Fundamentals

Group Source Of Authority Guidance

The guidance now links to the Microsoft Entra ID-to-Active Directory provisioning overview and its nested group membership behavior section.

Microsoft Entra provisioning options (Preview)

A new article compares groups-only, users-only, and users-and-groups provisioning through scoping filters. It also documents availability, domain and tenant configuration limits, and performance guidance.

Provision Microsoft Entra ID objects to AD

A new overview explains how Cloud Sync provisions users, groups, and memberships from Microsoft Entra ID to on-premises AD, including supported scenarios, configuration options, synchronization behavior, and limitations. User provisioning is in preview; group provisioning is generally available.

Source Of Authority Overview

The documentation now describes creating new cloud security groups in Microsoft Entra ID, provisioning them to AD DS as Universal groups, and updating applications to use the new group security identifiers.

Netskope Integration

The Netskope integration example now uses different values for the tenantId and userId fields.

Primary Refresh Token

The documentation now references the Chrome Windows 10 Accounts extension and Mozilla Firefox v91+ Windows SSO setting.

Understanding Lifecycle Workflows

The documentation now describes the Time based attribute V2 trigger, including Exactly, Less than or equal to, and Between comparisons with offsets from 0 to 180 days before or after a date attribute. It also documents that workflows and schedules must be enabled and that V2 has no three-day catch-up window.

Create New Tenant

The Governed Workforce tenant creation guidance now links the Microsoft Online Subscription Agreement and related billing agreement references.

Create New Tenant

The documentation now describes the requirement as an Enterprise Agreement (EA) or Pay-As-You-Go subscription and references MOSA and MCA billing agreements.

Create New Tenant

The documentation refreshes troubleshooting guidance for creating Governed Workforce tenants, including paid Azure subscription and billing-account requirements.

Deployment Guide

The secure tenant creation guidance now links the Microsoft Online Subscription Agreement (MOSA) reference alongside the existing Enterprise Agreement and Pay-As-You-Go links.

Deployment Guide

The deployment guide now refers to either a paid Enterprise Agreement or Pay-As-You-Go subscription and adds Microsoft Online Subscription Agreement terminology.

Deployment Guide

The secure tenant creation prerequisites were updated to clarify the required Azure Resource Manager permissions.

Quickstart - Access and create new tenant

The documentation now lists a paid Azure subscription associated with an Enterprise Agreement or pay-as-you-go billing account, replacing the previous MCA subscription requirement.

Secure add-on tenant creation

The page title no longer includes “(preview),” and the prerelease product notice was removed.

Lifecycle Workflow Tasks

The task now applies to both leaver and mover templates. For mover templates, scheduled removal defaults to 15 days; administrators can customize the timing or choose immediate removal.

Token Protection

The documentation now lists token protection for iOS/iPadOS and macOS as generally available. Supported web apps accessing Azure Resource Manager on macOS remain in preview.

Assign App Owners

The documentation now compares application owners with application administrators, stating that owners can manage only the enterprise applications they own and have equivalent permissions within that application scope.

Web filtering in Global Secure Access (V2)

The documentation now explains that V2 selects the first applicable profile containing a V2 policy, does not support user or group targeting on individual rules, and may produce different enforcement from V1 during migration.

Web Filtering

The web filtering documentation now links to an article explaining how to migrate web content filtering policies from V1 to V2.

Concepts Replica Sets

The documentation now states that replica sets require connectivity between all virtual networks hosting them. They are deployed in one Active Directory site and rely on a fully meshed virtual network topology for directory replication.

Inheritable Permissions

The page no longer includes a TODO questioning support for enumerated scopes versus `allAllowed`/`none`. The diff provides no evidence of a product or feature change.

Key Concepts

The key concepts page now labels the link “Microsoft Entra Agent ID OAuth protocols” instead of “oauth protocols.”

Learn about the agent's user account in Microsoft Entra Agent ID

The document title was normalized by removing an extra space after the metadata colon. No substantive guidance or product behavior changed.

Security For Ai Overview

The documentation now expands MCP, A2A, and OBO on first use to improve clarity and retrievability.

Workload Identity Federation

The concept page now points to first-party tutorials for Google Cloud and SPIFFE/SPIRE scenarios instead of the previous links. No product feature change is indicated.

Web filtering in Global Secure Access (V2)

A new concept article documents the V2 web filtering model in Microsoft Entra Internet Access, including policies, rules, destination matching, and coexistence with V1 web content filtering.

Token Protection

The page now documents browser-based application support in Preview for selected web apps accessing Azure Resource Manager on Windows and macOS. iOS/iPadOS browser support is not supported. The page also adds requirements for supported browsers, extensions, operating systems, and configurations.

Licensing Agent Id

The documentation replaces standalone Entra licensing options for agents with guidance that Microsoft Agent 365 is required. It states that Agent 365 is included with Microsoft 365 E7 and available as an add-on to Microsoft E5, A5, Business Premium, or Defender Suite plus Purview Suite.

Token Protection

The Conditional Access token protection documentation now links to a deployment guide for web apps that access Azure Resource Manager. The linked guidance is marked Preview.

