Fundamentals

Entitlement Management Overview

The page replaces the Mississippi Division of Medicaid customer example with the Digital Security and Resilience team at Microsoft and updates the accompanying wording and link.

Entitlement Management Overview

The entitlement management overview removes “preview” from references to assigning groups and API permissions to agents, and from the related license-requirements heading.

Identity Governance Overview

The overview heading and linked page title now refer to “Identity governance for agent identities” and “Governing agent identities,” with the “preview” label removed.

My Access Portal Overview

The overview’s guidance on managing agent identities and viewing their access and activity information was updated.

Usage and insights report

The documentation now explains that reported last activity can include incomplete sign-ins absent from sign-in logs. A timestamp does not confirm successful authentication or token issuance, and some partial activity may be misclassified as app-only during preview.

Web Filtering

The documentation now consistently labels the Continue default action as “in preview” and describes how unmatched traffic passes to the next applicable security profile.

Web filtering in Global Secure Access (V2)

The documentation now explains that Continue is a preview default action used when no enabled enforcement rule matches. It passes evaluation to the next applicable security profile in priority order, while Allow and Block stop V2 evaluation. It also adds cross-profile examples and clarifies Baseline and V1 behavior.

Cross Tenant Synchronization Overview

The documentation now states that direct cross-tenant user synchronization requires Microsoft Entra ID P1, while synchronizing a group and its members requires Microsoft Entra ID Governance or Microsoft Entra Suite for each synchronized user in the source tenant.

What are risk detections?

The documentation now lists the `suspiciousCredentialAddition` risk event type instead of `TBD` and revises the detection description. Metadata and customer intent were also updated.

What are risk detections?

The documentation now describes a real-time Identity Protection detection for suspiciously added authentication methods. It raises user risk and can trigger configured risk-based policies; the page lists Microsoft Entra ID P2 as required, pending confirmation.

What Is Cloud Sync

The page now directs Connect Sync users to review the decision guide, validate guided-tool prerequisites, and choose a supported guided or manual migration path. It also links the migration FAQ and separates Device Sync review from guided-tool eligibility.

Microsoft Entra ID Governance licensing fundamentals

The documentation now lists P1 with Microsoft 365 E3, E5, or E7; P2 with E5 or E7; and Governance capabilities with Microsoft Entra Suite and Microsoft 365 E7. The agent identity licensing reference was also updated.

Security Defaults

The Security Defaults article no longer includes the section describing individual protections, their preview availability, roles, behavior, and management steps.

Identity Protection Risks

The risk detection table now lists Atypical travel as “Real-time” instead of “Offline.” Its Premium requirement and unlikelyTravel identifier are unchanged.

Provision On Demand

Step 1 now links to the permissions reference anchor without the `.md` suffix.

Cross Tenant Access Overview

The overview now states that a Microsoft Entra ID P1 license is required on the configured tenant to change the default redemption order, in addition to configuring trust or scoped access settings.

Cross Tenant Access Overview

The documentation now states that changing the default redemption order, like configuring trust or access settings, requires Microsoft Entra ID P1 on the configured tenant.

2) Detect browsers via registry only

The PowerShell prompt now correctly refers to the `IPv4Preferred` registry key instead of `IPv4Preffered`.

AI agent discovery in Global Secure Access (preview)

The page no longer includes the `author` and `ms.author` metadata fields.

Generative AI Insights in Global Secure Access (preview)

The documentation no longer includes the `author` and `ms.author` fields.

Identity Protection Unified Risk

The page no longer includes the `ms.author` and `author` metadata fields.

Learn about Secure Web and AI Gateway for Microsoft Copilot Studio agents

The article metadata field was corrected from `ms.reviwer` to `ms.reviewer`; the topic classification remains unchanged.

Microsoft Entra Health

Corrected a spelling error and updated punctuation in the Microsoft Entra Health article.

What is a Microsoft Entra hybrid joined device?

The article now explains that Microsoft Entra Cloud Sync can synchronize Active Directory computer objects to Microsoft Entra ID for hybrid join and links to configuration guidance.

What is Microsoft Entra Cloud Sync?

The article now explains that enabled device synchronization can sync Active Directory computer objects to Microsoft Entra ID so devices can become hybrid joined, and links to configuration steps.

Zero Trust Ai

The page no longer includes the ms.author, author, or manager metadata fields.

Configure Security

The documentation link was updated from guidance for all multitenant applications to guidance for all applications.

Overview of Microsoft Entra role-based access control (RBAC)

The documentation now says app instance property lock can be enabled for both single-tenant and multitenant apps.

