Daily.Entra.News
Aboutmerill.net
← Previous day

Next day →
Day in brief

8 June 2025: Global Secure Access lockout guidance and a new Internet Access bypass sample stand out amid a documentation-heavy refresh

The supplied period is dominated by Microsoft Learn maintenance: 453 updates, 14 new items, no removals, and no Message Center notices. The clearest operational issue is a Global Secure Access tunnel-authorization limitation that can make a Conditional Access block on a forwarding profile lock users out of their machines. A new PowerShell sample provides an Internet Access bypass-rule pattern. Other notable updates cover Entra Health and Security Copilot SLA reporting, MFA health signals, and External ID custom sign-in domains. The supplied evidence identifies no specific preview, general-availability launch, retirement, or confirmed product behavior change.

  • Global Secure Access · Conditional Access
    Security guidance: Global Secure Access forwarding-profile blocks can cause lockouts

    An updated Global Secure Access page states that tunnel-authorization limitations mean a Conditional Access policy blocking a forwarding profile can inadvertently prevent users from accessing anything on their machine. This is a configuration-risk clarification, not a new feature or retirement.

  • Internet Access · General
    New documentation sample: add an Internet Access custom bypass rule

    A new PowerShell sample shows how to bypass a specified FQDN or IP address from being acquired by the GSA Client in the Internet Access forwarding profile. It is an implementation example, not evidence that a new service capability or availability change shipped.

  • Security Copilot · Authentication
    Updated scenario guidance: Security Copilot and Entra authentication SLA reporting

    The updated Copilot Entra Security Scenarios page describes Microsoft Entra Health's monthly SLA Attainment look-back for core Microsoft Entra ID authentication availability and says Security Copilot interacts with the SLA through Microsoft Graph API. The record supports a documentation update, not a newly announced SLA or Copilot launch.

  • Entra ID · Authentication
    Ordinary documentation update: Entra Health signals for MFA-required sign-ins

    An updated Entra ID page covers the Microsoft Entra Health signals and alerts for sign-ins that require Microsoft Entra MFA. The supplied evidence does not indicate that new alerts, settings, or policy behavior were introduced.

  • External ID · Authentication
    Ordinary documentation update: External ID custom URL domains

    Updated External ID guidance covers setting up custom URL domains to personalize authentication sign-in endpoints for external customers and consumers of an app. No new rollout, changed behavior, or additional requirement is identified in the supplied record.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

467 updates

Authentication

155

Use Custom Domain Url

Updated

Use a custom domain to fully brand the authentication URL. From a user perspective, users remain on your domain during the authentication process, rather than being redirected to *ciamlogin.com* domain name.

Web App Quickstart Portal Node Js

Updated

In this quickstart, you learn how to implement authentication with a Node.js web app and the Microsoft Authentication Library (MSAL) for Node.js.

Mfa Data Residency

Updated

Microsoft Entra ID stores customer data in a geographical location based on the address an organization provides when subscribing to a Microsoft online service such as Microsoft 365 or Azure. For information on where your customer data is stored, see [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) in the Microsoft Trust Center.

Quickstart V2 Java Webapp

Updated

In this quickstart, you'll learn how to add sign-in with Microsoft to a Java web application by using OpenID Connect.

Web App Quickstart Portal Java

Updated

In this quickstart, you'll learn how to add sign-in with Microsoft to a Java web application by using OpenID Connect.

General

52

Tutorial Create Forest Trust

Updated

Learn how to create a one-way outbound forest to an on-premises AD DS domain in the Microsoft Entra admin center for Microsoft Entra Domain Services

Microsoft identity platform

15

Desktop Quickstart Portal Uwp

Updated

In this quickstart, learn how a Universal Windows Platform (UWP) application can get an access token and call an API protected by Microsoft identity platform.

Mark an app as publisher verified

Updated

Describes how to mark an app as publisher verified. When an application is marked as publisher verified, it means that the publisher (application developer) verified the authenticity of their organization using a Cloud Partner Program (CPP) account that completed the verification process and associated this CPP account with that application registration.

Publisher verification overview

Updated

Learn about benefits, program requirements, and frequently asked questions in the publisher verification program for the Microsoft identity platform.

Quickstart V2 Java Daemon

Updated

In this quickstart, you learn how a Java app can get an access token and call an API protected by Microsoft identity platform endpoint, using the app's own identity

Web Api Quickstart Portal Aspnet Core

Updated

In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET Core web API by using the Microsoft identity platform for authorization.

Web App Quickstart Portal Python

Updated

In this quickstart, learn how a Python web app can sign in users, get an access token from the Microsoft identity platform, and call the Microsoft Graph API.

Developer

14

Application Proxy Configure Cookie Settings

Updated

Microsoft Entra ID uses access and session cookies to access on-premises applications through application proxy. This article explains how to use and configure the cookie settings.

Deploy Azure App Proxy

Updated

With Microsoft Entra Domain Services, you can lift-and-shift legacy applications running on-premises into Azure. Microsoft Entra application proxy then helps you support remote workers by securely publishing those internal applications part of a Domain Services managed domain so they can be accessed over the internet.

Spa Quickstart Portal Javascript Auth Code

Updated

In this quickstart, learn how a JavaScript single-page application (SPA) can sign in users of personal accounts, work accounts, and school accounts by using the authorization code flow.

Spa Quickstart Portal Javascript Auth Code Angular

Updated

In this quickstart, learn how a JavaScript Angular single-page application (SPA) can sign in users of personal accounts, work accounts, and school accounts by using the authorization code flow and call Microsoft Graph.

Spa Quickstart Portal Javascript Auth Code React

Updated

In this quickstart, learn how a JavaScript React single-page application (SPA) can sign in users of personal accounts, work accounts, and school accounts by using the authorization code flow and call Microsoft Graph.

Fundamentals

10

Troubleshooting

7

Conditional Access

5

Troubleshoot Conditional Access

Updated

1. **Conditional Access** to see policy failure and success. Scope your filter to show only failures to limit results.

Provisioning

5

Connect Install Existing Database

Updated

- Except for credentials information, the synchronization configuration stored in the ADSync database is automatically recovered and used during installation. This includes custom synchronization rules, connectors, filtering, and optional features configuration.

Security

5

Web App Role Based Access Control

Updated

Learn how to configure groups and user roles in your external tenant, so you can receive them as claims in a security token for your Node.js application

Monitoring

3

Standards

1

Authentication

1

General

73

Migrate Users

Updated

Learn how to migrate users from another identity provider to Microsoft Entra External ID.

About Redirect Url

Updated

A Microsoft Entra documentation page was updated: About Redirect Url.

Add Client App Certificate

Updated

To use your client app certificate, you need to associate the app you registered in the Microsoft Entra admin center with the certificate:

Applies To External Only

Updated

**Applies to**: ![White circle with a gray X symbol.](../media/common/applies-to-no.png) Workforce tenants ![Green circle with a white check mark symbol.](../media/common/applies-to-yes.png) External tenants ([learn more](../tenant-configurations.md))

Applies To Workforce Only

Updated

**Applies to**: ![Green circle with a white check mark symbol.](../media/common/applies-to-yes.png) Workforce tenants ![White circle with a gray X symbol.](../media/common/applies-to-no.png) External tenants ([learn more](../tenant-configurations.md))

B2b Quickstart Add Guest Users Portal

Updated

Use this quickstart to learn how Microsoft Entra admins can add B2B guest users in the Microsoft Entra admin center and walk through the B2B invitation workflow.

B2c Federation Customers

Updated

Learn how to configure an Azure AD B2C tenant as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Create an External Tenant

Updated

Create an external tenant to get started with Microsoft Entra External ID as your customer identity and access management (CIAM) service.

Declare App Roles

Updated

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Privileged Role Administrator](../../../../identity/role-based-access-control/permissions-reference.md#privileged-role-administrator).

Quickstart - Get started

Updated

Learn how to get started with Microsoft Entra External ID. Customize your apps' look and feel, set up a user to test the sign-up flow, and configure a sample app in just a few minutes.

Register Daemon App

Updated

The following steps show you how to register your daemon app in the Microsoft Entra admin center:

Service Limits

Updated

Learn about the service limits and restrictions in an external tenant.

User Permissions

Updated

Learn about the default permissions for users in an external tenant.

Authentication

28

Custom Url Domain

Updated

Learn about setting up custom URL domains to personalize the authentication sign-in endpoints for the external customers and consumers of your app.

