entra documentation page was updated: Organizational Messages Approver.

A Microsoft Entra documentation page was updated: Organizational Messages Writer.

A Microsoft Entra documentation page was updated: Partner Tier1 Support.

A Microsoft Entra documentation page was updated: Partner Tier2 Support.

A Microsoft Entra documentation page was updated: People Administrator.

A Microsoft Entra documentation page was updated: Permissions Management Administrator.

A Microsoft Entra documentation page was updated: Permissions Reference.

A Microsoft Entra documentation page was updated: Printer Administrator.

A Microsoft Entra documentation page was updated: Printer Technician.

A Microsoft Entra documentation page was updated: Privileged Role Administrator.

A Microsoft Entra documentation page was updated: Search Administrator.

A Microsoft Entra documentation page was updated: Search Editor.

A Microsoft Entra documentation page was updated: Service Support Administrator.

A Microsoft Entra documentation page was updated: Sharepoint Administrator.

A Microsoft Entra documentation page was updated: Sharepoint Embedded Administrator.

A Microsoft Entra documentation page was updated: Skype For Business Administrator.

A Microsoft Entra documentation page was updated: Teams Administrator.

A Microsoft Entra documentation page was updated: Teams Communications Administrator.

A Microsoft Entra documentation page was updated: Teams Communications Support Engineer.

A Microsoft Entra documentation page was updated: Teams Communications Support Specialist.

A Microsoft Entra documentation page was updated: Teams Devices Administrator.

A Microsoft Entra documentation page was updated: Teams Reader.

A Microsoft Entra documentation page was updated: Teams Telephony Administrator.

A Microsoft Entra documentation page was updated: Tenant Creator.

A Microsoft Entra documentation page was updated: User Administrator.

A Microsoft Entra documentation page was updated: User Experience Success Manager.

A Microsoft Entra documentation page was updated: Virtual Visits Administrator.

A Microsoft Entra documentation page was updated: Viva Glint Tenant Administrator.

A Microsoft Entra documentation page was updated: Viva Goals Administrator.

A Microsoft Entra documentation page was updated: Viva Pulse Administrator.

A Microsoft Entra documentation page was updated: Windows 365 Administrator.

A Microsoft Entra documentation page was updated: Windows Update Deployment Administrator.

A Microsoft Entra documentation page was updated: Yammer Administrator.

Before you configure a forest trust in Domain Services, make sure your networking between Azure and on-premises environment meets the following requirements:

Refrain from redirecting DNS zones related to windowsazure.com or core.windows.net. If DNS redirection is required, limit the redirection to individual host names instead of zones. For example, use server1.file.core.windows.net instead of file.core.windows.net.

A Microsoft Entra documentation page was updated: Compare Identity Solutions.

A Microsoft Entra documentation page was updated: Create Forest Trust Powershell.

A Microsoft Entra documentation page was updated: Tutorial Create Forest Trust.

How to revoke access to high-risk and unused tasks or assign read-only status for Microsoft Azure and Google Cloud Platform (GCP) identities in the Remediation dashboard.

How to attach and detach permissions for groups, users, and service accounts for Microsoft Azure and Google Cloud Platform (GCP) identities in the Remediation dashboard in Permissions Management.

How to attach and detach permissions for users, roles, and groups for Amazon Web Services (AWS) identities in the Remediation dashboard in Permissions Management.

How to clone a role/policy in Microsoft Entra Permissions Management.

How to create a role/policy in the Remediation dashboard.

How to create or approve a request for permissions in the Remediation dashboard.

How to delete a role/policy in the Microsoft Entra Permissions Management Remediation dashboard.

Understand potential error codes that may appear during onboarding of Microsoft Entra Permissions Management

How to modify a role/policy in the Remediation dashboard in Microsoft Entra Permissions Management.

Troubleshoot issues with Permissions Management

How to view existing roles/policies and requests for permission in the Remediation dashboard in Permissions Management.

How to view and filter information about roles/policies in the Microsoft Entra Permissions Management Remediation dashboard.

> Error code 1002013 indicates an expected (and successful) interrupt of the sign-up flow. [Learn more](howto-troubleshoot-sign-up-errors.md#sign-up-error-codes)

**Remediation action**

**Remediation action**

**Remediation action**

**Remediation action**

A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I want to learn how to troubleshoot sign-up errors for various scenarios and using different tools so that I can resolve sign-up issues quickly..

How to create a custom query in the Audit dashboard in Microsoft Entra Permissions Management.

How to create, view, and share a custom report in the Permissions Management.

How to filter and query user activity in Microsoft Entra Permissions Management.

