Configure cloud firewall for remote networks
Security
The article title and heading now explicitly focus on configuring cloud firewall for remote networks.
Cross-product topic
Security
A cross-product view of Microsoft Entra changes related to Security.
Latest Security changes
Netskope Coexistence
Security
The page now documents a scenario where Global Secure Access handles private application and Microsoft 365 traffic while Netskope captures internet traffic. It includes configuration, verification, and traffic-testing steps for Windows and macOS.
Configure Microsoft Entra Global Secure Access with Infoblox
Security
A new how-to explains configuring Microsoft Entra Private Access with Infoblox Threat Defense, including prerequisites, DNS bypasses, internal domains, category filters, endpoint groups, and security policies.
Protect against consent phishing
Security
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
Identity verification integration for Microsoft Entra External ID
Security
A new article compares three identity verification patterns: Verified ID credentials, direct REST API claims, and OIDC federation. It explains partner-based proofing, External ID authentication, setup considerations, and handling of longer-running verification journeys.
Credential Management Api
Security
The article now links to a sample app demonstrating passkey listing and registration with delegated permissions and warns that its deletion flow uses high-privilege application permissions and a client secret in browser code.
Credential Management Api
Security
The Microsoft Entra External ID credential management API reference was deleted, including guidance for passkey listing and registration, delegated permissions, authentication, and sample usage.
Policy All Users Approved App Or App Protection
Security
Corrected a spelling error in the explanation of “Report-only: Failure” results for the “Require app protection policy” control.
Secure Web Ai Gateway Agents
Security
The documentation corrects “Web respositories” to “Web repositories” in an example of security rules.
How to configure app instance property lock in your applications
Security
The documentation now states that locks apply to an application's service principal for both single-tenant and multitenant applications. Since June 2026, Enable property lock is enabled by default for new applications.
Microsoft Defender for Office 365: Changes to Unified RBAC permission mapping for Microsoft Entra Security Operator role
Security
Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.
Security best practices for application properties
Security
The documentation now emphasizes app instance lock for multitenant applications and also mentions single-tenant applications.
Security Updates Pks
Security
The required Microsoft Entra Connect Sync version changed from 2.5.79.0 to 2.6.84.0 or later. Application-based authentication must still be configured by April 7, 2027.
Security Updates Pks
Security
The warning is bolded: upgrade Microsoft Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are not met.
Security Updates Pks
Security
The deadline changed to April 7, 2027. Administrators must upgrade to version 2.5.79.0 or later and configure application-based authentication; synchronization stops after the deadline if requirements are unmet.
Upgrade Previous Version
Security
The required Microsoft Entra Connect Sync version increased from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.
Upgrade Previous Version
Security
The documentation now bolds the mandatory upgrade warning: upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Legacy authentication will be retired, and synchronization will stop after that date if requirements are unmet.
Upgrade Previous Version
Security
The documentation now requires version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop afterward if these requirements are unmet.
Workload Identities Flexible Federated Identity Credentials
Security
The page now notes that, starting July 15, 2026, GitHub will automatically use immutable subject claims for newly created, renamed, or transferred repositories. Existing repositories will retain name-based claims unless opted in.
Network Content Filtering
Security
The documentation replaces the Source type condition with Session type, adds a known internet access limitations reference, and revises guidance for WebSocket filtering, API rate limiting, and Purview inspection failures.
Network Content Filtering
Security
The documentation now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It adds a warning that blocking HTML or JSON can disrupt normal web and API traffic, and updates the stated coverage from HTTP/1.1 to HTTP/S.
Token Protection Deployment Guide - Windows
Security
The guide now states that users without a registered or enrolled device are prompted to register it, and documents a different message for users who have not installed the latest September 2026 Windows update.
Flexible federated identity credentials (preview)
Security
The guidance now covers applications and user-assigned managed identities, including Azure Resource Manager setup instructions and updated GitLab claim-matching requirements.
Set up a Flexible Federated identity credential (preview)
Security
The documentation now explains setup for applications and user-assigned managed identities, using Microsoft Graph for applications and Azure Resource Manager for managed identities. It also adds details about credential properties, including claimsMatchingExpression.
Connect Version History
Security
The version history entry now links readers to the latest available Microsoft Entra Connect Sync version.
Deployment Guide Token Protection Windows
Security
The Windows token protection guide now refers to Microsoft Copilot instead of Microsoft 365 Copilot.
Credential Management Api
Security
The Microsoft Entra External ID credential management API reference was deleted. It previously documented how applications let signed-in customers list, register, and delete passkeys.
Set up Microsoft Entra Verified ID
Security
The new article explains how to use Quick setup, register applications, create credentials, and issue and verify credentials in a Microsoft Entra External ID tenant. It documents prerequisites and limits, including custom-domain requirements, shared signing keys, two requests per second per tenant, and six-month credential validity.
Configure TLS inspection with a Microsoft-managed certificate
Security
The guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The capability is in preview, and the private key remains protected by Microsoft.
Configure TLS inspection with your own certificate
Security
The article now focuses on bringing your own certificate authority for TLS inspection, including CSR creation, PKI signing, and certificate upload. It also links to separate Microsoft-managed certificate guidance.
Microsoft Viva Engage: Microsoft Entra permissions required for community and membership administration
Security
Starting late September 2026, Microsoft Viva Engage will require Microsoft Entra permissions—Yammer Administrator role or Community Admin assignment—for community and membership management tasks previously allowed to Verified or Network Admins. Administrators should review and update role assignments accordingly.