Quickstart - Access and create new tenant

Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.

Explicit Forward Proxy overview

Explicit Forward Proxy is a traffic acquisition mechanism that's useful in scenarios where installation of the Global Secure Access client is difficult or not possible. Explicit Forward Proxy helps protect internet traffic when users use browsers to access resources from:

Proxy Automatic Configuration Files

For unmanaged devices, you can instruct users to manually enter the PAC file location in browser settings or rely on a network-provided configuration. A network-provided configuration might be Dynamic Host Configuration Protocol (DHCP) or Web Proxy Auto-Discovery (WPAD).

External User Access

> [!TIP]

Primary Refresh Token

| **Term** | **Description** |

Cross Tenant Synchronization Overview

Ai Prompt Injection Protection

- [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md)

Unified risk signals in Microsoft Entra ID Protection

Learn how unified risk signals correlate identity risk across Microsoft Entra ID Protection and Microsoft Defender to calculate compounded user risk.

Archive for Microsoft Entra releases and announcements

The What's new release notes in the Overview section of this content set contain six months of activity. After six months, the items are removed from the main article and put into this archive article.

Configure Security

A Microsoft Entra documentation page was updated: Configure Security.

Customer data storage and processing for European customers in Microsoft Entra ID

Learn about where Microsoft Entra ID stores identity-related data for its European customers.

Customer data storage for Japan customers

Learn about where Microsoft Entra ID stores customer-related data for its Japan customers.

Frontline Worker Management

Learn about frontline worker management capabilities that are provided through the My Staff portal.

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

Microsoft Entra ID Governance licensing fundamentals

This article describes shows the licensing requirements for Microsoft Entra ID Governance features.

Microsoft Entra releases and announcements

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.

Migrate Group Writeback

- Cloud-created [security groups](../../../fundamentals/concept-learn-about-groups.md#group-types).

Operations

| --- | --- |

Overview

> [!IMPORTANT]

Operations

| Guide | What it covers |

Add Member To Group

Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.md#create-a-basic-group-and-add-members).

Bulk Operations

- [Bulk operations service limitations](bulk-operations-service-limitations.md)

Compare

|**Users**|||

Create New Tenant

- To add users, see [Add or delete a new user](./how-to-create-delete-users.md).

Delegate By Task

Here are the least privileged roles you should use when performing tasks for [groups](../../fundamentals/how-to-manage-groups.md) in Microsoft Entra ID.

Entra Admin Center

| Task | Description | Learn more |

Groups Concept

- [Create a role-assignable group](groups-create-eligible.md)

Groups Dynamic Membership

- [Manage Microsoft Entra groups and group membership](~/fundamentals/how-to-manage-groups.md)

How to manage groups

Instructions about how to create and update Microsoft Entra groups, such as membership and settings.

Learn About Groups

- For more information, see [Learn about Microsoft 365 Groups](https://support.office.com/article/learn-about-office-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2).

Manage User Profile Info

- [Add or delete users](how-to-create-delete-users.md)

Microsoft Entra releases and announcements

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.

Users Default Permissions

An owner can also add or remove other owners. Unlike those users assigned at least the [Groups Administrator](../identity/role-based-access-control/permissions-reference.md#groups-administrator) role, owners can manage only the groups that they own and they can add or remove group members only if the group's membership type is **Assigned**.

Whats New Archive

**Type:** New feature

Bring Your Own Device

ai-usage: ai-assisted

Source Ip Restoration

- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).

Add an existing Azure subscription to your tenant

Instructions about how to add an existing Azure subscription to your Microsoft Entra tenant.

Quickstart - Access and create new tenant

Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.

Source Ip Restoration

- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).

Add your custom domain

Instructions about how to add your custom domain name to your tenant.

Bulk operations in Microsoft Entra ID (Preview)

Learn about the new Microsoft Entra bulk operations experience for managing users, groups, and devices.

Customer intent: As a new customer, I want an overview of all Microsoft Entra products including links to get started.

Introduction to the Microsoft Entra product family including links to get started.

Default user permissions

Compare the default user permissions available in Microsoft Entra ID and learn how to restrict access.

Directory Overview User Model

Managing user license assignments individually is time consuming and error prone. If you [assign licenses to groups](~/fundamentals/licensing.md?context=azure/active-directory/users-groups-roles/context/ugr-context) instead, you experience easier large-scale license management.

Group Based Licensing

Learn about Microsoft Entra group-based licensing, including how it works,

Microsoft Entra licensing

This article documents licensing requirements for Microsoft Entra features.

Restore or permanently remove recently deleted user

How to view restorable users, restore a deleted user, or permanently delete a user with Microsoft Entra ID.

Agent Identity Deletion

ai-usage: ai-assisted

ID Protection for Agents

Learn about how Microsoft Entra ID Protection identifies risky agents.

Inheritable permissions for Microsoft Entra Agent ID

Understand the difference between required resource access declarations and inheritable permissions for agent identity blueprints in Microsoft Entra Agent ID.

Risk Detection Types

Learn about risk detections and risk levels, including the difference between real-time and offline detections.