Custom Url Domain

Updated

Learn how to set up custom URL domains to personalize the authentication sign-in endpoints for the external customers and consumers of your app.

Customize Languages Customers

Updated

Learn about how to customize the browser language for your app's authentication experience to provide a personalized sign-in.

Enable Native Authentication

Updated

To specify that this app is a public client and can use native authentication, enable public client and native authentication flows:

Multifactor Authentication Customers

Updated

Learn how to add multifactor authentication (MFA) to your consumer and business customer (CIAM) application. For example, add email one-time passcode as a second authentication factor to your CIAM sign-up and sign-in user flows.

Native Authentication

Updated

Learn how to set up native authentication in Microsoft Entra External ID. Customize the user interface for mobile and desktop apps, and provide a seamless sign-in experience.

Test User Flow

Updated

To test a [user flow](/entra/external-id/customers/how-to-user-flow-sign-up-sign-in-customers) with this app registration, enable the implicit grant flow for authentication.

Use Custom Domain Url Python

Updated

Use a custom URL domain to fully brand the authentication URL. From a user perspective, users remain on your domain during the authentication process, rather than being redirected to *ciamlogin.com* domain name.

Add App Role

Updated

An API needs to publish a minimum of one app role for applications, also called [Application permission](~/identity-platform/permissions-consent-overview.md), for the client apps to obtain an access token as themselves. Application permissions are the type of permissions that APIs should publish when they want to enable client applications to successfully authenticate as themselves and not need to sign-in users. To publish an application permission, follow these steps:

Add App User Flow

Updated

For the customer users to see the sign-up or sign-in experience when they use your app, you need to associate your app with a user flow. Although many applications can be associated with your user flow, a single application can only be associated with one user flow.

Define Custom Attributes

Updated

Learn how to create and define new custom attributes to be collected from users during sign-up and sign-in.

Grant Api Permission Sign In

Updated

Once you register your application, it gets assigned the **User.Read** permission. However, since the tenant is an external tenant, the customer users themselves can't consent to this permission. You as the tenant administrator must consent to this permission on behalf of all the users in the tenant:

Quickstart Tenant Setup

Updated

In this quickstart, learn how to create an external tenant for customer identity and access management (CIAM). Customize a sign-in experience and try it out with a sample app.

Test User Flows

Updated

Learn how to use the Run user flow feature to test your sign-up and sign-in user flow for your consumer and business customer apps.

User Flow Sign Up Sign In Customers

Updated

Add sign-up and sign-in user flows for your consumer and business customers. Create a branded, customized user experience for apps in your external tenant.

Visual Studio Code Extension

Updated

Learn how to use the Microsoft Entra External ID extension for Visual Studio Code. Use the application samples provided to set up a customized, branded sign-in experience for external users of your application without leaving the development environment.

Developer

25

Add App Client Secret

Updated

Create a client secret for the registered application. The application uses the client secret to prove its identity when it requests for tokens:

Add Attributes To Token

Updated

Learn how to add built-in user attributes and custom attributes as claims to the application token. Use directory extension attributes for sending user data to applications in token claims.

Add Mfa Api App Client Secret

Updated

Create a client secret for the registered application. The application uses the client secret to prove its identity when it requests for tokens.

Add Optional Claims Access

Updated

You can add the **idtyp** optional claim to help the web API to determine whether a token is an **app** token or an **app + user** token. Although you can use a combination of **scp** and **roles** claims for the same purpose, using the **idtyp** claim is the easiest way to tell an app token and an app + user token apart. For example, the value of this claim is *app* when the token is an app-only token.

Assign Users Groups Roles

Updated

Once you've added app roles in your application, administrator can assign users and groups to the roles. Assignment of users and groups to roles can be done through the admin center, or programmatically using [Microsoft Graph](/graph/api/user-post-approleassignments). When the users assigned to the various app roles sign in to the application, their tokens have their assigned roles in the `roles` claim.

Facebook Federation Customers

Updated

Learn how to add Facebook as an identity provider for your external tenant, enabling customers to sign in to your applications using their Facebook accounts.

Find Application Id

Updated

A Microsoft Entra documentation page was updated: Find Application Id.

Group App Roles Support

Updated

Find out which core Microsoft Entra features related to the user and group management model and application assignment are available in external tenants.

