Use Microsoft Entra application proxy to access your on-premises application through Microsoft Teams.

Use Microsoft Entra application proxy to provide secure access to an Application Programming Interface (API) hosted in a private cloud or on premises.

Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. This tutorial shows you how to prepare your environment for use with application proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Microsoft Entra tenant.

Learn how to combine the application proxy service with a Traffic Manager solution.

Microsoft Entra ID uses access and session cookies to access on-premises applications through application proxy. This article explains how to use and configure the cookie settings.

How to publish on-premises ASP.NET applications that accept Active Directory Federation Services claims for secure remote access by your users.

Understand complex applications in Microsoft Entra application proxy.

Configure and manage custom domains in Microsoft Entra application proxy.

Learn how to set a custom home page for published apps using Microsoft Entra application proxy to ensure users land on the correct page.

Learn about debugging issues that occur when configuring Microsoft Entra application proxy.

Covers the basics about how to integrate an on-premises Power BI with Microsoft Entra application proxy.

Covers the basics about how to integrate on-premises SharePoint Server with Microsoft Entra application proxy.

How traffic distribution works with your application proxy deployment. Includes tips for how to optimize connector performance and use load balancing for back-end servers.

Covers how to provide single sign-on using Microsoft Entra application proxy.

PowerShell example that lists all Microsoft Entra private network connector groups with the assigned applications.

Integrate Microsoft Entra application proxy with Qlik Sense.

Learn how to use Microsoft Entra application proxy to provide remote access for your Tableau deployment.

PowerShell example that assigns a group to a Microsoft Entra application proxy application.

PowerShell example that assigns a user to a Microsoft Entra application proxy application.

PowerShell example that lists all Microsoft Entra application proxy applications in your directory that have a lifetime token policy.

PowerShell example that lists Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), and object ID (ObjId).

PowerShell example that lists all Microsoft Entra application proxy applications that are using wildcards.

PowerShell example that lists all the users and groups assigned to a specific Microsoft Entra application proxy application.

PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains and certificate information.

PowerShell example that lists all Microsoft Entra application proxy applications that are using default domains (.msappproxy.net).

PowerShell example that lists all Microsoft Entra application proxy applications that are published with the identical certificate.

PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains but don't have a valid TLS/SSL certificate uploaded.

Microsoft Entra application proxy PowerShell example used to move all applications currently assigned to a connector group to a different connector group.

PowerShell example that bulk replaces a certificate across Microsoft Entra application proxy applications.

Use these PowerShell samples for Microsoft Entra application proxy to get information about application proxy apps and connectors in your directory, assign users and groups to apps, and get certificate information.

Covers how to enable native client apps to communicate with the Microsoft Entra private network connector to provide secure remote access to your on-premises apps.

Covers how to configure application proxy with Remote Desktop Services (RDS)

Remove personal data from connectors installed on devices for Microsoft Entra application proxy.

Learn how to identify and resolve cross-origin resource sharing (CORS) issues in Microsoft Entra application proxy.

Learn how to redirect hard coded links for applications published with Microsoft Entra application proxy.

Understand single sign-on with an on-premises app using application proxy.

Optimize performance for global connectivity scenarios using Azure Front Door for geo-acceleration with Microsoft Entra application proxy.

Learn how to use Wildcard applications in Microsoft Entra application proxy.

Covers how to work with existing on-premises proxy servers with Microsoft Entra ID.

Before deactivating the application, remove all owners from the application. This ensures only users with tenant-wide `microsoft.directory/applications/enable` scope can reactivate the application. This scope is restricted to administrative roles.

A Microsoft Entra documentation page was updated: Deactivate Application Portal.

author: shlipsey3

Use Microsoft Entra application proxy to access your on-premises application through Microsoft Teams.

Use Microsoft Entra application proxy to provide secure access to an Application Programming Interface (API) hosted in a private cloud or on premises.

Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. This tutorial shows you how to prepare your environment for use with application proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Microsoft Entra tenant.

Microsoft Entra ID uses access and session cookies to access on-premises applications through application proxy. This article explains how to use and configure the cookie settings.

How to publish on-premises ASP.NET applications that accept Active Directory Federation Services claims for secure remote access by your users.

Understand complex applications in Microsoft Entra application proxy.

Understand single sign-on with an on-premises app using application proxy.

Configure and manage custom domains in Microsoft Entra application proxy.

Learn how to set a custom home page for published apps using Microsoft Entra application proxy to ensure users land on the correct page.

Learn about debugging issues that occur when configuring Microsoft Entra application proxy.

Covers the basics about how to integrate an on-premises Power BI with Microsoft Entra application proxy.

Covers the basics about how to integrate on-premises SharePoint Server with Microsoft Entra application proxy.

How traffic distribution works with your application proxy deployment. Includes tips for how to optimize connector performance and use load balancing for back-end servers.

Include file

Covers how to provide single sign-on using Microsoft Entra application proxy.

PowerShell example that lists all Microsoft Entra private network connector groups with the assigned applications.

Integrate Microsoft Entra application proxy with Qlik Sense.

Learn how to use Microsoft Entra application proxy to provide remote access for your Tableau deployment.

PowerShell example that assigns a group to a Microsoft Entra application proxy application.

PowerShell example that assigns a user to a Microsoft Entra application proxy application.

PowerShell example that lists all Microsoft Entra application proxy applications in your directory that have a lifetime token policy.

PowerShell example that lists Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), and object ID (ObjId).

PowerShell example that lists all Microsoft Entra application proxy applications that are using wildcards.

PowerShell example that lists all the users and groups assigned to a specific Microsoft Entra application proxy application.

PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains and certificate information.

PowerShell example that lists all Microsoft Entra application proxy applications that are using default domains (.msappproxy.net).

PowerShell example that lists all Microsoft Entra application proxy applications that are published with the identical certificate.

PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains but don't have a valid TLS/SSL certificate uploaded.

Microsoft Entra application proxy PowerShell example used to move all applications currently assigned to a connector group to a different connector group.

PowerShell example that bulk replaces a certificate across Microsoft Entra application proxy applications.

Use these PowerShell samples for Microsoft Entra application proxy to get information about application proxy apps and connectors in your directory, assign users and groups to apps, and get certificate information.

Covers how to enable native client apps to communicate with the Microsoft Entra private network connector to provide secure remote access to your on-premises apps.

Covers how to configure application proxy with Remote Desktop Services (RDS)

Remove personal data from connectors installed on devices for Microsoft Entra application proxy.

Learn how to identify and resolve cross-origin resource sharing (CORS) issues in Microsoft Entra application proxy.

Learn how to redirect hard coded links for applications published with Microsoft Entra application proxy.

Learn how to use Wildcard applications in Microsoft Entra application proxy.

Covers how to work with existing on-premises proxy servers with Microsoft Entra ID.

Describes how to create and export a connector from MIM Sync to be used with the Microsoft Entra ECMA Connector Host.

Learn how to provision custom security attributes from HR sources.

This article lists all releases of Microsoft Entra Connect Provisioning Agent and describes new features and fixed issues.

Learn how to implement API-driven inbound provisioning with Azure Logic Apps.

Learn how to implement API-driven inbound provisioning with a PowerShell script.

Learn how to configure API-driven inbound provisioning app.

Enable Termination Lookahead query for your Workday-to-AD/Microsoft Entra ID provisioning job.

A guide for independent software vendors for enabling automated provisioning in Microsoft Entra ID

Learn how to export your Application Provisioning configuration and roll back to a known good state for disaster recovery in Microsoft Entra ID.

Learn how to extend API-driven inbound provisioning to sync custom attributes.

How to find out when a critically important user is able to access an application you have configured for user provisioning with Microsoft Entra ID.

Learn more about the capabilities and integration scenarios supported by API-driven inbound provisioning.

Learn how to grant access to the inbound provisioning API.

Learn how to get index the employeeId attribute to automate user account creation and updates from Inbound Provisioning to Active Directory

Learn about known issues when you work with automated application provisioning or cross-tenant synchronization in Microsoft Entra ID.

Learn how to integrate Microsoft Entra Provisioning logs with Azure Monitor logs and use the associated workbooks.

Technical deep dive into SAP SuccessFactors-HR driven provisioning for Microsoft Entra ID.

Technical deep dive into Workday-HR driven provisioning in Microsoft Entra ID

This document describes how to configure Microsoft Entra ID to provision users into SAP ERP Central Component (SAP ECC, formerly SAP R/3) with NetWeaver AS ABAP 7.0 or later.

This document describes how to configure Microsoft Entra ID to provision users with external systems that offer REST and SOAP APIs.

This document describes how to configure Microsoft Entra ID to provision users with external systems that offer Windows PowerShell based APIs.

This document describes how to configure Microsoft Entra ID to provision users with external systems that offer web services based APIs.

This document describes how to configure Microsoft Entra ID to provision users into an LDAP directory.

Use partner driven integrations to provision accounts into all your applications.

Guidance for planning and executing automatic user provisioning in Microsoft Entra ID

This document describes how to configure Microsoft Entra ID to provision users into Active Directory Lightweight Directory Services as an example of an LDAP directory.

Learn how to provision users on demand in Microsoft Entra ID.

Learn how to simplify user provisioning with Expression Builder, handle duplicate users, and transform user attributes for seamless integration.

Provisioning users into SQL based applications using the ECMA Connector host

This article describes the Azure Monitor workbook for provisioning.

When you've configured an application for automatic user provisioning, learn what a provisioning status of Quarantine means and how to clear it.

Learn how to get started quickly with API-driven inbound provisioning using Graph Explorer

This tutorial provides step-by-step instructions so you can get started with API-driven inbound provisioning using cURL.

Learn how to use expression mappings to transform attribute values into an acceptable format during automated provisioning of SaaS app objects in Microsoft Entra ID. Includes a reference list of functions.

Learn how to retrieve pronoun information from Workday

Learn which attributes from SuccessFactors are supported by SuccessFactors-HR driven provisioning in Microsoft Entra ID.

Learn how to use scoping filters to define attribute-based rules that determine which users or groups are provisioned in Microsoft Entra ID.

Learn how to override the default behavior of deprovisioning out of scope users in Microsoft Entra ID.

A comprehensive guide to commonly used expression mapping functions when configuring SuccessFactors to Microsoft Entra ID user provisioning. These functions help transform and map data from SuccessFactors to create appropriate user attributes in Microsoft Entra ID.

When configuring user provisioning with Microsoft Entra ID and SaaS apps, use the directory extension feature to add source attributes that aren't synchronized by default.

Learn about attribute mappings for Software as a Service (SaaS) apps in Microsoft Entra Application Provisioning. Learn what attributes are and how you can modify them to address your business needs.

This tutorial describes how to provision users from Microsoft Entra ID into a SQL database.

Understand how Application Provisioning works in Microsoft Entra ID.

Understand how expression builder works with Application Provisioning in Microsoft Entra ID.

Learn how to manage user account provisioning for enterprise apps using the Microsoft Entra ID.

New and updated documentation for the Azure Active Directory application provisioning.

Learn which attributes that you can fetch from Workday using XPATH queries in Microsoft Entra ID.

A comprehensive guide to commonly used expression mapping functions when configuring Workday to on-premises Active Directory/Microsoft Entra ID user provisioning. These functions help transform and map data from Workday to create appropriate user attributes in Microsoft Entra ID.

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Adobe Identity Management (OIDC).

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Cofense Recipient Sync.

Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to myday.

This article describes the steps you need to perform in both Akamai Enterprise Application Access and Microsoft Entra ID to configure automatic user provisioning. When configured, Microsoft Entra ID automatically provisions and de-provisions users and groups to [Akamai Enterprise Application Access](https://www.akamai.com) using the Microsoft Entra provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Microsoft Entra ID](~/identity/app-provisioning/user-provisioning.md).

This article describes how to use the Microsoft Entra provisioning service to provision users into Azure Databricks with Private Link Workspace.

Integrating Oracle Fusion Cloud Human Capital Management (HCM) with Microsoft Entra ID and on-premises Active Directory using the Inbound Provisioning API.

Learn how to configure inbound provisioning from SuccessFactors

Learn how to configure inbound provisioning from SuccessFactors to Microsoft Entra ID

Learn how to configure Microsoft Entra ID to automatically provision and de-provision user accounts to Workday.

Include file

author: barclayn

Learn how to configure inbound provisioning from Workday to Microsoft Entra ID

Use tenant restrictions to control the types of external accounts that users can use on your networks and the devices that you manage.

PowerShell example that lists all Microsoft Entra private network connector groups and connectors in your directory.

author: shlipsey3

author: shlipsey3

include file Microsoft Entra ID preview program information

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

* Manage your accounts in one central location.

* Manage your accounts in one central location.

include file Microsoft Entra workbook instructions

include file

include file

include file

include file

include file

Include file

Include file

Include file

author: barclayn

author: barclayn

author: barclayn

author: barclayn

author: barclayn

keywords: Azure Active Directory licensing service plans

PowerShell example that lists all Microsoft Entra private network connector groups and connectors in your directory.

How to close your work or school account in an unmanaged Microsoft Entra ID.

* Manage your accounts in one central location.

* Manage your accounts in one central location.

|[2.5.3.0](#2530)|31 July 2026 (12 months after release of 2.5.76.0)|

A Microsoft Entra documentation page was updated: Tokens Overview.

An overview of API-driven inbound provisioning.

A Microsoft Entra documentation page was updated: Federation Overview.

An end-to-end guide for planning the deployment of application proxy within your organization

A Microsoft Entra documentation page was updated: Sso Overview.

A Microsoft Entra documentation page was updated: Sspr.

Learn how to use Microsoft Entra application proxy connectors.

An introduction to how you can use Microsoft Entra ID to automatically provision, deprovision, and continuously update user accounts across multiple third-party applications.

Describes overview of HR driven provisioning.

Restricted management administrative units enable you to easily restrict access to users, groups, or devices to the specific users or applications you specify. Tenant-level administrators (including Global Administrators) can't modify members of restricted management administrative units unless they're explicitly assigned a role scoped to the administrative unit. This makes it easy to lock down a set of sensitive groups or user accounts in your tenant without having to remove tenant-level role assignments. For more information, see: [Restricted management administrative units in Microsoft Entra ID](../identity/role-based-access-control/admin-units-restricted-management.md).

Learn how to add new custom security attribute definitions or deactivate custom security attribute definitions in Microsoft Entra ID.

Learn how to manage access to custom security attributes in Microsoft Entra ID.

Learn how to troubleshoot custom security attributes in Microsoft Entra ID.

Learn about custom security attributes in Microsoft Entra ID.

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: custorod

Learn about Microsoft Entra groups, including how they work, what they can access, and how membership and access is assigned.

author: justinha

author: jenniferf-skc

Learn how to use Microsoft Entra application proxy connectors.

Describes overview of identity provisioning and the ILM scenarios.

| Group Policy Object (GPO) assigns unprivileged identities to local groups with elevated privileges | Users | Preview | Yes | N/A |

For guidance, see:

Troubleshoot problems with broken links in application proxy apps that are integrated with Microsoft Entra ID.

Describes how to troubleshoot various issues you might encounter when you install and use the ECMA Connector Host.

Learn how to check the status of automatic user account provisioning jobs, and how to troubleshoot the provisioning of individual users.

Learn how to resolve common access issues with Microsoft Entra application proxy applications.

Learn how to troubleshoot errors in Microsoft Entra application proxy.

Learn how to troubleshoot attribute retrieval issues with HR provisioning

Learn how to troubleshoot InsufficientAccessRights error when provisioning to on-premises Active Directory.

This article provides potential issues and resolutions that guide you in how to troubleshoot issues with the inbound provisioning API.

Learn how to troubleshoot a Kerberos constrained delegation (KCD) configuration in Microsoft Entra application proxy.

This article provides potential issues and resolutions that show you how to troubleshoot manager update issues with HR provisioning

How to troubleshoot common issues faced when configuring user provisioning to an application already listed in the Microsoft Entra application gallery.

Learn how to troubleshoot user creation issues with HR provisioning

Learn how to troubleshoot user update issues with HR provisioning

This article provides potential issues and resolutions so you can troubleshoot writeback issues with HR provisioning.

Troubleshoot common issues faced when a user isn't appearing in a Microsoft Entra Gallery Application configured for user provisioning with Microsoft Entra ID.

author: shlipsey3

author: shlipsey3

author: shlipsey3

Troubleshoot problems with broken links in application proxy apps that are integrated with Microsoft Entra ID.

Learn how to troubleshoot sign-up errors using Microsoft Entra reports in the Microsoft Entra admin center

include file

Learn how to resolve common access issues with Microsoft Entra application proxy applications.

Learn how to troubleshoot errors in Microsoft Entra application proxy.

Learn how to troubleshoot a Kerberos constrained delegation (KCD) configuration in Microsoft Entra application proxy.

To use password hash synchronization in your environment, you need to:

Support header-based authentication with PingAccess and Microsoft Entra application proxy.

Learn how to provide single sign-on for on-premises applications that are secured with header-based authentication.

This document describes how to configure Microsoft Entra ID to provision users into an LDAP directory so that the users can then sign into a Linux or other POSIX system using pluggable authentication.

PowerShell example that lists all Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), external URL (ExternalUrl), internal URL (InternalUrl), and authentication type (ExternalAuthenticationType).

Turn on single sign-on for your published on-premises applications with Microsoft Entra application proxy in the Microsoft Entra admin center.

author: shlipsey3

author: shlipsey3

author: shlipsey3

Support header-based authentication with PingAccess and Microsoft Entra application proxy.

Learn how to provide single sign-on for on-premises applications that are secured with header-based authentication.

author: mepples21

PowerShell example that lists all Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), external URL (ExternalUrl), internal URL (InternalUrl), and authentication type (ExternalAuthenticationType).

include file

Turn on single sign-on for your published on-premises applications with Microsoft Entra application proxy in the Microsoft Entra admin center.

Covers security considerations for using Microsoft Entra application proxy

Learn how to use Microsoft Entra application proxy to protect your Network Device Enrollment Service (NDES).

How to add Web Application Firewall (WAF) protection for apps published with Microsoft Entra application proxy.

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

Assign, update, list, or remove custom security attributes for a user in Microsoft Entra ID.

Covers security considerations for using Microsoft Entra application proxy

author: shlipsey3

include file

author: jenniferf-skc

Learn how to use Microsoft Entra application proxy to protect your Network Device Enrollment Service (NDES).

Learn how to provide single sign-on (SSO) for on-premises applications that are secured with Security Assertion Markup Language (SAML) authentication. Provide remote access to on-premises apps with application proxy.

Learn how to integrate an on premises SharePoint farm with Microsoft Entra application proxy using Security Assertion Markup Language (SAML).

Learn to develop a SCIM endpoint, integrate your SCIM API with Microsoft Entra ID, and automatically provision users and groups into your cloud applications.

How to solve common protocol compatibility issues faced when adding a non-gallery application that supports SCIM 2.0 to Microsoft Entra ID

This article describes how to use the Microsoft Entra provisioning service to provision users into an on-premises app that's SCIM enabled.

System for Cross-domain Identity Management (SCIM) standardizes automatic user provisioning. In this tutorial, you learn to develop a SCIM endpoint, integrate your SCIM API with Microsoft Entra ID, and start automating provisioning users and groups into your cloud applications.

This tutorial describes how to use the Microsoft Entra SCIM Validator to validate that your provisioning server is compatible with the Azure SCIM client.

Using SCIM and the Microsoft Graph together to provision users and enrich your application with the data it needs in Microsoft Entra ID.

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Adobe Identity Management (SAML).

Learn how to provide single sign-on (SSO) for on-premises applications that are secured with Security Assertion Markup Language (SAML) authentication. Provide remote access to on-premises apps with application proxy.

Learn how to integrate an on premises SharePoint farm with Microsoft Entra application proxy using Security Assertion Markup Language (SAML).

| `ID` | Required | Microsoft Entra ID uses this attribute to populate the `InResponseTo` attribute of the returned response. ID must not begin with a number, so a common strategy is to prepend a string like "ID" to the string representation of a GUID. For example, `id6c1c178c166d486687be4aaf5e482730` is a valid ID. |

This article describes the deployment process of integrating cloud HR systems, such as Workday and SuccessFactors, with Microsoft Entra ID. Integrating Microsoft Entra ID with your cloud HR system results in a complete identity lifecycle management system.

Microsoft Entra ID Governance allows you to balance your organization's need for security and employee productivity with the right processes and visibility. You can use entitlement management and other identity governance features to enforce the policies for access.

Describes how to check the users who fall into the execution scope of a Lifecycle Workflow.

Planning for a successful access reviews campaign for a particular application includes identifying if any users in that application have access that doesn't derive from Microsoft Entra ID.

This article a tutorial on how to provision users and groups from on-premises to cloud using MIM.

Planning for a successful access reviews campaign for a particular application includes identifying if any users in that application have access that doesn't derive from Microsoft Entra ID. If the application does not support provisioning, then you will need to create application role assignments for the application, and supply the list of changes when a review completes.

Learn how to set up group writeback in entitlement management.

Understand why to use application proxy to publish on-premises web applications externally to remote users. Learn about application proxy architecture, connectors, authentication methods, and security benefits.

Presents an overview of on-premises application provisioning architecture.

A Microsoft Entra documentation page was updated: Multi Tenant Common Considerations.

Understand why to use application proxy to publish on-premises web applications externally to remote users. Learn about application proxy architecture, connectors, authentication methods, and security benefits.

Learn about the architecture of Microsoft Entra ID, including service design, scalability, availability, and data consistency.

An end-to-end guide for planning the deployment of application proxy within your organization

Use Microsoft Defender for Cloud Apps with on-premises applications in Microsoft Entra ID. Use the Defender for Cloud Apps Conditional Access App Control to monitor and control sessions in real-time based on Conditional Access policies. You apply these policies to on-premises applications that use application proxy in Microsoft Entra ID.

Create a custom Conditional Access policy to block access to resources by IP location.

Create a custom Conditional Access policy require approved app or app protection policy

author: shlipsey3

author: shlipsey3

Use Microsoft Defender for Cloud Apps with on-premises applications in Microsoft Entra ID. Use the Defender for Cloud Apps Conditional Access App Control to monitor and control sessions in real-time based on Conditional Access policies. You apply these policies to on-premises applications that use application proxy in Microsoft Entra ID.

Complete guide to understanding, implementing, and securing tokens in Microsoft identity platform including access tokens, ID tokens, refresh tokens, claims, validation, and configuration.

Learn how to save time by using the Microsoft Graph APIs to automate the configuration of automatic provisioning.

Learn how to deactivate an app registration in Microsoft Entra ID to prevent token issuance while preserving application configuration.

- [Delete an enterprise application](delete-application-portal.md) for permanent removal

Before configuring Microsoft Entra ID to have automatic user provisioning into SAP Cloud Identity Services, you need to add SAP Cloud Identity Services from the Microsoft Entra application gallery to your tenant's list of enterprise applications. You can do this step in the Microsoft Entra admin center, or via the Graph API.

A Microsoft Entra documentation page was updated: Recommendation Migrate From Adal To Msal.

Covers network topology considerations when using Microsoft Entra application proxy.

Microsoft Entra application proxy lets cloud-native logic apps securely access on premises APIs to bridge your workload.

