📋 Microsoft Entra Documentation Changes

author: idmdev

---

 

 

## Prerequisites

 

 

1. Select **+ Create** > **Managed Apps**:

 

 

1. Select **+ Select public apps**:

 

 

title: AI Administrator

description: AI Administrator

ms.topic: include

ms.custom: include file

---

 

Assign the AI Administrator role to users who need to do the following tasks:

 

 

<!-- autogenerated content starts here -->

 

> | --- | --- |

> | microsoft.azure.serviceHealth/allEntities/allTasks | Read and configure Azure Service Health |

1. Select **Reveal** on your Recovery Key and store this entire key in a safe place. **IMPORTANT!** If you're ever locked out of your Microsoft accounts and need to disconnect SSO without access, you be required to relay the Recovery Key to Simple In/Out technical support.

1. Select **Reveal** on your Bearer Token and make note of it. You'll need this for Step 5.6.

 

 

 

 

1. Within Simple In/Out's website, select **Settings** in the upper-right

1. Select **Roles** under the **USERS** menu on the left.

title: Entra Backup Administrator

description: Entra Backup Administrator

ms.topic: include

ms.custom: include file

---

 

> [!div class="mx-tableFixed"]

> | Actions | Description |

> | --- | --- |

> | microsoft.directory/backup/preview/cancel | Cancel a Microsoft Entra backup operation to compare a backup snapshot with the current state. |

> | microsoft.directory/backup/preview/create | Create a Microsoft Entra backup operation that allows a user to compare a backup snapshot with the current state. |

> | microsoft.directory/backup/recovery/cancel | Cancel a Microsoft Entra recovery operation to recover the contents of a backup snapshot |

> | microsoft.directory/backup/recovery/create | Create a Microsoft Entra recovery operation that allows a user to recover the contents of a backup snapshot. |

> | microsoft.directory/backup/standard/read | List Microsoft Entra backups (for example, backup IDs and timestamps), view difference reports, and list recovery jobs and their associated properties. |

title: Entra Backup Reader

description: Entra Backup Reader

ms.topic: include

ms.custom: include file

---

 

> [!div class="mx-tableFixed"]

> | Actions | Description |

> | --- | --- |

> | microsoft.directory/backup/preview/cancel | Cancel a Microsoft Entra backup operation to compare a backup snapshot with the current state. |

> | microsoft.directory/backup/preview/create | Create a Microsoft Entra backup operation that allows a user to compare a backup snapshot with the current state. |

> | microsoft.directory/backup/standard/read | List Microsoft Entra backups (for example, backup IDs and timestamps), view difference reports, and list recovery jobs and their associated properties. |

title: Microsoft Entra built-in roles

description: Describes the Microsoft Entra built-in roles and permissions.

ms.topic: reference

ms.reviewer: abhijeetsinha

ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange

---

> | Role | Description | Template ID |

> | --- | --- | --- |

> | [Agent ID Administrator](#agent-id-administrator) | Manage all aspects of agents in a tenant including identity lifecycle operations for agent blueprints, agent service principals, agent identities, and agentic users.<br/>[](privileged-roles-permissions.md) | db506228-d27e-4b7d-95e5-295956d6615f |

> | [Agent Registry Administrator](#agent-registry-administrator) | Manage all aspects of the Agent Registry service in Microsoft Entra ID | 6b942400-691f-4bf0-9d12-d8a254a2baf5 |

> | [AI Administrator](#ai-administrator) | Manage all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.<br/>[](privileged-roles-permissions.md) | d2562ede-74db-457e-a7b6-544e236ebb61 |

> | [AI Reader](#ai-reader) | Read all aspects of Microsoft 365 Copilot and AI-related enterprise services in Microsoft 365.<br/>[](privileged-roles-permissions.md) | 1fe13547-53f6-408d-ac04-7f8eed167b38 |

 

The scenario outlined in this article assumes that you already have the following prerequisites:

 

* [A Signagelive tenant](https://signagelive.com/pricing/)

* A user account in Signagelive with Admin permissions.

 

 

1. In the applications list, select **Signagelive**.

 

 

1. Select the **Provisioning** tab.

 

 

1. Review the user attributes that are synchronized from Microsoft Entra ID to Netskope User Authentication in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in Netskope User Authentication for update operations. If you choose to change the [matching target attribute](~/identity/app-provisioning/customize-application-attributes.md), you need to ensure that the Netskope User Authentication API supports filtering users based on that attribute. Select the **Save** button to commit any changes.

 

 

1. Review the group attributes that are synchronized from Microsoft Entra ID to Netskope User Authentication in the **Attribute Mapping** section. The attributes selected as **Matching** properties are used to match the groups in Netskope User Authentication for update operations. Select the **Save** button to commit any changes.

 

 

1. To configure scoping filters, refer to the instructions provided in the [Scoping filter article](~/identity/app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).

 

|urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department|String||

|urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager|String||

 

 

1. Review the group attributes that are synchronized from Microsoft Entra ID to Palo Alto Networks SCIM Connector in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the groups in Palo Alto Networks SCIM Connector for update operations. Select the **Save** button to commit any changes.

 

ms.service: entra-id

ms.subservice: role-based-access-control

ms.topic: include

author: FaithOmbongi

ms.author: ombongifaith

---

> | --- | --- |

> | microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks | Manage all aspects of granular delegated admin privileges (GDAP) relationships in a customer tenant. |

> | microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |

title: What's new in Microsoft Entra RBAC documentation

description: Learn about the new features and documentation improvements in Microsoft Entra role-based access control (RBAC).

ms.topic: whats-new

 

---

 

 

| Date | Area | Description |

| --- | --- | --- |

| April 2026 | Roles | Added [AI Reader](permissions-reference.md#ai-reader) and [Customer Delegated Admin Relationship Administrator](permissions-reference.md#customer-delegated-admin-relationship-administrator) roles. |

| March 2026 | Roles | Added [Teams External Collaboration Administrator](permissions-reference.md#teams-external-collaboration-administrator) role. |

| March 2026 | Roles | Added [Entra Backup Administrator](permissions-reference.md#entra-backup-administrator) and [Entra Backup Reader](permissions-reference.md#entra-backup-reader) roles. |

ms.reviewer:

---

 

 

Explicit Forward Proxy (EFP) is one of the traffic acquisition mechanisms that's useful in scenarios where installation of the Global Secure Access (GSA) client is difficult or not possible. EFP is an effective mechanism to protect internet traffic when users use browsers to access resources from:

* multi-session Virtual Desktop Infrastructure (VDI)

ms.reviewer:

---

 

 

A PAC file is a mechanism used to automatically determine which proxy server a web browser or application should use for a given request. PAC files are an integral part of Explicit Forward Proxy configuration, enabling flexible and dynamic traffic steering decisions. In the context of Global Secure Access, PAC files are similar to the traffic forwarding policies of the GSA client.

 

> The Explicit Forward Proxy feature is currently in PREVIEW.

> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

 

Explicit Forward Proxy (EFP) for Microsoft Entra Internet Access relies on IP affinity, among other mechanisms, for session management. While not required, we recommend that you configure a Conditional Access policy that restricts the use of EFP on networks your organization trusts. Additionally, you use Conditional Access policies to assign the Microsoft Entra Internet Access security profiles to users.

 

## Prerequisites

 

# How to Configure Explicit Forward Proxy (preview)

 

Explicit Forward Proxy (EFP) allows you to use Secure Web and AI Gateway capabilities of Microsoft Entra Internet Access without installing the Global Secure Access (GSA) client. EFP works with any browser that supports proxy automatic configuration (PAC).

 

> [!IMPORTANT]