Security Customers

Each layer addresses a different class of attacks, reducing the likelihood of compromise and limiting the blast radius.

Whats New

- clicktale

AI agent discovery in Global Secure Access (preview)

Learn how AI agent discovery in Global Secure Access provides network-level visibility into managed and shadow AI agents reaching the internet from your environment.

Key Concepts

Traditional service principals were designed for static, deterministic workloads. Microsoft Entra Agent ID exists because service principals lack the governance infrastructure AI agents need. There's no enforced sponsorship, no agent-aware audit entries, and no blueprint-managed lifecycle. For more information, see [Agent identities, service principals, and applications](agent-service-principals.md).

What is self-service sign-up for Microsoft Entra ID?

ai-usage: ai-assisted

Whats New Ignite 2025

- [Call API: Azure services](../agent-id/call-api-azure-services.md) (New)

Add or deactivate custom security attribute definitions in Microsoft Entra ID

Learn how to add new custom security attribute definitions or deactivate custom security attribute definitions in Microsoft Entra ID.

Application Usage Analytics Overview

Gain visibility into application traffic to gain insights into app categories, risk scores, transactions, and organizational usage patterns.

Configure Security

manager: dougeby

Create and manage custom attributes for Microsoft Entra Domain Services | Microsoft Docs

Learn how to create and manage custom attributes in a Domain Services managed domain.

Customer data storage and processing for European customers in Microsoft Entra ID

Learn about where Microsoft Entra ID stores identity-related data for its European customers.

Customer data storage for Japan customers

Learn about where Microsoft Entra ID stores customer-related data for its Japan customers.

Customer intent: As an IT admin, I need to know what options are available for integrating Microsoft Entra activity logs with storage and analysis to…

A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I need to know what options are available for integrating Microsoft Entra activity logs with storage and analysis tools so I can choose the best option for my organization..

Customer intent: As an IT admin, I want to know how to use the Identity Secure Score and related recommendations to improve the security posture of m…

A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I want to know how to use the Identity Secure Score and related recommendations to improve the security posture of my Microsoft Entra tenant..

Data operational considerations

Learn how

Data protection considerations

Learn how services store and retrieve Microsoft Entra object data through an RBAC authorization layer.

Device Registration

A Microsoft Entra documentation page was updated: Device Registration.

Device soft delete in Microsoft Entra ID (preview)

Learn about device soft delete (preview) in Microsoft Entra ID, which moves deleted devices to a recoverable state instead of permanently removing them.

Directory Join

A Microsoft Entra documentation page was updated: Directory Join.

Embrace cloud-first posture and transfer user Source of Authority (SOA) to the cloud

Learn about Source of Authority (SOA) for users, including prerequisites and supported scenarios.

Explicit Forward Proxy (preview) overview

Learn about Explicit Forward Proxy concepts.

Explicit Forward Proxy (preview) session management

Learn about Explicit Forward Proxy session management concepts.

Five steps to integrate your apps with Microsoft Entra ID

Learn to integrate your applications with Microsoft Entra ID by adding apps, discovery, and integration methods.

Frontline Worker Management

Learn about frontline worker management capabilities that are provided through the My Staff portal.

Global Secure Access: Advanced Threat Protection

Learn how to protect your organization with Global Secure Access Advanced Threat Protection (ATP) and Data Loss Prevention (DLP) policies powered by Netskope.

How to create, invite, and delete users in Microsoft Entra ID

Instructions for IT admins to create new users, invite external guests, and delete existing users in Microsoft Entra ID.

Hybrid Join

A Microsoft Entra documentation page was updated: Hybrid Join.

Inheritable permissions for Microsoft Entra Agent ID

Understand the difference between required resource access declarations and inheritable permissions for agent identity blueprints in Microsoft Entra Agent ID.

Introduction to proxy automatic configuration (PAC) files

Learn about Explicit Forward Proxy PAC file concepts.

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access

Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

Learn about Global Secure Access Alerts

Learn how Global Secure Access alerts notify you about security issues and operational concerns, helping to strengthen your organization's security posture.

Learn about Global Secure Access external user access

Learn how Global Secure Access enables secure external user access for partners through the Global Secure Access client and Azure Virtual Desktop.

Learn about Secure Web and AI Gateway for Microsoft Copilot Studio agents

Learn about the features and benefits of our Secure Web and AI Gateway for agents in Global Secure Access.

Learn how agent identity deletion works

Learn how deleting an agent identity blueprint triggers automatic cleanup of child agent identities in Microsoft Entra, and how to restore deleted objects.

Macos Psso

Overview of macOS Platform Single Sign On (PSSO) for Microsoft Entra ID registered devices.

Manage access to custom security attributes in Microsoft Entra ID

Learn how to manage access to custom security attributes in Microsoft Entra ID.

Microsoft Entra audit log activity reference

Get an overview of the audit activities that can be logged in your audit logs in Microsoft Entra ID.

Microsoft Entra ID and data residency

Use residency data to manage access, achieve mobility scenarios, and secure your organization.

Microsoft Entra releases and announcements

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.