Zero Trust Protect Tenants

The documentation now says the lock is configured for all applications, rather than all multitenant applications.

Adsync Service Account

The table now explicitly labels Group Managed Service Account (gMSA) and Standalone Managed Service Account (sMSA), with corresponding installation guidance.

Provision On Demand

The sign-in step now lists Application Owners alongside Application Administrators as acceptable roles for accessing the Microsoft Entra admin center.

Connectors

The documentation specifies non-overlapping dynamic TCP ports 49152–65535 and AutoReuse TCP ports 10000–49151, with new configuration and verification commands. It also adds Windows Server 2016+ prerequisites and clarifies that AutoReuse applies only to TCP.

Groups Concept

The guidance now directs administrators to the Exchange admin center for role assignments through dynamic membership groups. If the old Exchange admin center is required, assign the eligible role directly to the user rather than through role-assignable groups; Exchange PowerShell cmdlets work as expected.

Guidance for using Group Source of Authority (SOA) in Microsoft Entra ID

The guidance now links to updated Microsoft Entra Cloud Sync documentation for provisioning groups to Active Directory and nested-group membership behavior. Page metadata was also refreshed.

Microsoft Entra provisioning options (Preview)

A new article explains groups-only, users-only, and users-and-groups provisioning from Microsoft Entra ID to AD DS. User provisioning is in preview, while group provisioning is generally available; it also documents per-domain configuration limits and performance guidance.

Provision Entra Id To Active Directory

The documentation now states that password writeback isn't supported for applications that collect passwords, including applications that authenticate users through an LDAP bind.

Provision Entra Id To Active Directory

The guidance now specifies that password-based apps, including LDAP-authenticated apps, must be updated to Kerberos for cloud-managed users to use passwordless authentication.

Provision Microsoft Entra ID objects to AD

The new overview describes how Cloud Sync provisions users, groups, and memberships from Microsoft Entra ID to AD, including supported configurations, user types, attribute updates, enforcement, and provisioning flow. User provisioning is in preview, while group provisioning is generally available; password writeback isn't supported.

Source Of Authority Overview

The article’s introductory wording and references were updated, including the link to cloud-first identity management guidance. The described Group SOA and group replication steps remain unchanged.

Transfer user SOA to Microsoft Entra ID

The article now describes provisioning Microsoft Entra-managed users back to Active Directory with Cloud Sync so they can access Kerberos-based on-premises applications while their lifecycle is governed from the cloud. It also updates passwordless authentication guidance and diagrams.

Pim For Groups

The documentation now states that credential protection covers group members and owners, including eligible members and owners who have not yet activated.

Pim For Groups

The role-assignable groups description now includes members and owners, including eligible members and owners who have not activated their assignments.

Continuous Access Evaluation

The Continuous Access Evaluation documentation no longer includes the note that SharePoint Online doesn't support user risk events.

Global Secure Access traffic forwarding profiles

Global Secure Access now documents a default Private Access profile plus up to 10 custom profiles during preview. Profiles can target users, groups, devices, and device platforms, with priority determining which applicable profile the client uses.

Reconciliation overview - Microsoft Entra ID Governance

The overview describes access drift, account discovery, access package drift detection, and enforcement and remediation approaches for aligning resource access with governance policies.

Learn about Universal Continuous Evaluation

The documentation now covers preview device signals for deleted, disabled, or noncompliant devices. It also specifies reauthentication through a GSA client notification and tunnel disconnection after two minutes if reauthentication is incomplete.

Web filtering in Global Secure Access (V2)

The documentation now describes a preview Continue Evaluation default action. Unmatched traffic can pass to the next applicable security profile, while matching rules and Allow or Block stop evaluation. The Baseline Profile must use Allow or Block.

Connect Install Roadmap

The page now directs administrators to Microsoft Entra Connect Health in the Microsoft Entra admin center and documents updated navigation for Sync, AD FS, AD DS, settings, troubleshooting, and support. It also clarifies that agents must be installed before monitoring data appears.

Licensing

The page now lists the Microsoft Agent 365 Licensing FAQs and governance relationships links without the previous section heading and introductory text.

Microsoft Entra ID Governance licensing fundamentals

The licensing fundamentals page was updated to align the Account Discovery section and state that the feature requires the Microsoft Entra ID Governance add-on or Microsoft Entra Suite.

Generative Ai Insights

The documentation now refers to “Microsoft Copilot” instead of “Microsoft 365 Copilot.”

Manage User Profile Info

The user profile information guidance no longer includes the “Manage user feature settings” reference.

