Learn about the new features and documentation improvements in Microsoft Entra role-based access control (RBAC).

PowerShell sample that pauses all groups and administrative units with dynamic membership in your Microsoft Entra tenant to mitigate ongoing membership-processing issues.

PowerShell sample that pauses every group and administrative unit with dynamic membership in your Microsoft Entra tenant except for the IDs you specify.

PowerShell sample that pauses specific groups and administrative units with dynamic membership in your Microsoft Entra tenant by accepting a list of IDs.

PowerShell sample that resumes dynamic membership processing for noncritical groups and administrative units in your Microsoft Entra tenant, up to 100 of each per run.

PowerShell sample that resumes dynamic membership processing for specific critical groups and administrative units in your Microsoft Entra tenant after pausing.

Use these PowerShell samples to pause and resume dynamic membership rule processing for Microsoft Entra groups and administrative units during incident response.

Global Administrator

"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"

- Each dynamic group can have up to 50 member groups.

```json

Learn how to run a registration campaign in Microsoft Entra ID to nudge users toward passkeys or Microsoft Authenticator for stronger sign-in security.

Learn how to simplify the user experience with combined Microsoft Entra multifactor authentication and self-service password reset registration.

```kql

- Replace `{authenticationeventsAPI_AppId}` with the **appId** you recorded earlier.

1. Select **Add**.

1. Select **Add**.

`https://login.microsoftonline.com/contoso.com/oauth2/authorize?resource=https://gateway.contoso.com/api&response_type=token&client_id=00001111-aaaa-2222-bbbb-3333cccc4444&...`

Learn how Knowledge Bases help the Conditional Access Optimization Agent create tailored policy recommendations based on your organization's unique standards.

The agent settings described in this article cover standard options like triggers, notifications, and scope. But the settings also include advanced options like custom instructions, Intune integrations, and permissions.

author: shlipsey3

1. Identify the permissions your app requires, their permission IDs, and whether they're app roles (application permissions) or delegated permissions. For example, if you want to request Microsoft Graph permissions, see [Microsoft Graph permissions](/graph/permissions-reference#permission-scenarios) for a list of permissions and their IDs.

Learn about requirements to prepare FIDO2 hardware for attestation with Microsoft Entra ID.

The [What If Evaluation API](/graph/api/conditionalaccessroot-evaluate) is a Microsoft Graph API that is called by the Conditional Access experience. The API is different from the legacy What If evaluation in a few ways:

"displayName": "AWS Contoso",

Troubleshoot Microsoft Entra multifactor authentication and self-service password reset combined registration.

Conditional Access policies for agent identities let you control how AI agents access corporate resources. As your organization deploys more agents, you need policies that target the right agents, evaluate the right signals, and enforce the right controls. To learn more about how Conditional Access policies for agents work for different scenarios, see [Conditional Access policies for agents](agent-id.md).

- High-level overview of Conditional Access: [What is Conditional Access?](overview.md)

Agent ID Administrator

Agent ID Developer

- **Require authentication strength** and **Sign-in frequency - Every time** are automatically applied to the policy to ensure that after session revocation, end users are immediately prompted to reauthenticate with the specified authentication strength.

Learn how to configure custom extensions in Microsoft Entra Privileged Identity Management (PIM) to integrate custom business logic into role activation workflows.

Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Learn how to configure the standard OpenID Connect claims with the claims your identity provider provides in your external tenant.

Learn about the B2B collaboration invitation email you can send to business partners and external guest users who need to authenticate and access your apps.

```powershell

| 1Kosmos | [1Kosmos offer](https://aka.ms/1kosmos) | [VerifiedIdentity](https://verifiedid.did.msidentity.com/v1.0/tenants/8108e610-606c-4dc3-ae95-d3ad8be3b24c/verifiableCredentials/contracts/1197e066-a9a2-2dc5-f245-4c31d1f4b456/manifest) | 1Kosmos and Microsoft Entra Verified ID unite to deliver trusted, privacy-preserving identity verification that empowers secure, passwordless access across ecosystems. |

:::image type="content" source="media/concept-external-user-access/guest-access-overview.png" alt-text="Diagram showing an overview of external user access in Global Secure Access." lightbox="media/concept-external-user-access/guest-access-overview.png":::