:::image type="content" border="true" source="media/reference-domain-services-tls-enforcement/enable.png" alt-text="Screenshot that shows how to enable TLS 1.2 Only Mode for Domain Services.":::

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

manager: dougeby

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: Free.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

manager: dougeby

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

manager: dougeby

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

manager: dougeby

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

manager: dougeby

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P1.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

manager: dougeby

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

A Microsoft Entra documentation page was updated: minimumlicense: P2.

manager: dougeby

Updates to this consent policy will have at least 30 days of given notice.

**Type:** New feature

A Microsoft Entra documentation page was updated: Zero Trust Protect Identities.

A Microsoft Entra documentation page was updated: Whats New.

| Check | Minimum required license |

A Microsoft Entra documentation page was updated: Overview.

|Workday Writeback | ✅ |

There might be situations while configuring or managing an application where you don't want tokens to be issued for an application. Or, you might want to block an application that you don't want your employees to try to access, like the deprecated Azure AD PowerShell modules (AppID 1b730954-1685-4b74-9bfd-dac224a7b894). To block user access to an application, you can disable user sign-in for the application, which prevents all tokens from being issued for that application.

Include a test group of users for each policy, but not both. If a user is included in both policies, or any policy with both conditions, the user has to satisfy MFA during sign-in. They also have to satisfy the custom control, which makes them redirected to the external provider a second time.

To identify Intune device compliance and app protection policies, the agent must be running as a Global Administrator or Conditional Access Administrator AND Global Reader. Conditional Access Administrator isn't sufficient on its own for the agent to produce Intune suggestions.

With the Conditional Access optimization agent chat interface, you can use natural language to get more information on a policy suggestion or have the agent present the suggestions in a different order.

:::image type="content" source="media/conditional-access-agent-optimization-review-suggestions/review-suggestions-details.png" alt-text="Screenshot of the agent with the policy suggestion details open." lightbox="media/conditional-access-agent-optimization-review-suggestions/review-suggestions-details-expanded.png":::

A Microsoft Entra documentation page was updated: minimumlicense: P2, Governance.

A Microsoft Entra documentation page was updated: minimumlicense: P2, Governance.

A Microsoft Entra documentation page was updated: minimumlicense: P2, Governance.

ai-usage: ai-assisted

The Conditional Access optimization agent evaluates policies such as requiring multifactor authentication (MFA), enforcing device based controls (device compliance, app protection policies, and domain-joined devices), and blocking legacy authentication and device code flow. The agent also evaluates all existing enabled policies to propose potential consolidation of similar policies. When the agent identifies a suggestion, you can have the agent update the associated policy with one click-remediation.

Microsoft Purview will enforce Entra conditional access policies for eDiscovery admins by blocking non-compliant users from accessing SharePoint content and adding a new ‘FilePreviewed’ audit log activity. Rollout begins now and completes by November 2025, enhancing security and compliance monitoring.

Workflows by default, unless specified during creation, are managed by users with either the Lifecycle Workflows, or Global, administrator roles. As workflows grow and change to meet the needs of members of your organization, so does the need to limit who can manage them. With delegated workflow management, you can scope management of workflows using [Administrative Units](../identity/role-based-access-control/administrative-units.md). When scoped, specific admins are only granted access to manage specific workflows. Scoping allows for greater security within your environment by following Microsoft's least privileged access guidelines by only giving access to specifically what's needed.

This article discusses how to use Custom Attribute Triggers as an attribute change trigger within a workflow in Lifecycle Workflows.

7. Update the desired properties.

Microsoft Entra Privileged Identity Management (PIM) Iteration 2 (beta) APIs will be retired on October 28, 2026. Applications using these APIs will fail after this date. Organizations should migrate to the more reliable Iteration 3 (GA) APIs and stop new development on Iteration 2 APIs.

{

> Branding themes for applications are currently in PREVIEW.

A Microsoft Entra documentation page was updated: Managed Identity Libraries.

author: kenwith