Manage User Profile Info

The user profile information documentation no longer includes guidance that users can use My Apps preview features or that administrators can access My Staff.

What is Transport Layer Security Inspection?

The documentation now provides separate links for configuring TLS inspection with a Microsoft-managed certificate and with your own certificate.

Deployment Options Provision To Active Directory

The article comparing group-only, user-only, and users-and-groups provisioning from Microsoft Entra ID to Active Directory was deleted, including guidance on scoping, configuration limits, and performance.

Group Source Of Authority Guidance

The guidance now links to the group provisioning tutorial and its updated section on nested groups and membership references.

Provision Entra Id To Active Directory

The documentation page describing Microsoft Entra Cloud Sync provisioning of users, groups, and memberships from Entra ID to Active Directory was deleted.

Source Of Authority Overview

The guidance for recreating AD DS groups as cloud security groups, provisioning them as Universal groups, and updating applications to use their new security identifiers was revised.

Group Source Of Authority Guidance

The guidance now links to the Microsoft Entra ID-to-Active Directory provisioning overview and its nested group membership behavior section.

Microsoft Entra provisioning options (Preview)

A new article compares groups-only, users-only, and users-and-groups provisioning through scoping filters. It also documents availability, domain and tenant configuration limits, and performance guidance.

Provision Microsoft Entra ID objects to AD

A new overview explains how Cloud Sync provisions users, groups, and memberships from Microsoft Entra ID to on-premises AD, including supported scenarios, configuration options, synchronization behavior, and limitations. User provisioning is in preview; group provisioning is generally available.

Source Of Authority Overview

The documentation now describes creating new cloud security groups in Microsoft Entra ID, provisioning them to AD DS as Universal groups, and updating applications to use the new group security identifiers.

Netskope Integration

The Netskope integration example now uses different values for the tenantId and userId fields.

Primary Refresh Token

The documentation now references the Chrome Windows 10 Accounts extension and Mozilla Firefox v91+ Windows SSO setting.

Understanding Lifecycle Workflows

The documentation now describes the Time based attribute V2 trigger, including Exactly, Less than or equal to, and Between comparisons with offsets from 0 to 180 days before or after a date attribute. It also documents that workflows and schedules must be enabled and that V2 has no three-day catch-up window.

Create New Tenant

The Governed Workforce tenant creation guidance now links the Microsoft Online Subscription Agreement and related billing agreement references.

Create New Tenant

The documentation now describes the requirement as an Enterprise Agreement (EA) or Pay-As-You-Go subscription and references MOSA and MCA billing agreements.

Create New Tenant

The documentation refreshes troubleshooting guidance for creating Governed Workforce tenants, including paid Azure subscription and billing-account requirements.

Deployment Guide

The secure tenant creation guidance now links the Microsoft Online Subscription Agreement (MOSA) reference alongside the existing Enterprise Agreement and Pay-As-You-Go links.

Deployment Guide

The deployment guide now refers to either a paid Enterprise Agreement or Pay-As-You-Go subscription and adds Microsoft Online Subscription Agreement terminology.

Deployment Guide

The secure tenant creation prerequisites were updated to clarify the required Azure Resource Manager permissions.

Quickstart - Access and create new tenant

The documentation now lists a paid Azure subscription associated with an Enterprise Agreement or pay-as-you-go billing account, replacing the previous MCA subscription requirement.

Secure add-on tenant creation

The page title no longer includes “(preview),” and the prerelease product notice was removed.

Lifecycle Workflow Tasks

The task now applies to both leaver and mover templates. For mover templates, scheduled removal defaults to 15 days; administrators can customize the timing or choose immediate removal.

Token Protection

The documentation now lists token protection for iOS/iPadOS and macOS as generally available. Supported web apps accessing Azure Resource Manager on macOS remain in preview.

Assign App Owners

The documentation now compares application owners with application administrators, stating that owners can manage only the enterprise applications they own and have equivalent permissions within that application scope.

Web filtering in Global Secure Access (V2)

The documentation now explains that V2 selects the first applicable profile containing a V2 policy, does not support user or group targeting on individual rules, and may produce different enforcement from V1 during migration.

Web Filtering

The web filtering documentation now links to an article explaining how to migrate web content filtering policies from V1 to V2.

Concepts Replica Sets

The documentation now states that replica sets require connectivity between all virtual networks hosting them. They are deployed in one Active Directory site and rely on a fully meshed virtual network topology for directory replication.

