Thursday, 29 May 2025

Learn best practices for migrating Source of Authority (SOA) from Active Directory to Microsoft Entra ID, including prerequisites, supported scenarios, and step-by-step guidance for IT Architects and Administrators.

- *Who are the owners of the Finance Department group?*

**Type:** New feature

To access the data from Usage and insights you must have:

author: shlipsey3

* The [**audit logs activity report**](concept-audit-logs.md) gives you access to the history of every task performed in your tenant.

author: MicrosoftGuyJFlo

Reviewing the data in the Microsoft Entra activity logs can provide helpful information for IT administrators. To streamline the process of reviewing data on key scenarios, we've created several reports on common scenarios that use the activity logs.

A Microsoft Entra documentation page was updated: Source Of Authority Overview.

A Microsoft Entra documentation page was updated: Whats New.

Learn how to add a redirect URI to your application in Microsoft Entra to securely handle authentication tokens and enhance app security.

:::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/validation-error.png" alt-text="Screenshot of a certificate validation error." :::

:::image type="content" border="true" source="media/how-to-authentication-track-linkable-identifiers/search-token-id.png" alt-text="Screenshot of log line with linkable identifiers.":::

Once your default sign-in experience is created, select the **Edit** button to make any changes. You can't delete a default sign-in experience after it's created, but you can remove all custom settings.

As a developer, you want to run automated integration tests on the apps you develop. Calling your API protected by Microsoft identity platform (or other protected APIs such as [Microsoft Graph](/graph/)) in automated integration tests is a challenge. Microsoft Entra ID often requires an interactive user sign-in prompt, which is difficult to automate. This article describes how you can use a non-interactive flow, called [Resource Owner Password Credential Grant (ROPC)](v2-oauth-ropc.md), to automatically sign in users for testing.

1. In the owner tenant, use the [Update-MgTenantRelationshipMultiTenantOrganization](/powershell/module/microsoft.graph.identity.signins/update-mgtenantrelationshipmultitenantorganization) command to create your multitenant organization. This operation can take a few minutes.

**Request**

>[!IMPORTANT]

The email notifications provide a basic summary of the specific recommendation with a link to the related area of the Microsoft Entra admin center. The email also includes a link to related documentation so you can learn more about the recommendation and how to resolve it. These emails are enabled by default, aren't promotional or marketing emails, and don't contain any upselling content. These emails are purely informational and designed to help you act quickly when a new recommendation is available.

A Microsoft Entra documentation page was updated: Howto Stream Logs To Event Hub.

A Microsoft Entra documentation page was updated: Howto Use Workbooks.

There are two endpoints for the Microsoft Graph API. The V1.0 endpoint is the most stable and is commonly used for production environments. The beta version often contains more properties, but they're subject to change. For this reason, we don't recommend using the beta version of the schema in production environments.

author: shlipsey3

author: shlipsey3

Workload identity risk in Microsoft Entra ID Protection

As mentioned, custom extensions created with the request workflow type, which includes four associated policy stages, can be enabled with “*Launch and wait*” if desired.

This article serves as a reference for Microsoft Entra ID behavior when assignment periods of an access package and PIM policy dont allign.

1. Verify the Access Package expiration period doesn't exceed the **Expire eligible assignments after** setting in the PIM managed group.

manager: femila

> [!NOTE]

1. Select **Save changes**.

- Cross-tenant access partner configurations

- **Do you need to override broad block or allow policies for certain users or specific circumstances?** If you want to allow specific users or groups to access a blocked website, consider testing the [Allow a user to access a blocked website](gsa-poc-internet-access.md#allow-a-user-to-access-a-blocked-website) use case.

[Universal tenant restrictions](../global-secure-access/how-to-universal-tenant-restrictions.md) enable you to control access to external tenants by unmanaged identities on company-managed devices and networks. You can enforce this restriction with Entra ID Tenant Restrictions, by either blocking or allowing all traffic to an external tenant.

|Use case|Recommended configuration|

manager: femila

author: HULKsmashGithub