> [!div class="nextstepaction"]

> [!div class="nextstepaction"]

Learn how to add a redirect URI to your application in Microsoft Entra to securely handle authentication tokens and enhance app security.

How to update your existing Node.js application to use the Microsoft Authentication Library (MSAL) for authentication and authorization instead of the Active Directory Authentication Library (ADAL).

Learn how Microsoft Entra tenants publish metadata for authentication and authorization endpoints, scopes, and claims.

Learn about acquiring and caching tokens using MSAL.

Learn to configure certificates, client secrets, and federated credentials in Microsoft Entra for secure app authentication.

Learn about the authentication flows supported by MSAL, such as authorization code, client credentials, and device code, to secure your apps effectively.

Understand the fundamentals of authentication, authorization, and how the Microsoft identity platform simplifies these processes for developers.

Learn about configuration options for public client and confidential client applications using the Microsoft Authentication Library (MSAL).

Learn how to install identity packages and sign-in components to an ASP.NET Core application and enable user authentication.

Learn how to use the Authentication events trigger for Azure Functions library to create a trigger function that uses the token issuance start event.

Use Microsoft Entra custom authentication extensions to customize your user's sign-in experience by using REST APIs or outbound webhooks.

Conceptual article describing the custom claims provider as part of the custom authentication extension framework.

Learn the benefits of integrating your application with the Microsoft identity platform, and get resources for features like simplified sign-in, identity management, multifactor authentication, and access control.

Learn the fundamental concepts of identity and access management (IAM). Learn about identities, resources, authentication, authorization, permissions, identity providers, and more.

Learn about application scenarios for the Microsoft identity platform, including authenticating identities, acquiring tokens, and calling protected APIs.

List of client libraries and middleware compatible with the Microsoft identity platform. Use these libraries to add support for user sign-in (authentication) and protected web API access (authorization) to your applications.

Learn key terms used in Microsoft identity platform documentation, Microsoft Entra admin center, and authentication SDKs like the Microsoft Authentication Library (MSAL).

The Microsoft Authentication Library (MSAL) enables application developers to acquire tokens in order to call secured web APIs. These web APIs can be the Microsoft Graph, other Microsoft APIs, third-party web APIs, or your own web API. MSAL supports multiple application architectures and platforms.

In this quickstart, you learn how to implement authentication with a Node.js web app and the Microsoft Authentication Library (MSAL) for Node.js.

Code snippet for a custom authentication extension using the Azure Functions client library in C#.

Troubleshoot and monitor your custom claims provider API. Learn how to use logging and Microsoft Entra sign-in logs to find errors and issues in your custom claims provider API.

In this tutorial, you learn how to enable authentication for a web app running on Azure App Service. Limit access to the web app to users in your organization​.

Learn how to create and prepare an ASP.NET Core application for authentication with the Microsoft identity platform, and secure it with a self-signed certificate.

Learn what identity and access management (IAM) is, why it's important, and how it works. Learn about authentication and authorization, single sign-on (SSO), and multifactor authentication (MFA). Learn about SAML, Open ID Connect (OIDC), and OAuth 2.0 and other authentication and authorization standards, tokens, and more.

- [Bring Your Own Application (BYOA)](#bring-your-own-application)

Learn how to remove accounts from the token cache during global sign-out in web apps that call web APIs using the Microsoft identity platform.

Learn how to build a web app that signs in/out users

Learn about the sign-in flow of web, desktop, and mobile apps in Microsoft identity platform.

In this quickstart, you learn how a Node.js Electron desktop application can sign-in users and get an access token to call an API protected by a Microsoft identity platform endpoint

Learn how to run automated integration tests as a user against APIs protected by the Microsoft identity platform. Use the Resource Owner Password Credential Grant (ROPC) auth flow to sign in as a user instead of automating the interactive sign-in prompt UI.

Learn how to call the Microsoft Graph web API, sign-in, and display the profile information of the logged-in user

When a user signs in, a registration wizard helps them register the EAMs they're enabled to use. If they are enabled for other authentication methods, they might need to select **I want to set up a different method** > **External Auth methods** to proceed. They need to authenticate with their EAM provider to register the EAM in Microsoft Entra ID.

author: justinha

Welcome to what's new in the Microsoft identity platform documentation. This article lists new articles that were added or had significant updates in the last three months.

Include file that explains the common steps you need to take for all public client apps when it comes to migration from ADAL to MSAL.

Learn about ID tokens used in the Microsoft identity platform.

In this quickstart, you learn how to register an application with the Microsoft identity platform.

Learn how to set up a Microsoft Entra test environment so you can test your application integrated with Microsoft identity platform. Evaluate whether you need a separate tenant for testing or if you can use your production tenant.

In this tutorial, you add support for signing-in users in a web app.

Claims reference with details on the claims included in access tokens issued by the Microsoft identity platform.

Learn about access tokens used in the Microsoft identity platform.

Learn about the process of registering your application so it can integrate with the Microsoft identity platform.

The types of apps and scenarios supported by the Microsoft identity platform.