Inheritable Permissions

The page no longer includes a TODO questioning support for enumerated scopes versus `allAllowed`/`none`. The diff provides no evidence of a product or feature change.

Key Concepts

The key concepts page now labels the link “Microsoft Entra Agent ID OAuth protocols” instead of “oauth protocols.”

Learn about the agent's user account in Microsoft Entra Agent ID

The document title was normalized by removing an extra space after the metadata colon. No substantive guidance or product behavior changed.

Security For Ai Overview

The documentation now expands MCP, A2A, and OBO on first use to improve clarity and retrievability.

Workload Identity Federation

The concept page now points to first-party tutorials for Google Cloud and SPIFFE/SPIRE scenarios instead of the previous links. No product feature change is indicated.

Web filtering in Global Secure Access (V2)

A new concept article documents the V2 web filtering model in Microsoft Entra Internet Access, including policies, rules, destination matching, and coexistence with V1 web content filtering.

Token Protection

The page now documents browser-based application support in Preview for selected web apps accessing Azure Resource Manager on Windows and macOS. iOS/iPadOS browser support is not supported. The page also adds requirements for supported browsers, extensions, operating systems, and configurations.

Licensing Agent Id

The documentation replaces standalone Entra licensing options for agents with guidance that Microsoft Agent 365 is required. It states that Agent 365 is included with Microsoft 365 E7 and available as an add-on to Microsoft E5, A5, Business Premium, or Defender Suite plus Purview Suite.

Token Protection

The Conditional Access token protection documentation now links to a deployment guide for web apps that access Azure Resource Manager. The linked guidance is marked Preview.

Quickstart - Access and create new tenant

Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.

Explicit Forward Proxy overview

Explicit Forward Proxy is a traffic acquisition mechanism that's useful in scenarios where installation of the Global Secure Access client is difficult or not possible. Explicit Forward Proxy helps protect internet traffic when users use browsers to access resources from:

Proxy Automatic Configuration Files

For unmanaged devices, you can instruct users to manually enter the PAC file location in browser settings or rely on a network-provided configuration. A network-provided configuration might be Dynamic Host Configuration Protocol (DHCP) or Web Proxy Auto-Discovery (WPAD).

External User Access

> [!TIP]

Primary Refresh Token

| **Term** | **Description** |

Cross Tenant Synchronization Overview

Ai Prompt Injection Protection

- [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md)

Unified risk signals in Microsoft Entra ID Protection

Learn how unified risk signals correlate identity risk across Microsoft Entra ID Protection and Microsoft Defender to calculate compounded user risk.

Archive for Microsoft Entra releases and announcements

The What's new release notes in the Overview section of this content set contain six months of activity. After six months, the items are removed from the main article and put into this archive article.

Configure Security

A Microsoft Entra documentation page was updated: Configure Security.

Customer data storage and processing for European customers in Microsoft Entra ID

Learn about where Microsoft Entra ID stores identity-related data for its European customers.

Customer data storage for Japan customers

Learn about where Microsoft Entra ID stores customer-related data for its Japan customers.

Frontline Worker Management

Learn about frontline worker management capabilities that are provided through the My Staff portal.

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

Microsoft Entra ID Governance licensing fundamentals

This article describes shows the licensing requirements for Microsoft Entra ID Governance features.

Microsoft Entra releases and announcements

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.

Migrate Group Writeback

- Cloud-created [security groups](../../../fundamentals/concept-learn-about-groups.md#group-types).

Operations

| --- | --- |

Overview

> [!IMPORTANT]

Operations

| Guide | What it covers |

Add Member To Group

Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.md#create-a-basic-group-and-add-members).

Bulk Operations

- [Bulk operations service limitations](bulk-operations-service-limitations.md)

Compare

|**Users**|||

Create New Tenant

- To add users, see [Add or delete a new user](./how-to-create-delete-users.md).

Delegate By Task

Here are the least privileged roles you should use when performing tasks for [groups](../../fundamentals/how-to-manage-groups.md) in Microsoft Entra ID.

Entra Admin Center

| Task | Description | Learn more |

Groups Concept

- [Create a role-assignable group](groups-create-eligible.md)

Groups Dynamic Membership

- [Manage Microsoft Entra groups and group membership](~/fundamentals/how-to-manage-groups.md)

How to manage groups

Instructions about how to create and update Microsoft Entra groups, such as membership and settings.

Learn About Groups

- For more information, see [Learn about Microsoft 365 Groups](https://support.office.com/article/learn-about-office-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2).

Manage User Profile Info

- [Add or delete users](how-to-create-delete-users.md)

Microsoft Entra releases and announcements

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.