Learn how to integrate an on-premises Power BI with Microsoft Entra application proxy.
Day in brief
Entra Connect’s upgrade safeguard and new Agent ID onboarding stand out in an otherwise Application Proxy-heavy documentation day
The 12 March feed is dominated by Microsoft Learn maintenance: a large set of updated Microsoft Entra Application Proxy PowerShell samples and integration guides. The clearest operational change is Entra Connect’s handling of servers with customized configuration files, while Agent ID receives new AI-assisted onboarding guidance covering blueprint creation, credentials, and identity provisioning. Separate updates add federated SSO certificate-rollover and Global Secure Access Secure Web Gateway guidance. The supplied evidence does not establish preview, general availability, retirement, or a tenant-wide rollout for these items.
- Entra Connect auto-upgrade now skips servers with modified configuration files
Entra ID · ProvisioningThe Connect Version History update describes changed upgrade behavior: auto-upgrade detects edits to `miiserver.exe.config` and `miisclient.exe.config` and skips automatic upgrade on those servers, addressing an issue in which auto-upgrade could stop the server unexpectedly. A manual upgrade can still fail when those files were previously modified, so the linked known-issues guidance remains relevant. This is an operational behavior change, not a retirement or availability announcement.
- Agent ID adds AI-guided onboarding documentation
Agent ID · ProvisioningNew Agent ID guidance describes using an AI coding agent, such as GitHub Copilot in VS Code Agent mode, to automate onboarding. The workflow includes blueprint creation, credential configuration, and agent identity provisioning. The evidence establishes new setup documentation, but does not identify the workflow as preview or generally available and is not evidence of a product launch.
- Application Proxy documentation refreshes its PowerShell operations runbook
Entra ID · DeveloperThe updated PowerShell sample set documents inventorying Application Proxy apps and private network connectors, assigning users and groups, and retrieving certificate information. Related examples cover connector-group moves, custom and default domains, wildcard publishing, token-lifetime policies, and bulk certificate replacement. These are documentation and scripting updates; the supplied evidence does not describe a new Application Proxy service capability.
- Federated SSO guidance emphasizes automated SAML certificate rollover
Entra ID · StandardsThe updated federated SSO certificate tutorial gives ISVs best practices for automated rollover as SAML certificates approach expiry. It notes that Entra signing certificates typically expire every one to three years and that customer and SaaS-provider coordination is needed to avoid downtime. This is security and operational guidance, not evidence that Entra changed certificate lifetimes or introduced automatic rollover.
- Global Secure Access documentation details SWG defense-in-depth and TLS checks
Global Secure Access · SecurityGlobal Secure Access Secure Web Gateway material describes five security layers forming an inspection chain for internet-bound traffic. Same-day pages frame checks around keeping TLS inspection failures below 1% and preventing custom bypass rules from duplicating system bypass destinations. This is security and configuration documentation; no new SWG availability milestone or behavior change is supplied.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
40 updates
Microsoft Entra ID
35 updatesIntegrate Microsoft Entra application proxy with Qlik Sense.
Learn how to configure application proxy with Remote Desktop Services (RDS)
PowerShell example that assigns a group to a Microsoft Entra application proxy application.
PowerShell example that assigns a user to a Microsoft Entra application proxy application.
PowerShell example that lists all the users and groups assigned to a specific Microsoft Entra application proxy application.
PowerShell example that lists Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), and object ID (ObjId).
PowerShell example that lists all Microsoft Entra private network connector groups with the assigned applications.
PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains but don't have a valid TLS/SSL certificate uploaded.
PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains and certificate information.
PowerShell example that lists all Microsoft Entra application proxy applications that are using default domains (.msappproxy.net).
PowerShell example that lists all Microsoft Entra application proxy applications that are using wildcards.
PowerShell example that lists all Microsoft Entra application proxy applications in your directory that have a lifetime token policy.
PowerShell example that bulk replaces a certificate across Microsoft Entra application proxy applications.