Learn how to build a web app that calls protected web APIs using the Microsoft identity platform. Explore options for ASP.NET Core, ASP.NET, Java, Node.js, and Python.

Explanation of claims challenges, claims requests, and client capabilities in the Microsoft identity platform.

Learn about the custom claims policy and claims mapping policy types, which are used to modify the claims emitted in tokens in the Microsoft identity platform.

Learn how to configure optional claims and attributes in access tokens issued by Microsoft identity platform; optional claims can add useful user information for your app.

Learn how to customize the claims issued by Microsoft identity platform in the JSON web token (JWT) token for enterprise applications.

As a developer, I want to learn how to acquire tokens for web APIs so that I can enable secure API calls in my application.

In this how-to guide, register a web API with the Microsoft identity platform and configure its scopes, exposing it to clients for permissions-based access to the API's resources.

Learn how to remove an application registered with the Microsoft identity platform.

In this how-to, you learn how to restore or permanently delete a recently deleted application registered with the Microsoft identity platform.

Learn the details of the claims included in ID tokens issued by the Microsoft identity platform.

An overview of the Microsoft identity platform accounts for Android

author: cilwerner

Claims reference with details on the optional claims that can be included in tokens in the Microsoft identity platform.

Learn how to build a protected web API and acquire all the information you need to register the app.

In this quickstart, you download and run a code sample that shows how a Node.js console application can get an access token and call an API protected by a Microsoft identity platform endpoint, using the app's own identity

Learn about refresh tokens that are used in the Microsoft identity platform.

Learn how to register a web app that calls web APIs. Configure client secrets and delegated permissions with the Microsoft identity platform.

Learn how to register a web app that signs in users using the Microsoft identity platform with step-by-step guidance for various frameworks.

In this tutorial, you build an Electron desktop app that can sign in users and use the auth code flow to obtain an access token from the Microsoft identity platform and call the Microsoft Graph API.

Learn about the validation differences of various properties for different supported account types when registering your app with the Microsoft identity platform.

In this quickstart, you learn how to configure app registration and API permissions for a Web API, and how to grant admin consent to these permissions.

Build a web API that calls other APIs using the Microsoft identity platform. Learn how to acquire tokens and make secure API calls.

The following table explains the status for **isCloudManaged** and **onPremisesSyncEnabled** attributes after you convert the SOA of an object.

a. In the **Identifier (Entity ID)** text box, type a unique identifier for your Sage Intacct company, with the following format:

Describes the deprecation of the app manifest (Azure AD Graph format) and attribute differences in the new format.

zone_pivot_groups: enterprise-apps-minus-portal-aad

author: cilwerner

This article demonstrates how to customize claims in Microsoft Entra ID using the Custom Claims Policy.

This article describes how to customize claims in Microsoft Entra ID using PowerShell

Shows how to convert an existing single-tenant app to a multitenant app that can sign in a user from any Microsoft Entra tenant.

Reference documentation for custom claims providers

Learn how to configure a custom claims provider for a token issuance start event in Microsoft Entra ID. You can add custom claims to a token before it's issued.

author: cilwerner

author: cilwerner

author: cilwerner

Learn how to register your app in Microsoft Entra ID and configure it for single-tenant or multitenant use.

Learn how to restrict access to your apps registered in Microsoft Entra ID to a selected set of users.

Learn about the features and differences between single-tenant and multitenant apps in Microsoft Entra ID.

In this tutorial, you learn how to clean up the Azure resources allocated while creating the web app.

In this tutorial, you learn how to access data in Microsoft Graph from a web app for a signed-in user.

In this tutorial, you build a console daemon app for calling Microsoft Graph.

> For this flag to take effect, it must be applied to a new registration. It will not impact devices that have already been registered unless they re-register.

author: Justinha

In March 2024, Microsoft announced that Microsoft Entra ID will transition from using Apple’s Keychain to Apple’s Secure Enclave for storing device identity keys. Beginning July 2025, new device registrations will require Secure Enclave for key storage.

Learn how to convert group management from Active Directory Domain Services (AD DS) to Microsoft Entra ID by using Group Source of Authority (SOA).

This article shows the new and updated documentation for the Microsoft Entra application management.

Learn how to add app roles to an application registered in Microsoft Entra ID. Assign users and groups to these roles, and receive them in the 'roles' claim in the token.

Learn about the relationship between application and service principal objects in Microsoft Entra ID.

Learn how to configure and set up a custom email provider with the One Time Passcode Send event type.

Learn how to build a web API that calls web APIs (app's code configuration)

Learn how to configure the code of a web app that calls web APIs

Learn how to build a web app that signs in users (code configuration)

Learn about multi-instancing, which is needed for configuring multiple instances of the same application within a tenant.

Describes directory extension attributes that are used for sending user data to applications in token claims.

Learn how to acquire a token for a web app that calls web APIs

What does it mean for an application to be added to Microsoft Entra ID and how do they get there?

Learn how to configure a web API to securely call downstream APIs by registering it as a confidential client application.