Read Id Token Claims Android Kotlin

Updated

Once your app acquires an ID token, you can retrieve the claims associated with the current account. To do so, use the following code snippet.

Samples Ciam All

Updated

Learn how to build and integrate apps with external tenants with scenarios such as sign-up, sign in, and getting an access token to call an API.

Use App Roles Customers

Updated

Learn how to define application roles for your consumer and business customer applications and assign those roles to users and groups in external tenants.

User Insights

Updated

Learn about how to analyze user activity and engagement for your registered application in the external tenant.

Fundamentals

18

Add Member To Group

Updated

Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.yml#create-a-basic-group-and-add-members).

Add Api Mfa Scopes

Updated

An API needs to publish a minimum of one scope, also called [Delegated Permission](~/identity-platform/permissions-consent-overview.md), for the client apps to obtain an access token for a user successfully. To publish a scope, follow these steps:

Add Api Scopes

Updated

An API needs to publish a minimum of one scope, also called [Delegated Permission](~/identity-platform/permissions-consent-overview.md), for the client apps to obtain an access token for a user successfully. To publish a scope, follow these steps:

Guide Explained

Updated

Learn about the features you set up with the get started guide.

Solutions Customers

Updated

Learn about the customer identity and access management solutions for your consumer and business customer apps that are provided by Microsoft Entra External ID.

Supported Features Customers

Updated

Compare features and capabilities of a workforce vs. an external tenant configuration. Determine which tenant type applies to your external identities scenario.

User Attributes

Updated

User profile attributes that you can collect from the user during sign-up, and how to extend user profile attributes by using custom user attributes.

Microsoft identity platform

16

Grant Api Access App

Updated

For your application to access data in Microsoft Graph API, grant the registered application the relevant application permissions. The effective permissions of your application are the full level of privileges implied by the permission. For example, to create, read, update, and delete every user in your external tenant, add the User.ReadWrite.All permission.

Grant Api Permission Call Api Common

Updated

1. From the **App registrations** page, select the application that you created (such as *ciam-client-app*) to open its **Overview** page.

Grant Api Permission Edit Profile

Updated

1. From the **App registrations** page, select the application that you created (such as *edit-profile-service*) to open its **Overview** page.

Register Api App

Updated

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](~/identity/role-based-access-control/permissions-reference.md#application-developer).

Register Mfa Api App

Updated

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](~/identity/role-based-access-control/permissions-reference.md#application-developer).

Standards

5

Custom Oidc Federation Customers

Updated

Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Register Saml App

Updated

Learn how to create and register a SAML app with External ID for customer identity and access management (CIAM). Choose your app type and get detailed steps.

Set up claims mapping for OIDC

Updated

Learn how to configure the standard OpenID Connect claims with the claims your identity provider provides in your external tenant.

Monitoring

2

Conditional Access

1

Security

1

Troubleshooting

1

General

2

General

2

Ciphers

Updated

Learn about the supported cryptographic algorithms, or ciphers, used for Microsoft Entra Private Access.

Enable Multi Geo

Updated

Learn how to enable Multi-Geo Capability for Microsoft Entra Private Access to optimize traffic flow from Microsoft Entra Clients to Microsoft Entra Apps.

General

1

Troubleshooting

1

General

11

China User Support

Updated

Learn about how Microsoft is dedicated to supporting Global Secure Access capabilities in China.

Create Remote Networks

Updated

Learn how to create remote networks, for remote locations such as branch offices, for Global Secure Access.

Troubleshooting

4

Conditional Access

1

Powershell Add Ia Devicecompliance Bypasses

Updated

The [Universal Conditional Access documentation](../concept-universal-conditional-access#known-tunnel-authorization-limitations) notes that Global Secure Access has tunnel authoriziation limitations. This means that you can block access to a forwarding profile in Conditional Access and inadvertenty lock users out from accessing anything on their machine.

Developer

1

Authentication

1

Copilot Entra Security Scenarios

Updated

Microsoft Entra Health provides look-back reporting on Service Level Agreements (SLA) for authentication availability for your Microsoft Entra tenant. The SLA Attainment is a monthly look-back solution that shows the core authentication availability of Microsoft Entra ID each month. IT admins often need to review the SLA reports in conjuntion with service outages. Security Copilot interacts with the Microsoft Entra SLA using the Microsoft Graph API.

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…