📋 Microsoft Entra Documentation Changes

Marketing | OU=Marketing,DC=contoso,DC=com

Groups | OU=Groups,DC=contoso,DC=com

5. On the configuration screen, select your domain. Select **Create**.

ai-usage: ai-assisted

ms.date: 03/31/2026

Microsoft periodically adds and modifies features and functionality in the Microsoft identity platform to improve security, usability, and standards compliance.

## Microsoft Identity Broker version lifecycle and support matrix

ai-usage: ai-assisted

ms.date: 03/31/2026

- Registers Linux desktops with Microsoft Entra ID and enrolls them in Microsoft Intune.

- Enables SSO for native and web applications (for example, Azure CLI, Microsoft Edge, and Teams PWA).

- Enables SSO for apps that use MSAL for .NET or MSAL for Python.

- Supports Conditional Access policies for web apps through Microsoft Edge.

- Supports standard Microsoft Intune compliance policies.

- Supports Bash scripts for custom compliance policies.

| `/serviceproviderconfig` | GET | Fetch configuration details about the Microsoft Entra ID SCIM implementation, such as supported authentication schemes, available endpoints, and compliance with SCIM protocols. |

| `/resourcetypes` | GET | Retrieve information about the resource types (Users and Groups) supported by Microsoft Entra ID. |

| `/schemas` | GET | Retrieve detailed information about the schemas supported by Microsoft Entra ID. |

| `/users` | GET, POST, PATCH, DELETE | Read, create, update, and delete user data in Microsoft Entra ID. |

"id": "d3d3d3d3-eeee-ffff-aaaa-b4b4b4b4b4b4",

 

## Verify that the SCIM API is disabled

 

Use the following steps to validate that the disable operation was successful.

 

1. Obtain an app-only access token that previously worked for SCIM API calls.

 

1. Send a GET request to any SCIM endpoint. For example, call the user read endpoint:

 

```http

GET https://graph.microsoft.com/rp/scim/users/{id}

Authorization: Bearer {token}

Accept: application/json

```

 

1. Confirm that the API returns **HTTP 400 Bad Request**.

 

ms.date: 03/31/2026

#customer intent: Learn about SCIM support in Microsoft Entra ID, including how to provision users and groups to SaaS applications or into Microsoft Entra using SCIM APIs.

Microsoft Entra ID supports the **System for Cross‑domain Identity Management (SCIM) 2.0** standard in multiple ways, depending on the provisioning scenario. Microsoft Entra can act as:

- A **SCIM client**, provisioning users and groups from Microsoft Entra into partner applications.

- A **SCIM service provider**, exposing SCIM APIs that allow external systems to provision users and groups directly into MicrosoftEntra.

description: Learn how to add social sign-in with Apple, Facebook and Google identity providers to your React SPA using native authentication JavaScript SDK.

#Customer intent: As a developer, I want to support federated identity providers (social sign-in) in my React single-page application that uses native authentication JavaScript SDK so that users can sign up and sign in with Apple, Facebook and Google identity providers.

In this tutorial, you learn how to let users sign up and sign in with their existing social accounts, such as Apple, Facebook and Google, in your React single-page application (SPA) by using native authentication's JavaScript SDK for external tenants.

ms.date: 03/31/2026

Credentials used to authenticate an agent identity are configured on the agent identity blueprint. When an AI agent wants to perform an operation, the credentials configured on the agent identity blueprint are used to request an access token from Microsoft Entra ID. OAuth permissions granted to a agent identity blueprint are granted to all agent identities created from that blueprint. There are several credentials types that can be used for agent identities. For more information on these, see [credentials for agent identities](./agent-identities.md#authorizing-agent-identities). For auth protocols, see [Agent ID authentication protocols](./agent-oauth-protocols.md)

Blueprints don't just hold information. They're also a special identity type in a Microsoft Entra ID tenant. A blueprint can perform exactly one operation in the tenant: provision or deprovision agent identities. All agent identities in a Microsoft Entra ID tenant are created from an agent identity blueprint. To create an agent identity, a blueprint has:

description: Learn how to add social sign-in with Apple, Facebook and Google identity providers to your Angular SPA using native authentication JavaScript SDK.

#Customer intent: As a developer, I want to support federated identity providers (social sign-in) in my Angular single-page application that uses native authentication JavaScript SDK so that users can sign up and sign in with Apple, Facebook and Google identity providers.

In this tutorial, you learn how to let users sign up and sign in with their existing social accounts, such as Apple, Facebook and Google, in your Angular single-page application (SPA) by using native authentication's JavaScript SDK for external tenants.

| SCIM Attribute | Microsoft Entra ID Attribute | Notes / Restrictions |

| addresses[type eq "work"].country/region | country/region | Only one *addresses* value is allowed, and it requires a type of "work". |

| emails[type eq "proxyAddress"].value | proxyAddresses - only for values that start with SMTP: (case-insensitive) | A read-only list of email addresses. This attribute is currently implemented as type "work" and primary equal to false. |

ms.date: 03/31/2026

ms.date: 03/31/2026

# Shadow AI discovery in Global Secure Access

ms.date: 03/31/2026

- See [Supported applications](#supported-applications) for applications that support Account Discovery. Account Discovery isn't supported for the following applications including:

ms.date: 03/31/2026

- Provisioning (inbound) is not supported for External ID tenants.

4. **Configure credentials**: Adds a managed identity (for production) or a certificate or client secret (for local development/testing) to the blueprint.

- **Credential type**: Whether to use a managed identity (recommended for production) or a certificate or client secret (for local development).