How to generate an on-demand report from a query in the **Audit** dashboard in Permissions Management.

How to generate and view a system report in the Permissions Management.

How to use queries to see how users access information in an authorization system in Permissions Management.

View a list and description of all system reports available in Permissions Management.

How to view and download the Permissions Analytics Report in Permissions Management.

How to view system reports in the Reports dashboard in Permissions Management.

| March | 99.568% | 99.998% | 99.999% | 99.999% | 99.996% |

A Microsoft Entra documentation page was updated: Attribute Log Administrator.

A Microsoft Entra documentation page was updated: Attribute Log Reader.

Users in this role can create and manage all aspects of environments, Power Apps, Flows, Data Loss Prevention policies. Additionally, users with this role have the ability to manage support tickets and monitor service health.

A Microsoft Entra documentation page was updated: Reports Reader.

A Microsoft Entra documentation page was updated: Usage Summary Reports Reader.

- To find sign-up attempts that failed during email validation:

A User account in Microsoft Entra must be added to a role assignment in Azure before the user is allowed to sign in to Azure virtual machines or Arc-connected Windows Server. The same roles are used for both Azure virtual machines and Arc-enabled Windows Server.

To create a PKI container object:

- Use Intune to automate and scale Microsoft Entra join with mobile device management (MDM) autoenrollment of Azure Windows VMs that are part of your virtual desktop infrastructure (VDI) deployments. MDM autoenrollment requires Microsoft Entra ID P1 licenses. Windows Server VMs don't support MDM enrollment.

author: vimrang

Fraud confirmation | If this was not you trying to sign in, protect your account by notifying your IT team by pressing 1.

Changes are required if you use the [Microsoft.Identity.Client](https://www.nuget.org/packages/Microsoft.Identity.Client) package and one of the following APIs in your application. The public client API is **deprecated** [as of the 4.73.1 release](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/main/CHANGELOG.md):

The [OAuth 2.0 resource owner password credentials](v2-oauth-ropc.md) (ROPC) grant allows an application to sign in the user by directly handling their password. In your desktop application, you can use the username/password flow to acquire a token silently. No UI is required when using the application.

A Microsoft Entra documentation page was updated: Authentication Administrator.

A Microsoft Entra documentation page was updated: Authentication Extensibility Administrator.

A Microsoft Entra documentation page was updated: Authentication Policy Administrator.

A Microsoft Entra documentation page was updated: Privileged Authentication Administrator.

Learn about the information available on each of the tabs on the Microsoft Entra sign-in log activity details.

A Microsoft Entra documentation page was updated: Password Administrator.

A Microsoft Entra documentation page was updated: Sign Ins.

- You must have at least the [Microsoft Entra ID P1](overview.md#license-requirements) license.

An introduction to Microsoft Entra Permissions Management.

author: MicrosoftGuyJFlo

A Microsoft Entra documentation page was updated: Audit Logs.

> [!IMPORTANT]

A Microsoft Entra documentation page was updated: Sign Ups.

Most recommendations follow the same pattern. You're provided information about how the recommendation works, its value, and some action steps to address the recommendation. This section provides an overview of the details provided in a recommendation, but aren't specific to one recommendation.

A Microsoft Entra documentation page was updated: Concepts Forest Trust.

- US Gov -> Commercial

**Service category:** Provisioning

The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings.

The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings.

To ensure Conditional Access policies are accurately enforced on specified authentication flows, we use functionality called protocol tracking. This tracking is applied to the session using device code flow or authentication transfer. In these cases, the sessions are considered protocol tracked. Any protocol tracked sessions are subject to policy enforcement if a policy exists. Protocol tracking state is sustained through subsequent refreshes. Given this, it is possible for non device code flow or authentication transfer flows to be subject to enforcement of authentication flows policies.

A Microsoft Entra documentation page was updated: Conditional Access Administrator.

- **Success:** The Conditional Access policy was applied successfully to the sign-in attempt.

- Provectus - Secure Contacts

We're continually adding more administrative portals to the list.

How to configure ServiceNow with Microsoft Entra Permissions Management.

How to view the Permissions Management API integration settings and create service accounts and roles.

This article shows the new and updated documentation for the Microsoft Entra application management.

1. If you wish to configure the application in **SP** initiated mode, then perform the following step:

A Microsoft Entra documentation page was updated: Application Administrator.

A Microsoft Entra documentation page was updated: Cloud Application Administrator.

Learn how Microsoft Entra Permissions Management helps strengthen security in cloud environments as an enhancement for Defender for Cloud

A Microsoft Entra documentation page was updated: Cloud App Security Administrator.