Learn how to configure the automatically generated Microsoft Entra recommendation email notification settings for your tenant.

Include file

Covers network topology considerations when using Microsoft Entra application proxy.

author: shlipsey3

author: SHERMANOUKO

Access Microsoft Entra admin center to effortlessly view and filter agent identities. Streamline tenant oversight and take charge now.

Learn how to structure agent metadata for optimal discoverability in Microsoft Entra Agent Registry and understand how the collections model affects agent visibility.

author: SHERMANOUKO

author: shlipsey3

Learn how to navigate, create, and manage agent collections in Microsoft Entra Agent Registry.

author: SHERMANOUKO

This article explains how to manage agent blueprints and registry-only agents using the Microsoft Entra Admin Center.

Learn how to call Azure services using .NET Azure SDK from an agent using agent identities.

Learn how to enable secure agent communication through the Microsoft Entra Agent Registry API.

Learn how autonomous agents acquire tokens using the Microsoft Entra SDK for Agent ID to call downstream APIs independently.

Learn how to register agents to the Agent Registry in Microsoft Entra Agent ID through automatic registration or manual API calls for agent discovery and management.

Learn how to call Microsoft Graph API from an agent using agent identities or agent users, including authentication configuration and implementation steps.

Learn about the Microsoft Agent Identity Platform, a comprehensive identity, and authorization framework designed specifically for AI agents. Key concepts include agent registry, authentication protocols, tokens, claims, and agent discovery capabilities.

Learn about the Agent ID, Agent Blueprint, and Agent Identity error codes.

Learn how agent identities operate autonomously without user context using app-only protocol with OAuth 2.0 client credentials flows.

Learn how agent applications operate on behalf of signed-in users using OAuth 2.0 On-Behalf-Of flows with agent identity blueprints and agent identities.

Learn how agent identities operate with user context through agent users using the agent user impersonation protocol with OAuth 2.0 token exchange.

Learn about agent identities, specialized identity constructs that enable secure authentication and authorization for AI agents in enterprise environments.

Learn about the Agent Registry, a centralized metadata repository that enables agent discovery, and secure communication in enterprise environments.

Learn about agent identities in Microsoft Entra ID, specialized identity constructs that enable secure authentication and authorization for AI agents in enterprise environments.

Learn how to configure Conditional Access policies to block risky agent identities. Follow best practices to enhance security in Microsoft Entra.

Learn how to call custom protected APIs from an agent using different approaches including IDownstreamApi, MicrosoftIdentityMessageHandler, and IAuthorizationHeaderProvider.

Learn about currently known issues and errors encountered when using the Microsoft Entra Agent ID preview.

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

author: shlipsey3

| Catalog owner | `ae79f266-94d4-4dab-b730-feca7e132178` | Edit and manage access packages and other resources in a catalog. Typically an IT administrator or resource owners, or an identity who the catalog owner chooses. |

Discovery and insights (formerly Security Wizard) help you convert permanent Microsoft Entra role assignments to just-in-time assignments with Privileged Identity Management.

Microsoft Entra ID Governance allows you to balance your organization's need for security and employee productivity with the right processes and visibility. You can define policies for how users should obtain access to your business critical applications integrated with Microsoft Entra ID Governance.

Microsoft Entra ID Governance allows you to balance your organization's need for security and employee productivity with the right processes and visibility. These features can be used for your existing business critical third party on-premises and cloud-based applications.

Microsoft Entra ID Governance allows you to model organizational roles using access packages, so you can migrate your existing role definitions to entitlement management.

Microsoft Entra ID Governance allows you to balance your organization's need for security and employee productivity with the right processes and visibility. You can integrate your existing business critical third party on-premises and cloud-based applications with Microsoft Entra ID for identity governance scenarios.

Learn the detailed steps for how to bring identities from SAP SuccessFactors and other sources into Microsoft Entra ID and provision those identities with access to SAP ECC, SAP S/4HANA, and other SAP and non-SAP applications, for organizations that were previously using SAP IDM.

The following documentation provides guidance for Privileged Identity Management (PIM) PowerShell migration.

Learn how to configure security alerts for Azure resource roles in Privileged

Configure security alerts for Microsoft Entra roles Privileged Identity Management.

Learn how to use custom security attribute to configure the scope of a workflow with lifecycle workflows.

Learn how to assign Microsoft Entra roles with access packages.

Learn how to create an access review of PIM for Groups in Microsoft Entra ID.

Frequently asked questions about Access Reviews.

Learn how to approve activation requests for group members and owners in Microsoft Entra Privileged Identity Management (PIM).

Learn how to use the My Access portal to approve or deny requests to an access package in Microsoft Entra entitlement management.

Learn how to approve or deny requests for Microsoft Entra roles in Privileged Identity Management (PIM).

Learn how to archive logs and create reports with Azure Monitor in entitlement management.

Learn how to assign eligibility for a group in Privileged Identity Management.

Learn how to assign Microsoft Entra roles in Privileged Identity Management (PIM).

View activity and audit activity history for group assignments in Privileged Identity Management (PIM).

Tutorial for moving users that change jobs using Lifecycle workflows with the Microsoft Entra admin center.

Tutorial for post off-boarding users from an organization using Lifecycle workflows with the Microsoft Entra admin center.

Tutorial for onboarding users to an organization using Lifecycle workflows with the Microsoft Entra admin center.

author: owinfreyATL

Learn how to write PowerShell scripts in Azure Automation to interact with Microsoft Entra entitlement management and other features.

services: entra-id-governance

Learn how to bring groups into Privileged Identity Management.

Learn how to change approval and requestor information settings for an access package in entitlement management.

Learn how to change requestor information & lifecycle settings for an access package in entitlement management.

Learn how to change request settings for an access package in entitlement management.

Learn how to change the resource roles for an existing access package in entitlement management.

This article guides a user on checking the status of a Lifecycle workflow

Learn how to check workflow insights within your Microsoft Entra tenant.

Learn the high-level steps you should follow for common scenarios in Microsoft Entra entitlement management.

Learn how to complete an access review of Azure resource and Microsoft Entra roles Privileged Identity Management.

Learn how to complete an access review of group members or application access in Microsoft Entra access reviews.

Learn how to configure automatic assignments based on rules for an access package in entitlement management.

Learn how to configure Azure resource role settings in Privileged Identity Management (PIM).

Learn how to configure Microsoft Entra role settings in Privileged Identity Management (PIM).

Learn how to configure PIM for Groups settings.

Learn how to configure separation of duties enforcement for requests for an access package in entitlement management.

Learn how to configure verified ID settings for an access package in entitlement management.

Learn how to convert guest user access package assignments for an access package in entitlement management.

You can use Microsoft Entra entitlement management to enforce the policies for who can get assigned access to an application.

Learn how to create an access package of resources that you want to share in Microsoft Entra entitlement management.

Learn how to set up an access review in a policy for entitlement management access packages in Microsoft Entra ID part of Microsoft Entra.

Learn how to create an access review of Azure resource and Microsoft Entra roles in Privileged Identity Management (PIM).

Learn how to create an access review of group members or application access in Microsoft Entra ID.

Learn how to create a new container of resources and access packages in entitlement management.

Using Microsoft Entra access reviews, you can download a review history for access reviews in your organization.

This tutorial describes how to create customized reports in Azure Data Explorer by using data from more sources in addition to Microsoft Entra

This tutorial describes how to create customized reports in Azure Data Explorer by using data from Microsoft Entra.

This article guides you in creating a lifecycle workflow.

Learn how to customize the schedule of a lifecycle workflow.

Get a step-by-step guide for customizing emails that you send by using tasks within lifecycle workflows.

Learn how to delegate access governance from IT administrators to access package managers and project managers so that they can manage access themselves.

Learn how to delegate access governance from IT administrators to catalog creators and project managers so that they can manage access themselves.

Learn how to delegate access governance from IT administrators to department managers and project managers so that they can manage access themselves.