Describes the Microsoft Entra app manifest (Microsoft Graph format), which represents an application's identity configuration in a Microsoft Entra tenant.

Describes the Microsoft Entra app manifest, which represents an application's identity configuration in a Microsoft Entra tenant.

A Microsoft Entra documentation page was updated: Copilot Security Entra Responsible Ai Faq.

author: justinha

keywords:

keywords:

In this tutorial, you learn how to build a web app by using Azure App Service, sign in users to the web app, call Azure Storage, and call Microsoft Graph.

- [Privileged Identity Management (PIM)](#privileged-identity-management-pim): Manage and monitor privileged access in your organization using natural language queries.

**Type:** New feature

A Microsoft Entra documentation page was updated: Whats New.

author: cilwerner

manager: pmwongera

manager: pmwongera

manager: pmwongera

manager: pmwongera

author: cilwerner

A Microsoft Entra documentation page was updated: Conditional Access optimization agent phased rollout (preview).

author: shlipsey3

manager: pmwongera

Staged rollout (SRO) is intended as a temporary testing mechanism for organizations with federated domains and allows to test cloud authentication with a group of users before [transitioning the entire domain from federated to managed](./migrate-from-federation-to-cloud-authentication.md#convert-domains-from-federated-to-managed). These features include Microsoft Entra multifactor authentication, Conditional Access, Identity Protection for leaked credentials, Identity Governance, and more. This approach allows you to validate functionality and user experience before fully transitioning your domains from federated to managed.

Developer guidance and scenarios for Microsoft Entra Conditional Access authentication context

7. On the **Set up Single Sign-On with SAML** page, In the **SAML Signing Certificate** section, select copy button to copy **App Federation Metadata Url**, open it in a new browser tab, download the content of the page as an XML file and save it on your computer.

Learn how to configure token lifetimes for access, SAML, and ID tokens in Microsoft Identity Platform to enhance security.

Learn how to customize the claims issued by Microsoft identity platform in the SAML token for enterprise applications.

Learn how to configure the role claim issued in the SAML token for enterprise applications in Microsoft Entra ID.

Claims reference with details on the claims included in SAML 2.0 tokens issued by the Microsoft identity platform, including their JWT equivalents.

Learn about securing the business logic of your applications and APIs by validating claims in tokens.

| April | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|

:::image type="content" source="media/tutorial-group-provision/verify.png" alt-text="Screenshot of the newly provisioned group." lightbox="media/tutorial-group-provision/verify.png":::

manager: mwongerapk

Learn how to build a protected web API and configure your application's code.

Verify that the API is only called by applications on behalf of users who have the right scopes and by daemon apps that have the right application roles.

| - | - | - |

Learn about application branding guidelines for Microsoft identity platform.

author: billmath

A Microsoft Entra documentation page was updated: ZTLS.

A Microsoft Entra documentation page was updated: ZTLS.

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

Learn how notifications support your investigation activities.

author: shlipsey3

Create a plan to deploy Microsoft Entra ID Protection.

author: shlipsey3

- Risk summary: summarize in natural language why the user risk level was elevated.

:::image type="content" source="./media/copilot-entra-risky-user-summarization/risky-user-details.png" alt-text="Screenshot that shows the ID Protection risky user summarization details.":::

author: shlipsey3

keywords:

Workload identity risk in Microsoft Entra ID Protection

Learn how to use Microsoft Entra ID Protection for B2B users to secure your organization. Discover benefits and steps to unblock accounts.

author: shlipsey3

Identifying risk-based Conditional Access policies

Take a proactive look at the impact of risk-based Conditional Access policies in your environment.

author: shlipsey3

|| Entitlement management | ✅ |

keywords:

> [!NOTE]

- Microsoft Azure global cloud and Microsoft Azure Government

When you enable tenant restrictions on a Windows device, corporate proxies aren't required for policy enforcement. Devices don't need to be Microsoft Entra ID managed to enforce tenant restrictions v2. Domain-joined devices that are managed with Group Policy are also supported.

* A user flow. For more information, see [create self-service sign-up user flows for apps in external tenants](../external-id/customers/how-to-user-flow-sign-up-sign-in-customers.md). Under **Identity providers**, select your preferred method of authentication, that's, **Email with password** or **Email one-time passcode**. For this code sample, you can include the following user attributes in your user flow as the app submit these attributes:

If you've a client secret already in place for your application, you need to delete it to avoid a malicious application for impersonating your application:

For more information, see the [Configure Microsoft cloud settings for B2B collaboration](cross-cloud-settings.md) article.

Create a new Microsoft Entra app and service principal to manage access to resources with role-based access control in Azure Resource Manager.

In this tutorial, you learn how to access data in Microsoft Graph from a web app running in Azure App Service using managed identities.

Learn how to access Azure Storage from a web app in Azure App Service using managed identities. Simplify security and avoid managing secrets.

manager: pmwongera

This article introduces you to Security Copilot in Microsoft Entra.

manager: pmwongera

Frequently asked questions about related to Responsible AI as it relates to Copilot in Microsoft Entra.

manager: dougeby