📋 Microsoft Entra Documentation Changes

| App segment published without user assignment | An application segment is added or updated while the parent enterprise application has zero user or group assignments | IAM Admin | Sentinel scheduled rule *Private Access segment created without assignment* + the [pre-flight safety gate in Playbook 4](#playbook-4-application-segment-onboarding) | The segment matches traffic but no user is authorized, which can disrupt user access. 1. Assign at least one user or group to the parent enterprise app, **or** delete the offending **segment** — not the parent enterprise app. 2. Confirm activity returns to baseline before closing the alert. |

| App segment with broad destination | A new or updated application segment uses `destinationType` of `dnsSuffix` (wildcard suffix match), or its `destinationHost` is `0.0.0.0/0` or `::/0` | IAM Admin + Network Ops L2 | Sentinel scheduled rule *Private Access broad segment destination* (conservative trigger) + Zero Trust Assessment check [Entra Private Access Application segments are defined to enforce least-privilege access](https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-networks#entra-private-access-application-segments-are-defined-to-enforce-least-privilege-access) | A wildcard or default-route segment can capture traffic intended for unrelated services, including globally-deployed agents. 1. Confirm with the change requester that the broad destination is intentional. 2. If unintentional, narrow to specific FQDNs or `/24`-or-tighter ranges and remove `dnsSuffix` wildcards. 3. Run [Playbook 7](#playbook-7-scheduled-zero-trust-assessment-digest) to pick up the wider posture findings (CIDR > /24, broad port ranges, missing Custom Security Attributes) that ZT Assessment 25395 reports. |

| **Required permissions** | Service principal or user account with `NetworkAccess.ReadWrite.All`; `Application.Read.All` for the pre-flight assignment lookup |

> [!IMPORTANT]

> Run the four-step **pre-flight safety gate** below before every segment creation or update. A segment published with no user assignment or with an overly broad destination can disrupt access to unrelated apps; if that happens, mitigate by assigning users or deleting the **segment** — do not delete the parent enterprise app.

 

**Pre-flight safety gate:**

 

1. **Verify user assignment exists on the parent enterprise app.** A segment begins matching traffic the moment the policy is delivered to clients. If the parent app has no user or group assignment, every matched session is denied. Query Graph and confirm at least one assignment exists **before** writing the segment:

 