Learn how to delete a lifecycle workflow.

author: owinfreyATL

Learn how to discover Azure resources to manage in Privileged Identity Management (PIM).

Describes email notifications in Microsoft Entra Privileged Identity Management (PIM).

This article serves as a reference for Microsoft Entra ID behavior when assignment periods of an access package and PIM policy don't align.

author: owinfreyATL

include file

Learn how to remove users from an organization in real time on their last day of work by using lifecycle workflows in the Microsoft Entra admin center.

Learn how to extend or renew PIM for groups assignments.

A how-to guide on dynamically determining the approval requirements for an access package externally using a custom extension.

Learn about the settings you can specify to govern access for external users in entitlement management.

This article a tutorial on how to provision users and groups using cloud sync.

This article a tutorial on how to provision users and groups using connect sync.

This article a tutorial on how to provision users and groups from and managed in Workday.

This article a tutorial on how to provision users and groups from and managed in Microsoft Entra ID to Active Directory.

This article a tutorial on how to provision users and groups to AD with Workday.

This article a tutorial on how to provision users and groups to Active Directory using MIM.

This article details service limits for offerings within Microsoft Entra ID Governance

Learn how to activate your group membership or ownership in Privileged

Learn how to hide or delete an access package in Microsoft Entra entitlement management.

This article shows how to create custom alerts with Microsoft Entra ID Governance

This article shows how to use the new identity governance dashboard

This article describes use cases Microsoft Entra ID Governance.

include file

Include file

author: owinfreyATL

Information about audit logs with Lifecycle Workflows

This article walks you through managing inactive users with Lifecycle Workflows.

This article guides a user on Workflow task definitions and task parameters.

An article discussing Lifecycle workflow versioning and history

Frequently asked questions about Lifecycle workflows.

Learn how to bring identities from SAP SuccessFactors into Microsoft Entra ID and provision access to SAP ERP Central Component (ECC), SAP S/4HANA, and other SAP applications.

Learn how to manage user and guest access as membership of a group or assignment to an application with Microsoft Entra access reviews.

Learn how to allow people outside your organization to request access packages so that you can collaborate on projects.

Manage guest users as members of a group or assigned to an application with Microsoft Entra access reviews.

Learn how to manage users' access as membership of a group or assignment to an application with Microsoft Entra access reviews

A how to article on how to edit a user account related task to run for users synchronized from Active Directory Domain Services (AD DS) with Lifecycle workflows.

This article guides a user to editing a workflow's properties using Lifecycle Workflows.

This article guides a user on managing workflow versions with Lifecycle Workflows.

Learn how Microsoft Entra ID is licensed for guest users.

This article guides a user to running a workflow on demand using Lifecycle Workflows.

Learn how to simplify approving access to applications and resources for onboarding external users to your organization.

Information for understanding the APIs in Microsoft Entra Privileged

Learn how to view the audit log history for Microsoft Entra roles in

Learn how to review access of Azure resource and Microsoft Entra roles

Learn how to approve or deny requests for Azure resource roles in Privileged

Learn how to assign Azure resource roles in Privileged Identity Management (PIM).

Describes the roles you can't manage in Microsoft Entra Privileged Identity

Learn how to deploy Privileged Identity Management (PIM) in your Microsoft Entra organization.

Planning for a successful access reviews campaign for a particular application starts with understanding how to model access for that application in Microsoft Entra ID.

This document describes how to configure Microsoft Entra ID to provision users into an on-premises LDAP directory.

This document describes how to provision users into SAP ERP Central Component (SAP ECC, formerly SAP R/3) with NetWeaver AS ABAP 7.0 or later.

This document describes how you can govern on-premises uses by provisioning them into SQL based applications using the ECMA Connector host

Learn how to extend or renew Azure resource role assignments in Privileged Identity Management (PIM).

Learn how to extend or renew Microsoft Entra role assignments in Microsoft Entra Privileged Identity Management (PIM)

Learn how to reprocess assignments for an access package in entitlement management.

Learn how to reprocess a request for an access package in entitlement management.

This article guides a user on reprocessing workflow runs using Lifecycle Workflows

Learn how to use the My Access portal to request access to an access package in Microsoft Entra entitlement management.

Learn about the request process for an access package and when email notifications are sent in entitlement management.

Learn how to complete an access review of entitlement management access packages in access reviews.

Learn how to review access of group members or application access in Microsoft Entra access reviews.

Learn how to review access of group members with review recommendations in Microsoft Entra access reviews.

Learn how to review your own access to groups or applications in access reviews.

Learn how to review your own access to resources in access reviews.

documentationcenter: ''

Learn how to review user access of entitlement management access packages in access reviews.

Learn about partners who can help with deployment and integration of identity management (IAM) and identity governance scenarios.

Learn how to share link to request an access package in entitlement management.

Learn how to show suggested access packages to users in My Access so they can quickly find the most relevant access packages.

Learn how to enable and get started using Privileged Identity Management (PIM) in the Microsoft Entra admin center.

Trigger Logic Apps based on custom task extensions

Learn how to configure and use custom logic app workflows in entitlement management.

Step-by-step tutorial for how to create your first access package using the Microsoft Entra admin center in entitlement management.

Tutorial for preparing user accounts for Lifecycle workflows.

Learn how to use Azure custom roles in Microsoft Entra Privileged Identity Management (PIM).

Learn how you can use entitlement management and Global Secure Access to restrict employee access to cloud apps.

Use Access Reviews to extend of remove access from members of partner organizations.

Learn how to use multi-stage reviews to design more efficient reviews with Microsoft Entra.

Learn how to view requests and remove for an access package in entitlement management.

View activity and audit history for Azure resource roles in Privileged Identity Management (PIM).

Learn how to view the identity assignments report and audit logs in entitlement management.

Learn how to view, add, and remove assignments for an access package in entitlement management.

Scenario: In this scenario you learn how to use custom extensibility, and a Logic App, to automatically generate ServiceNow tickets for manual provisioning of users who have received assignments and need access to apps.

Microsoft Entra ID Governance enables you to balance your organization's need for security and end user productivity with the right processes and visibility.

Using access reviews, you can control group membership and application access to meet governance, risk management, and compliance initiatives in your organization.

Describes overview of identity lifecycle management and what is meant by governing the employee lifecycle.

Describes overview of Lifecycle workflow attributes.

Conceptual article about Lifecycle workflows execution conditions.

Conceptual article discussing workflow extensibility with Lifecycle Workflows

Conceptual article about Lifecycle Workflows reporting and history capabilities

Conceptual article about Lifecycle Workflows reporting and history capabilities.

Conceptual article discussing managing Users synchronized from Active Directory Domain Services (AD DS) to Microsoft Entra with Lifecycle Workflows.

Conceptual article discussing workflow templates and categories with Lifecycle Workflows.

This page provides an overview of the Microsoft Entra ID Governance integrations available to automate provisioning and governance controls.

This article describes shows the licensing requirements for Microsoft Entra ID Governance features.

Describes how to use a resource dashboard to perform an access review

Describes overview of getting started with new business partner and external user scenarios.

How to manage Microsoft Entra Privileged Identity Management (PIM) for Groups.

A conceptual article describing access package visibility in the My Access portal.

Describes an overview of Lifecycle workflows and the various parts.

Get an overview of the lifecycle workflow feature of Microsoft Entra ID.

Get an overview of entitlement management and how you can use it to manage access to groups, applications, and SharePoint Online sites for internal and external identities.

Provides an overview of Microsoft Entra Privileged Identity Management (PIM).

Planning guide for a successful Lifecycle Workflow deployment.

Planning guide for a successful access reviews deployment.

Learn about some items you should check to help you troubleshoot Microsoft Entra entitlement management.

Learn how to troubleshoot system errors with roles in Microsoft Entra Privileged Identity Management (PIM).

Learn how to use access reviews to manage users that have been excluded from Conditional Access policies

author: MicrosoftGuyJFlo

Learn how to migrate users from another identity provider to Microsoft Entra External ID.

author: kengaderdus

Learn how to add and manage admin accounts in your external tenant with Microsoft Entra External ID.

Learn how to add and manage customer accounts in Microsoft Entra External ID.

author: kengaderdus

author: kengaderdus

author: kengaderdus

B2B collaboration allows information workers and app owners to add guest users to Microsoft Entra ID for access.

author: kengaderdus

Learn how to add custom attributes to self-service sign-up flows in Microsoft Entra External ID. Extend the set of attributes stored on a guest account and customize the user experience.

Federate with Facebook to enable external users (guests) to sign in to your Microsoft Entra apps with their own Facebook accounts.

Learn how to add Google as an identity provider for your external tenant.

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: henrymbuguakiarie

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: henrymbuguakiarie

author: kengaderdus

author: kengaderdus

author: Dickson-Mwendia

author: SHERMANOUKO

author: SHERMANOUKO

author: kengaderdus

author: kengaderdus

author: SHERMANOUKO

Shows how an admin can add sponsors to guest users in Microsoft Entra B2B collaboration.

Learn how an administrator creates a list to allow or block B2B collaboration with specific domains by using the Microsoft Entra admin center.

**Applies to**:  External tenants ([learn more](/entra/external-id/tenant-configurations))

**Applies to**:  iOS (Swift)  macOS (Swift)

**Applies to**:  Workforce tenants ([learn more](/entra/external-id/tenant-configurations))

author: kengaderdus

Give partners access to both on-premises and cloud resources with Microsoft Entra B2B collaboration.

Learn how to configure B2B direct connect with other Microsoft Entra organizations, using cross-tenant access settings to manage outbound and inbound access.

Learn how to bulk invite B2B collaboration users in Microsoft Entra External ID. Follow the steps to prepare a CSV file, upload it, and verify guest users in the directory.

Learn how to configure external collaboration settings in Microsoft Entra External ID. Control guest user access, specify who can invite guests, and manage domain restrictions for B2B collaboration.

Enable secure cross-cloud B2B collaboration between organizations in different sovereign (national) Microsoft Azure clouds by configuring Microsoft cloud settings.

author: kengaderdus

Learn how to create and manage dynamic membership groups in Microsoft Entra External ID. Set rules based on user attributes to automate group membership for B2B collaboration.

author: kengaderdus

author: kengaderdus

Learn about the pricing structure for Microsoft Entra External ID. Understand the monthly active users (MAU) billing model, core offering, and premium add-ons. Link your tenant to an Azure subscription for proper billing and feature access.

author: SHERMANOUKO

Find answers to frequently asked questions about Microsoft Entra External ID. Learn about pricing, features, and the future of Azure AD B2C and External Identities.

Learn how to add Google as an identity provider in Microsoft Entra External ID. Enable customers to sign in with their Google accounts and configure Google federation for seamless access.

Shows how to give cloud B2B users access to on premises apps with Microsoft Entra B2B collaboration.

Learn how to use Microsoft Entra ID as your default identity provider for sharing with external users.

Learn about customizing the language experience in your user flows in Microsoft Entra External ID.

As a B2B collaboration user, learn how to leave an organization if you no longer need guest user access to apps. If you're an admin, see how to allow external users to leave.

Current limitations for Microsoft Entra B2B collaboration

Use this quickstart to learn how Microsoft Entra admins can add B2B guest users in the Microsoft Entra admin center and walk through the B2B invitation workflow.

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: cilwerner

Learn how to customize the onboarding workflow for Microsoft Entra B2B users to fit your organization’s needs.

Learn about the service limits and restrictions in an external tenant.

Learn how to run a sample Angular SPA to sign in users

Learn how to run a sample React SPA to sign in users

Learn how to run a sample JavaScript SPA to sign in users

author: kengaderdus

Learn about tenant configurations in Microsoft Entra External ID. Understand the differences between workforce and external tenants, and how to configure them for your organization's needs.

In this tutorial, you learn how to use PowerShell and a CSV file to send bulk invitations to external Microsoft Entra B2B collaboration guest users.

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: henrymbuguakiarie

author: henrymbuguakiarie

author: henrymbuguakiarie

author: henrymbuguakiarie

author: henrymbuguakiarie

author: kengaderdus

Enable your external business partners and guest users to use their Microsoft Account (MSA) to sign in to your apps for B2B collaboration.

Enable your external business partners and guest users to use their Microsoft Entra work or school accounts to sign in to your apps for B2B collaboration.

Learn about the default permissions for users in an external tenant.

Learn how to run a sample ASP.NET web app to sign in users

Learn how to run a sample Node.js/Express web app to sign in users

Learn how to run a sample Python Django web app to sign in users

Learn how to run a sample Python Flask web app to sign in users

New and updated documentation for the Microsoft Entra External ID.

When you add a guest user to your directory, the guest user account has a consent status (viewable in PowerShell) that's initially set to **PendingAcceptance**. This setting remains until the guest accepts your invitation and agrees to your privacy policy and terms of use. After that, the consent status changes to **Accepted**, and the consent pages are no longer presented to the guest.

If you don’t have an Azure subscription, create a [free account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn) before you begin.

To protect customers, some regions require you to enable the country codes to receive SMS telephony verification for Microsoft Entra External ID external tenants.

Learn how to add multifactor authentication (MFA) to your consumer and business customer (CIAM) application. For example, add email one-time passcode as a second authentication factor to your CIAM sign-up and sign-in user flows.

Learn how to enforce multifactor authentication policies for Microsoft Entra B2B users.

Learn about the properties of a B2B guest user in Microsoft Entra External ID. Understand user types, authentication methods, and how to manage guest user access and permissions.

author: henrymbugua

author: henrymbugua

Learn about how to customize the browser language for your app's authentication experience to provide a personalized sign-in.

Learn how to enable and use email one-time passcode authentication for B2B guest users in Microsoft Entra External ID. This feature provides a seamless fallback authentication method for sign-in.

author: kengaderdus

Learn how to set up custom URL domains to personalize the authentication sign-in endpoints for the external customers and consumers of your app.

Explore Microsoft Entra External ID training, live demos, and videos. Learn to create secure sign-up experiences and protect access with multifactor authentication.

In this tutorial, learn how to require multifactor authentication when you use Microsoft Entra B2B to collaborate with external users and partner organizations.

Learn about the B2B collaboration invitation email you can send to business partners and external guest users who need to authenticate and access your apps.

Learn how to add an application to a user flow to associate the application with a sign-up and sign-in user experience. Get guidance for updating the application configuration with application registration and tenant information.

Learn how to configure an Azure AD B2C tenant as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Learn how to add Facebook as an identity provider for your external tenant, enabling customers to sign in to your applications using their Facebook accounts.

Add sign-up and sign-in user flows for your consumer and business customers. Create a branded, customized user experience for apps in your external tenant.

author: kengaderdus

Learn how Microsoft Entra B2B invitation redemption works, including guest sign-in, consent process, and privacy terms. Ensure secure access for your organization’s resources.

Learn how to create and define new custom attributes to be collected from users during sign-up and sign-in.

In this quickstart, learn how to create an external tenant for customer identity and access management (CIAM). Customize a sign-in experience and try it out with a sample app.

author: kengaderdus

If you have internal user accounts for partners, distributors, suppliers, vendors, and other guests, you can change to Microsoft Entra B2B collaboration by inviting them to sign in with their own external credentials or sign-in. Use either PowerShell or the Microsoft Graph invitation API.

In this quickstart, you learn how to use PowerShell to send an invitation to a Microsoft Entra B2B collaboration user. You'll use the Microsoft Graph Identity Sign-ins and the Microsoft Graph Users PowerShell modules.

Learn how to Sign in with alias/username with External ID for customer identity and access management (CIAM). Get detailed steps to enable username as a sign-in identifier and create users with both email address and username.