Get all Microsoft Entra application proxy apps that are published with the identical certificate
UpdatedPowerShell example that lists all Microsoft Entra application proxy applications that are published with the identical certificate.
Microsoft Entra application proxy PowerShell example used to move all applications currently assigned to a connector group to a different connector group.
Use these PowerShell samples for Microsoft Entra application proxy to get information about application proxy apps and connectors in your directory, assign users and groups to apps, and get certificate information.
Use Microsoft Entra application proxy to access your on-premises application through Microsoft Teams.
Learn how to use Microsoft Entra application proxy to provide remote access for your Tableau deployment.
author: HULKsmashGithub
author: HULKsmashGithub
author: HULKsmashGithub
PowerShell example that lists all Microsoft Entra private network connector groups and connectors in your directory.
Support header-based authentication with PingAccess and Microsoft Entra application proxy.
PowerShell example that lists all Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), external URL (ExternalUrl), internal URL (InternalUrl), and authentication type (ExternalAuthenticationType).
- Store refresh tokens in encrypted, platform‑protected storage.
Learn how to restore a deleted group, view restorable groups, and permanently delete a group in Microsoft Entra ID.
How to add Web Application Firewall (WAF) protection for apps published with Microsoft Entra application proxy.
Learn how to use Microsoft Entra application proxy to protect your Network Device Enrollment Service (NDES).
Configure Security
Updated| [TLS inspection is enabled and correctly configured for outbound traffic](zero-trust-protect-networks.md#tls-inspection-is-enabled-and-correctly-configured-for-outbound-traffic) | Microsoft Entra ID P1 |
Zero Trust Protect Networks
UpdatedA Microsoft Entra documentation page was updated: Zero Trust Protect Networks.
Learn how to integrate an on-premises SharePoint farm with Microsoft Entra application proxy using Security Assertion Markup Language (SAML).
This section will outline best practices independent software vendors (ISV’s) can adopt to enable automated certificate rollover when SAML certificates are near expiry and when applications federated with Microsoft Entra ID. SAML certificates in Entra ID are used for signing assertions in federated single sign-on (SSO). These certificates expire (typically every 1-3 years) and rotation requires a Customer and SaaS ISV coordination to update a mutual certificate in both systems without downtime. Industry trends are shortening certificate lifetimes, manual rollover processes increasingly create operational burden and risk service disruption — especially in large organizations with many SAML enterprise applications.
Use Microsoft Defender for Cloud Apps with on-premises applications in Microsoft Entra ID. Use the Defender for Cloud Apps Conditional Access App Control to monitor and control sessions in real-time based on Conditional Access policies. You apply these policies to on-premises applications that use application proxy in Microsoft Entra ID.
Connect Version History
Updated- Fixed a [known issue](#known-issue-synchronization-fails-after-upgrade-if-miiserverexeconfig-was-previously-modified) where auto-upgrade could stop your Microsoft Entra Connect server unexpectedly. Auto-upgrade now detects modifications to the `miiserver.exe.config` and `miisclient.exe.config` configuration files and skips automatic upgrade on those servers. If you manually upgrade and previously modified these configuration files, you might encounter installation failures. To resolve the issue, see the [known issues section](#known-issue-synchronization-fails-after-upgrade-if-miiserverexeconfig-was-previously-modified).
Microsoft Entra Agent ID
4 updatesAgent Id Setup Instructions
Updated- Execute each step **sequentially** and don't skip ahead.
Agent Id Ai Guided Setup
Updatedauthor: arlucaID
This file is used by an AI coding agent (such as GitHub Copilot in VS Code Agent mode) to automate onboarding to Microsoft Entra Agent ID.
Use an AI coding agent to automate the onboarding process for Microsoft Entra Agent ID, including blueprint creation, credential configuration, and agent identity provisioning.
27014
UpdatedThe Global Secure Access Secure Web Gateway (SWG) implements defense-in-depth through five security layers that together create a comprehensive inspection chain for internet-bound traffic. Each layer serves a distinct protective function: