📋 Microsoft Entra Documentation Changes

Add assignments of existing users, who already have access to the application, to the access package and its direct assignment policy. You can [directly assign each user](entitlement-management-access-package-assignments.md#assign-a-user-to-an-access-package-with-powershell) to an access package.

## Add assignments for users existing users who already have accounts in your application

When you use the Microsoft Entra provisioning service to [discover](~/identity/app-provisioning/how-to-account-discovery.md) users in your application, you can easily assign those users to an access package. [Download](https://aka.ms/AssignCorrelatedUsersPowerShell) the Assign-CorrelatedUsersWithRules.ps1 file. See the example approaches for adding assignments.

 

1. Assign all discovered users to a specific access package (dry run):

 

```powershell

.\Assign-CorrelatedUsersWithRules.ps1 -ServicePrincipalId "7A22..." ` -RulesFile ".\access-package-rules.csv" -DryRun

```

 

title: Configure OpenForms for automatic user provisioning with Microsoft Entra ID

description: Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to OpenForms.

ms.date: 03/25/2025

# Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to OpenForms so that I can streamline the user management process and ensure that users have the appropriate access to OpenForms.

# Configure OpenForms for automatic user provisioning with Microsoft Entra ID

This article describes the steps you need to perform in both OpenForms and Microsoft Entra ID to configure automatic user provisioning. When configured, Microsoft Entra ID automatically provisions and de-provisions users and groups to [OpenForms](https://granicus.com/solution/govservice/openforms) using the Microsoft Entra provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Microsoft Entra ID](~/identity/app-provisioning/user-provisioning.md).

> * Create users in OpenForms.

title: System-preferred multifactor authentication (MFA)

description: Learn how system-preferred multifactor authentication evaluates methods to prompt users with the most secure sign-in option.

ms.date: 04/15/2026

# System-preferred multifactor authentication

System-preferred multifactor authentication (MFA) prompts users to sign in by using the most secure method they registered.

Administrators can enable system-preferred MFA to improve sign-in security and discourage less secure sign-in methods like Short Message Service (SMS).

For example, if a user registered both SMS and Microsoft Authenticator push notifications as methods for MFA, system-preferred MFA prompts the user to sign in by using the more secure push notification method. The user can still choose to sign in by using another method, but they're first prompted to try the most secure method they registered.

System-preferred MFA is a Microsoft managed setting, which is a [tristate policy](#authentication-method-feature-configuration-properties). The **Microsoft managed** value of system-preferred MFA is **Enabled**. If you don't want to enable system-preferred MFA, change the state from **Microsoft managed** to **Disabled**, or exclude users and groups from the policy.

title: Configure STACKIT Cloud for Single sign-on with Microsoft Entra ID

# Configure STACKIT Cloud for Single sign-on with Microsoft Entra ID

In this article, you learn how to integrate STACKIT Cloud with Microsoft Entra ID. When you integrate STACKIT Cloud with Microsoft Entra ID, you can:

In this article, you configure and test Microsoft Entra SSO in a test environment.

ms.date: 04/08/2026

## Supported apps and platforms

Authentication transfer is available for Microsoft apps that support the cross-device QR code flow. The transfer flow works from desktop apps on Windows or macOS to mobile apps on iOS or Android.

> Authentication transfer is only supported for Microsoft apps. Non-Microsoft apps don't support this flow.

At public preview Entra Backup and Recovery automatically takes daily backup of a tenant’s supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for five days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.

Policy-wide updates—such as Registration Campaigns and System‑preferred MFA—may continue to include the full policy payload. The activity name and triggering events remain unchanged. This update affects formatting only and does not change policy behavior. For more information, see: [Core Directory](../identity/monitoring-health/reference-audit-activities.md#core-directory)

Beginning **June 1, 2026**, Microsoft Entra ID will block any attempt by Entra Connect Sync or Cloud Sync from hard-matching a new user object from Active Directory to an existing cloud-managed Entra ID user object that hold [Microsoft Entra roles](../identity/role-based-access-control/permissions-reference.md).

If the user has other ways to sign in and [system-preferred MFA](/entra/identity/authentication/concept-system-preferred-multifactor-authentication) is enabled, those other methods appear by default order. The user can choose to use a different method, and then select external MFA. For example, if the user has Authenticator enabled as another method, they get prompted for [number matching](/entra/identity/authentication/how-to-mfa-number-match).

:::image type="content" border="true" source="./media/how-to-authentication-external-method-manage/system-preferred.png" alt-text="Screenshot of how to choose an external MFA when system-preferred MFA is enabled.":::

1. Select one or more external MFA method, and select **Save**.

Now that you have provided the connectivity details and matching attribute as part of your provisioning configureation, Microsoft Entra can discover the existing users in your application. Click on the [discover identities](~/identity/app-provisioning/how-to-account-discovery.md) button in the provisioning overview page. Once the report is generatd, you will have a view of all the users in your application, which users in the application match with a Microsoft Entra ID user, which users are already assigned to the enterprise application in Microsoft Entra ID, and which users in the application are not matched with a Microsoft Entra ID user).

- When subsequent updates are made to the user's attributes in Microsoft Entra ID, Microsoft Entra ID will sent those updates to the application.

| [System-preferred MFA](concept-system-preferred-multifactor-authentication.md) | Enabled |

> We recommend that you also enable [system-preferred MFA](concept-system-preferred-multifactor-authentication.md) when you enable Authenticator Lite. With system-preferred MFA enabled, users try to sign in with Authenticator Lite before they try less secure telephony methods like SMS or voice call.

> - **Phone-based MFA (SMS and voice call).** Plan to transition affected users to a supported MFA method such as email one-time passcode.

- Phone-based MFA (SMS and voice call). Plan to transition affected users to a supported MFA method such as email one-time passcode before migrating applications.