Learn how to use the Run user flow feature to test your sign-up and sign-in user flow for your consumer and business customer apps.

Learn how to use the Microsoft Entra External ID extension for Visual Studio Code. Use the application samples provided to set up a customized, branded sign-in experience for external users of your application without leaving the development environment.

Learn about tenant-level restrictions and controls for users, groups, and applications, along with policy management in a cloud-based portal.

Learn how to add enterprise applications to your Microsoft Entra external tenant using the admin center. Discover gallery apps, configuration steps, and deployment tips.

Configure a web API to be used in a user flow.

author: kengaderdus

author: kengaderdus

Learn how to add built-in user attributes and custom attributes as claims to the application token. Use directory extension attributes for sending user data to applications in token claims.

Add API connectors for custom approval workflows in External ID self-service sign-up

author: kengaderdus

Learn about how to analyze user activity and engagement for your registered application in the external tenant.

Code samples for API connectors in self-service sign-up flows for Microsoft Entra External ID.

Learn how to manage your external tenant by calling the Azure REST API.

Code and PowerShell samples for Microsoft Entra B2B collaboration

Learn how to configure Microsoft Entra External ID with Azure Web Application Firewall.

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: kengaderdus

author: kengaderdus

Find out which core Microsoft Entra features related to the user and group management model and application assignment are available in external tenants.

author: kengaderdus

author: kengaderdus

Learn how to build and integrate apps with external tenants with scenarios such as sign-up, sign in, and getting an access token to call an API.

Secure your custom RESTful APIs used as API connectors in self-service sign-up user flows.

Learn how to define application roles for your consumer and business customer applications and assign those roles to users and groups in external tenants.

Learn about security features and fundamentals for Microsoft Entra External ID customer identity and access management (CIAM) in external tenant configurations.

Microsoft Entra ID supports two tenant configurations: A workforce configuration that's intended for internal use and manages employees and business guests, and a [customer configuration](/entra/external-id/customers/concept-supported-features-customers) which is optimized for isolating consumers and partners in a restricted external-facing directory. While the underlying identity service is identical for both tenant configurations, the sign in domains and token issuing authority for external tenants is different. This allows applications to keep workforce and external ID workflows separated if needed.

Learn how to use custom authentication extensions in Microsoft Entra External ID. Integrate with external systems, add custom logic to authentication flows, and enhance user experiences.

Learn about setting up custom URL domains to personalize the authentication sign-in endpoints for the external customers and consumers of your app.

Learn about B2B collaboration for sharing apps with external identities, business partners, and guests, using External ID for authentication and identity access management.

> This information relates to a prerelease product that might be substantially modified before its release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

Use Microsoft Entra API connectors to customize and extend your self-service sign-up user flows by using web APIs.

Microsoft Entra B2B direct connect lets users from other Microsoft Entra tenants seamlessly sign in to your shared resources via Teams shared channels. There's no need for a guest user object in your Microsoft Entra directory.

Learn how to manage cross-tenant access in Microsoft Entra External ID. Configure B2B collaboration and direct connect settings to control access and trust for external organizations.

Compare features and capabilities of a workforce vs. an external tenant configuration. Determine which tenant type applies to your external identities scenario.

Learn how Microsoft Entra External ID provides to manage your external identities scenarios, including guest user access and customer identity and access management (CIAM) for apps.

Learn about the features you set up with the get started guide.

Learn about using MFA to secure apps in your external tenant and enabling email one-time passcodes (EOTP) or SMS as a second verification method for sign-up and sign-in.

Learn best practices and recommendations for business-to-business (B2B) guest user access in Microsoft Entra ID.

Microsoft Entra External ID allows you to collaborate with or publish apps to people outside your organization. Compare solutions for External ID, including Microsoft Entra B2B collaboration, Microsoft Entra B2B collaboration, and Azure AD B2C.

Discover the steps for setting up a customer identity and access management (CIAM) solution in an external tenant, including creating a tenant, registering apps, and setting up user flows for sign-in.

Learn how to enable self-service sign-up for Microsoft Entra External ID. Allow external users to sign up for your applications themselves, customize the sign-up experience, and manage user flows.

User profile attributes that you can collect from the user during sign-up, and how to extend user profile attributes by using custom user attributes.

Learn how Global Secure Access enables secure B2B guest access for external partners through the Global Secure Access client and Azure Virtual Desktop.

**Password complexity mismatch in Native Auth**: During a Native Auth flow, if a user enters a password that is correct according to the legacy identity provider but is considered weak by External ID password complexity standards an error is returned instead of redirecting to SSPR.

We are pleased to announce the general availability of client credentials in Entra External ID. The OAuth 2.0 client credentials grant flow permits a web service (confidential client) to use its own credentials, instead of impersonating a user, to authenticate when calling another web service. Permissions are granted directly to the application itself by an administrator.

Learn about federation with an external organization's SAML/WS-Fed identity provider (IdP) for external user self-service sign-up and invitation redemption.

Set up direct federation with SAML 2.0 or WS-Fed identity providers so users can sign in with work accounts. Understand attributes and claims for federation.

Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Customize the user claims that are issued in the SAML token for Microsoft Entra B2B users.

Learn sign-in and MFA options for customer identity and access management (CIAM), including email, one-time passcodes, social providers, SAML/WS-Fed, and OIDC.

Learn how to create and register a SAML app with External ID for customer identity and access management (CIAM). Choose your app type and get detailed steps.

Set up direct federation with SAML 2.0 or WS-Fed identity providers (IdP) and enable self-service sign-up for external users, who can sign in with their own work accounts.

Learn how to set up SAML/WS-Fed IdP federation with AD FS for B2B collaboration in Microsoft Entra External ID. Configure AD FS as a SAML 2.0 or WS-Fed IdP and manage attributes and claims.

Learn how to configure the standard OpenID Connect claims with the claims your identity provider provides in your external tenant.

author: henrymbuguakiarie

Learn how to configure Akamai Web Application Firewall (WAF) to protect against attacks for Microsoft Entra External ID tenants.

Learn how to configure Cloudflare Web Application Firewall (WAF) to protect against attacks.

Learn how to configure Arkose Labs and Human fraud protection with Microsoft Entra External ID to block bot attacks and fake account creation during user sign-up flows.

Give locally managed external partners access to both local and cloud resources using the same credentials with Microsoft Entra B2B collaboration.

Learn how to Migrate to version 2 of the CrossTenantAccessPolicy Microsoft Graph API.

Disable sign-up in your user flow with Microsoft Graph API. Prevent new registrations and allow only sign-in for your external users.

Learn how to use Visual Studio Connected Services to integrate Microsoft Entra ID into your applications right from your development environment.

Learn how to reset the redemption status for a guest user in Microsoft Entra External ID. This guide covers using the admin center, PowerShell, and Microsoft Graph API.

Enable accidental deletions prevention in the Microsoft Entra provisioning service for applications and cross-tenant synchronization.

include file

Include file

Guest user properties are configurable in Microsoft Entra B2B collaboration

Learn how to set up Azure Monitor in external tenants to collect and analyze data in your tenant.

Learn about known issues in external tenants.

Learn how to troubleshoot common issues with Microsoft Entra B2B collaboration. Resolve guest sign-in errors, direct connect access problems, policy update failures, and encrypted email access issues.

Learn about how to create branding themes and apply them to the sign-in experience for your application in Microsoft External ID for external tenants.

Learn how to configure threat intelligence in Microsoft Entra Internet Access.

Learn how to configure web content filtering in Microsoft Entra Internet Access.

Global Secure Access includes Microsoft Entra Private Access and Microsoft Entra Internet Access. This article outlines data storage and privacy information.

Learn how to manage the Internet Access traffic forwarding profile for Microsoft Entra Internet Access.

Global Secure Access points of presence and IP addresses for Microsoft Entra Internet Access and Microsoft Entra Private Access.