| Groups |<ul><li>A non-admin user can create a maximum of 250 groups in a Microsoft Entra organization. This quota is shared with other Entra resources. Any Microsoft Entra admin who can manage groups in the organization can also create an unlimited number of groups (up to the Microsoft Entra object limit). If you assign a role to a user to remove the limit for that user, assign a less privileged, built-in role such as User Administrator or Groups Administrator.</li><li>A Microsoft Entra organization can have a maximum of 15,000 dynamic groups (including those originating from Microsoft Entra entitlement management automatic assignment policies) and dynamic administrative units combined.</li><li>A maximum of 500 [role-assignable groups](~/identity/role-based-access-control/groups-concept.md) can be created in a single Microsoft Entra organization (tenant).</li><li>A maximum of 100 users can be owners of a single group.</li><li>There is a limit of 1010 groups per token allowed for [Entra Kerberos](/troubleshoot/windows-server/windows-security/logging-on-user-account-fails).</li><li>Any number of Microsoft Entra resources can be members of a single group.</li><li>If a user (or group) is a member of more than 2,048 groups (direct and nested), their access might be blocked. This limit applies to both direct and nested group memberships. See [Users, groups, and workload identities assignments in Conditional Access](~/identity/conditional-access/concept-conditional-access-users-groups.md).</li><li>A user can be a member of any number of groups. The following service-specific limits apply when group memberships are used in authentication or authorization (including direct and indirect memberships):<ul><li><b>SharePoint Online:</b> When security groups are used with SharePoint Online, a user can be a part of up to 2,047 security groups in total, including direct and indirect membership. When this limit is exceeded, authentication and search results can become unpredictable. See [SharePoint limits](/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits).</li><li><b>SAML tokens:</b> If optional groups claims are enabled, up to 150 group memberships (including nested groups) are included in SAML assertions. If a user is in more than 150 groups, the groups claim is omitted and an overage claim is sent instead. Microsoft Entra ID supports group filtering only if a user belongs to 1,000 or fewer groups (including direct and transitive memberships). If this limit is exceeded, filtering won’t apply and an overage claim is sent instead. See [Configure optional claims](~/identity-platform/optional-claims.md) and the [SAML token claims reference](~/identity-platform/reference-saml-tokens.md#claims-in-saml-tokens) for implementation guidance.</li><li><b>JWT/OIDC tokens:</b> If optional groups claims are enabled, up to 200 group memberships (including nested groups) are included in JWT tokens. If a user is in more than 200 groups, the groups claim is omitted and an overage claim is sent instead. See [Configure optional claims](~/identity-platform/optional-claims.md) and the [Access token claims reference](~/identity-platform/access-token-claims-reference.md#payload-claims) for implementation guidance.</li><li><b>Conditional Access policies:</b> Policy evaluation supports up to 4,096 group memberships per user (direct and indirect). When this limit is exceeded, policy enforcement might fail. See [Users, groups, and workload identities assignments in Conditional Access](~/identity/conditional-access/concept-conditional-access-users-groups.md).</li></ul></li><li>Starting with Microsoft Entra Connect v2.0, the V2 endpoint is the default API. The number of members in a group that you can synchronize from your on-premises Active Directory to Microsoft Entra ID by using Microsoft Entra Connect is limited to 250,000 members. For more information, see [Microsoft Entra Connect Sync V2](../identity/hybrid/connect/how-to-connect-sync-endpoint-api-v2.md).</li><li>When you select a list of groups, you can assign a group expiration policy to a maximum of 500 Microsoft 365 groups. There's no limit when the policy is applied to all Microsoft 365 groups.</li></ul><br/>At this time, the following scenarios are supported with nested groups:<ul><li>One group can be added as a member of another group, and you can achieve group nesting.</li><li>Group membership claims. When an app is configured to receive group membership claims in the token, nested groups in which the signed-in user is a member are included.</li><li>Conditional Access (when a Conditional Access policy has a group scope).</li><li>Restricting access to self-serve password reset.</li><li>Restricting which users can do Microsoft Entra join and device registration.</li></ul><br/>The following scenarios are <i>not</i> supported with nested groups:<ul><li>App role assignment, for both access and provisioning. Assigning groups to an app is supported, but any groups nested within the directly assigned group won't have access.</li><li>Group-based licensing (assigning a license automatically to all members of a group).</li><li>Microsoft 365 Groups.</li></ul> |

|Agent Identity Blueprints |<ul><li>Non-admin users are restricted to creating a maximum of 250 Agent Identity Blueprints. Both active and soft-deleted Blueprints contribute to this quota. This quota is shared with other Microsoft Entra resources.</li><li>Blueprints can take up no more than 95% of the tenant's overall resource quota (see "Resources" above).</li></ul> |

|Agent Identities |<ul><li>In a tenant, each Agent Blueprint managed by a platform not owned by Microsoft is limited to a maximum of 250 Agent Identities per Blueprint. This restriction does not apply to Blueprints managed by Microsoft-owned platforms, such as Foundry and Copilot Studio.</li><li>For non-admin users, the creation of Agent Identities is also capped at 250 per Agent Blueprint. Both active and deleted Agent Identities are counted toward this limit. This quota is shared with other Entra resources.</li><li>Agent Identities can take up no more than 95% of the tenant's overall resource quota (see **Resources**).</li></ul> |

Account Discovery requires the Microsoft Entra ID Governance add-on or Microsoft Entra Suite. This feature allows administrators to discover existing user accounts in target applications and identify which users have matching Entra accounts or are orphan accounts. For more information, see [Discover identities in target applications with Account Discovery](../identity/app-provisioning/how-to-account-discovery.md).

@azure Use the Agent ID Skill to set up an agent identity blueprint and create agent identities for my project using Microsoft Entra Agent ID.

Deep analysis performs an in-depth review of Conditional Access policies for scenarios such as blocking legacy authentication, blocking device control flow, and policies that require device or MFA controls. It evaluates the targeted users, groups, and roles to identify coverage gaps, overlapping or redundant policies, and consolidation opportunities. It also analyzes exclusions—flagging policies that exclude a large portion of users and recommending explicit exclusion of break‑glass accounts to reduce the risk of accidental lockout.

- **Deep analysis**: The agent looks at policies that correspond to key scenarios to identify outlier policies that have more than a recommended number of exceptions (leading to unexpected gaps in coverage) or no exceptions (leading to possible lockout).