A Microsoft Entra documentation page was updated: Security Administrator.

A Microsoft Entra documentation page was updated: Security Operator.

A Microsoft Entra documentation page was updated: Security Reader.

A Microsoft Entra documentation page was updated: Azure Information Protection Administrator.

| Attribute Name | User | Comment |

A Microsoft Entra documentation page was updated: Attribute Provisioning Administrator.

A Microsoft Entra documentation page was updated: Attribute Provisioning Reader.

A Microsoft Entra documentation page was updated: Directory Synchronization Accounts.

Learn how to configure token lifetimes for access, SAML, and ID tokens in Microsoft Identity Platform to enhance security.

Redirect URIs for SPAs that use the auth code flow require special configuration.

Microsoft is enhancing security by disabling TLS versions 1.0 and 1.1 as communicated on November 10, 2023. While the Microsoft implementation of TLS 1.0 and TLS 1.1 versions is not known to have vulnerabilities, TLS 1.2 or later versions provide improved security features, including perfect forward secrecy and stronger cipher suites. This change helps protect customer data and ensures compliance with industry standards.

A Microsoft Entra documentation page was updated: Application Developer.

Welcome to what's new in the Microsoft identity platform documentation. This article lists new articles that were added or had significant updates in the last three months.

The following diagram shows a high-level architecture of provisioning engine connecting to a single forest, although multiple forests are supported. This architecture shows how the various components interact with each other.

A Microsoft Entra documentation page was updated: Organizational Branding Administrator.

A Microsoft Entra documentation page was updated: Identity Governance Administrator.

- **Require MFA**: The agent identifies users who aren't covered by a Conditional Access policy that requires MFA and can update the policy.

[Learn more](../../id-governance/entitlement-management-organization.md)

> If you select multiple credential types from one issuer, users will be required to present credentials of all selected types. Similarly, if you include multiple issuers, users will be required to present credentials from each of the issuers you include in the policy. To give users the option of presenting different credentials from various issuers, configure separate policies for each issuer/credential type you’ll accept.

A Microsoft Entra documentation page was updated: Lifecycle Workflows Administrator.

New and updated documentation for the Microsoft Entra External ID.

A Microsoft Entra documentation page was updated: B2c Ief Keyset Administrator.

A Microsoft Entra documentation page was updated: B2c Ief Policy Administrator.

A Microsoft Entra documentation page was updated: External Id User Flow Administrator.

A Microsoft Entra documentation page was updated: External Id User Flow Attribute Administrator.

A Microsoft Entra documentation page was updated: External Identity Provider Administrator.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Domain Name Administrator](~/identity/role-based-access-control/permissions-reference.md#domain-name-administrator).

Microsoft Entra is updating the default sign-in background for Work or School accounts to align with Microsoft's Fluent design language. This visual update will roll out from late September to early October 2025. No action is required, but internal documentation and help desks should be updated to reduce confusion.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](~/identity/role-based-access-control/permissions-reference.md#cloud-application-administrator).

| Use tenant restrictions to control how external accounts are used on your networks and managed devices. | With tenant restrictions, you can prevent your users from using accounts they've created in unknown tenants or accounts they've received from external organizations. We recommend you disallow these accounts and use B2B collaboration instead. |

<br/>**Target tenant**

| **Sign-out** | When a [SAML](../../identity-platform/single-sign-out-saml-protocol.md) or [OpenID Connect](../../identity-platform/v2-protocols-oidc.md#send-a-sign-out-request) application directs the user to the logout endpoint, Microsoft Entra ID removes and invalidates the user's session from the browser. | Same as workforce.|

- *issuer*, *subject* are the key pieces of information needed to set up the trust relationship. When the Azure workload requests Microsoft identity platform to exchange the managed identity token for an Entra app access token, the *issuer* and *subject* values of the federated identity credential are checked against the `issuer` and `subject` claims provided in the Managed Identity token. If that validation check passes, Microsoft identity platform issues an access token to the external software workload.

- Optimize performance between the connector and the application. Physically locate the connector server close to the application servers. For more information, see [Optimize traffic flow with Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).

A Microsoft Entra documentation page was updated: Global Secure Access Log Reader.

Use Application discovery to detect the applications accessed by users and create separate private applications.

For information about connectors, capacity planning, and how they stay up-to-date, see [Understand Microsoft Entra private network connectors](concept-connectors.md).

A Microsoft Entra documentation page was updated: Global Secure Access Administrator.

Learn how to review and apply suggestions provided by the Security Copilot for Microsoft Entra optimization agent.

Learn about the Security Copilot for Microsoft Entra optimization agent metrics and events in audit logs.