PowerShell example that bypasses a certain fqdn or IP from being acquired by the Global Secure Access Client in the Internet Access forwarding profile.

PowerShell example that adds Intune-related endpoints to the Global Secure Access Internet Access custom bypass policy to mitigate device compliance issues.

Learn about the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

Learn about how Microsoft Entra Internet Access secures access to the Internet.

PowerShell examples for use in a Microsoft Entra Internet Access break glass scenario.

Global Secure Access includes Microsoft Entra Private Access and Microsoft Entra Internet Access. This article references event enrichment in Microsoft 365 enriched logs.

Learn how to configure and use GSA Cloud Firewall to protect against unauthorized internet access from branch offices using Remote Networks for Internet Access.

Learn about the supported cryptographic algorithms, or ciphers, used for Microsoft Entra Private Access.

Learn how to configure Microsoft Entra private network connectors for Microsoft Entra Private Access.

Learn how to configure Microsoft Entra Private Access for Active Directory Domain Controllers.

Learn how to specify the internal resources to secure with Microsoft Entra Private Access using a Quick Access app.

Learn how to enable Multi-Geo Capability for Microsoft Entra Private Access to optimize traffic flow from Microsoft Entra Clients to Microsoft Entra Apps.

Learn how to manage the Private Access traffic forwarding profile for Microsoft Entra Private Access.

author: kenwith

Covers how to provide single sign-on using Kerberos with Microsoft Entra Private Access.

Learn how to access an Azure Storage account behind Azure Private Link using Microsoft Entra Private Access.

Learn how to access Azure SQL with a service endpoint using Microsoft Entra Private Access.

Learn how Microsoft Entra private network connector groups work, and how Microsoft Entra Private Access and application proxy use them.

Learn how Microsoft Entra private network connectors work and how Microsoft Entra Private Access and application proxy use them.

Learn about how Microsoft Entra Private Access secures access to your private corporate resources through the creation of Quick Access and Global Secure Access apps.

Learn how to configure per-app access to your private, internal resources using Global Secure Access applications for Microsoft Entra Private Access.

Configure Microsoft Entra Private Access to tunnel specific application traffic through a private network for application's network-based access control policy.

Learn to configure and establish a Secure Shell (SSH) connection using Microsoft Entra Private Access for enhanced security.

Learn how to link your domain to your decentralized identifier (DID).

author: barclayn

In this article, you learn how to use a quickstart to create a custom verifiable credential for an ID token hint.

In this tutorial, you learn how to configure your tenant to verify credentials.

A design pattern describing how to verify in helpdesk scenarios

author: shlipsey3

author: barclayn

author: kenwith

This article lists all releases of Microsoft Entra private network connector and describes new features and fixed issues.

author: kenwith

author: HULKsmashGithub

Learn how to assign a remote network to a traffic forwarding profile for Global Secure Access.

Learn about how Microsoft is dedicated to supporting Global Secure Access capabilities in China.

Microsoft and Cisco’s Secure Access coexistence solution guide.

Microsoft and Cisco VPNs coexistence solution guide.

author: kenwith

Learn how to configure the connectivity between your customer premises equipment and the Global Secure Access network.

Learn how to set up the bidirectional communication tunnel between Global Secure Access and your router.

Learn how to create remote networks, for remote locations such as branch offices, for Global Secure Access.

author: HULKsmashGithub

author: HULKsmashGithub

author: HULKsmashGithub

author: jenniferf-skc

Global Secure Access maintains a compliance portfolio. This article lists the current, supported certifications.

author: HULKsmashGithub

author: HULKsmashGithub

author: HULKsmashGithub

Learn how to list remote networks for Global Secure Access.

author: HULKsmashGithub

Learn how to enable and manage the Microsoft traffic forwarding profile for Global Secure Access.

Learn how to add and delete customer premises equipment device links to remote networks for Global Secure Access.

Learn how to update and delete remote networks for Global Secure Access.

Learn how to roll out traffic forwarding profiles to users and groups with Global Secure Access

author: HULKsmashGithub

Use this PowerShell script to create a TLS certificate using Active Directory Certificate Services (ADCS) in a test environment.

PowerShell example that gets the Auth Token for registering your Microsoft Entra private network connector through Azure, AWS, or GCP Marketplaces.

Use these PowerShell samples for Global Secure Access.

Learn how to access the Global Secure Access area of the Microsoft Entra admin center.

Learn how to Install the Windows client to acquire Microsoft traffic in Global Secure Access.

Learn how to configure per-app access to private resources in Global Secure Access.

Learn how to configure Quick Access to private resources in Global Secure Access.

Valid Global Secure Access configurations for custom remote network device links settings, including IKE, ASN, IPSec, and DH group.

ai-usage: ai-assisted

Learn about the built-in administrator roles you can assign to manage Global Secure Access permissions.

ai-usage: ai-assisted

Covers how to perform an unattended installation of the Microsoft Entra private network connector.

author: kenwith

author: kenwith

author: kenwith

Global Secure Access Threat intelligence threat types

author: kenwith

Global Secure Access Web content filtering categories

author: HULKsmashGithub

author: kenwith

The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.

This article provides an overview of the Transport Layer Security (TLS) inspection process and how it increases security between two communicating parties.

Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.

Learn about Continuous Access Evaluation (CAE) for Application Proxy (preview)

author: kenwith

ai-usage: ai-assisted

A Microsoft Entra documentation page was updated: Application Usage Analytics.

Learn about endpoint detection and response and antivirus solution coexistence with Global Secure Access client.

Learn about the available Global Secure Access logs and monitoring options.

Learn about the capabilities and traffic handling in the Microsoft traffic profile

ai-usage: ai-assisted

Learn about the Microsoft Secure Access Service Edge (SASE) partner ecosystem. Learn about partner integrations and partner coexistence.

Install the Global Secure Access Windows client as a proof of concept. This script automates installation and applies essential configurations.

Learn how remote network connectivity in Global Secure Access allows users to connect to your corporate network from a remote location, such as a branch office.

ai-usage: ai-assisted

Monitor the health and status of your network traffic with the Global Secure Access dashboard.

Learn about how traffic forwarding profiles for Global Secure Access streamline how you route traffic through your network.

author: idmdev

author: HULKsmashGithub

author: HULKsmashGithub

Understand critical IP address ranges to consider when configuring and troubleshooting internet over remote network connectivity.

Learn how to troubleshoot application access problems with the Global Secure Access Windows client.

A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.

author: HULKsmashGithub

author: HULKsmashGithub

author: HULKsmashGithub

Troubleshoot problems installing the Microsoft Entra private network connector.

**To verify the client certificate:**

Learn how to access, archive, and analyze the audit logs for Microsoft's Security Service Edge solution.

Learn how to use Global Secure Access traffic logs (preview) to monitor connections to the service, the type of traffic, and who's connecting.

author: jenniferf-skc

Learn how to check the health of your remote networks with the Global Secure Access remote network health logs.

Workbooks provide rich, interactive reports for Global Secure Access. Learn how to integrate workbooks with log analytics for Global Secure Access.

author: kenwith

Learn how to use enriched Microsoft 365 logs for Global Secure Access.

Microsoft and Cisco’s Security Service Edge (SSE) coexistence solution guide.

ai-usage: ai-assisted

Microsoft and Palo Alto Network’s Security Service Edge (SSE) coexistence solution guide.

Use this PowerShell script to generate and sign Transport Layer Security (TLS) certificates using OpenSSL in a test environment.

Learn how to configure a Transport Layer Security inspection policy and assign it to users in your organization.

Learn how to configure a Transport Layer Security inspection certificate authority

ai-usage: ai-assisted

PowerShell examples that re-enable any Conditional Access policies that were disabled in a break glass scenario.

Learn how to Create a remote network, apply Conditional Access, and review the logs in Global Secure Access.

author: HULKsmashGithub

Learn how to secure highly valued private application access with Privileged Identity Management (PIM) and Global Secure Access

author: shlipsey3