Protect enterprise generative AI apps with prompt injection protection
Security
The AI prompt injection protection documentation now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before configuring TLS inspection policies.
Transport Layer Security
Security
The TLS inspection documentation now explains how to configure either a Microsoft-managed certificate or your own certificate authority.
SAM Account Name
Security
Enhanced synchronization can source sAMAccountName for hybrid users from onPremisesSamAccountName in Microsoft Entra ID. Existing domains retain current behavior until enabled; enabling updates existing hybrid users during synchronization, while cloud-only users without the source value continue using mailNickname-based generation.
Migrate Web Content Filtering Policies
Security
The guide now presents the V1-to-V2 migration procedure and migration options as numbered steps.
Flexible federated identity credentials (preview)
Security
The documentation now states that GitHub flexible federated identity credentials must match `sub` and at least one immutable claim: `repository_id` or `repository_owner_id`. It also updates examples and operator support details.
Set up a Flexible Federated identity credential (preview)
Security
The guidance now requires GitHub flexible federated identity credentials to match `sub` plus `repository_id`, `repository_owner_id`, or both. Portal and Microsoft Graph examples include these claims and optional workflow matching.
Best Practices Agent Id
Security
The documentation now recommends creating agent identities from an agent identity blueprint instead of using standard app registrations or service principals. It also adds .NET usage guidance and lists required roles and permission.
Call Api Azure Services
Security
The documentation updates its C# examples, separating app-only, on-behalf-of-user, and user-identification scenarios. Samples now configure agent identity options and pass the credential to the Blob client correctly.
Integrate Aws Bedrock Agent
Security
The guide updates “Entra” to “Microsoft Entra” in the diagram alt text, setup heading, and TENANT_ID descriptions. No technical procedure or feature change is shown.
Workload Identities Flexible Federated Identity Credentials
Security
The documentation now links to guidance on mutable subjects and migrating GitHub Actions federated credentials to immutable subjects.
Workload Identities Set Up Flexible Federated Identity Credential
Security
The setup documentation now links to guidance on mutable subjects and migrating GitHub Actions federated credentials to immutable subjects.
Workload Identities Federated Credential Mutable Subjects
Security
"audiences": ["api://AzureADTokenExchange"]
Migrate GitHub Actions federated credentials to immutable subjects
Security
Learn how to migrate a Microsoft Entra federated identity credential for GitHub Actions from a mutable subject to GitHub's immutable subject format.
Mutable subjects in federated identity credentials
Security
Learn how mutable OIDC subject claims expose Microsoft Entra federated identity credentials to subject recycling, and how immutable claims reduce the risk.
Connect Health Agent Install
Security
> If you have a highly locked-down and restricted environment, you need to add more URLs than the URLs the table lists for Internet Explorer enhanced security. Also add URLs that are listed in the table in the next section.
Assignment restriction for managed identities (preview)
Security
Learn how assignment restrictions scope a user-assigned managed identity to one or more resource providers to improve security and resilience.
Dynamics 365 Contact Center - Manage users through Microsoft Entra security groups
Security
We are announcing the ability to manage users through Microsoft Entra security groups in Dynamics 365 Contact Center. This feature will reach general availability on July 24, 2026.
Create content policies for network content filtering
Security
Discover how to configure network content filtering with Global Secure Access to enforce data protection policies for files and text content in real time.
Id Protection Dashboard
Security
Microsoft Entra ID Protection provides unified risk signals that aggregate correlated risk signals from Microsoft Entra ID Protection, Microsoft Defender, and other Microsoft security products. Instead of evaluating alerts in isolation, this capability correlates identity-related signals across products and evaluates them together within the same time window to calculate a compounded user risk score.
Assignment restriction for managed identities
Security
Learn how assignment restrictions scope a user-assigned managed identity to one or more resource providers to improve security and resilience.
Security Operations
Security
- [Microsoft Entra Security Operations Guide](https://aka.ms/AzureADSecOps)
Security operations for network access
Security
Security operations guide for Microsoft Entra Global Secure Access covering detection patterns and Sentinel analytics for Private Access, Internet Access, Remote Networks, and Microsoft Traffic.
Entra Offerings
Security
>The licensing options on this page aren't comprehensive. You can get detailed information about the various options at the [Microsoft Entra pricing page](https://www.microsoft.com/security/business/microsoft-entra-pricing) and at the [Compare Microsoft 365 Enterprise plans and pricing page](https://www.microsoft.com/microsoft-365/enterprise/microsoft365-plans-and-pricing).
Licensing Identity Protection
Security
Starting soon, ID Protection for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to extend protection to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).
Configure Domain Controllers
Security
- The Service Principal Names (SPNs) of the private apps you want to protect. You add these SPNs in the policy for Private Access Sensors that are installed on the DCs.
Licensing Identity Protection
Security
Starting soon, ID Protection for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to extend protection to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).
What If Tool
Security
**Has filter** indicates whether the policy has app filters that use custom security attributes.
Ai Prompt Injection Protection
Security
Protect your enterprise generative AI apps from prompt injection attacks with Microsoft's AI Gateway prompt injection protection.
Application consent management and evaluation of consent requests
Security
Understand consent request evaluation and tenant-wide admin consent in Microsoft Entra ID. Essential guidance for administrators managing application permissions and security.
Best practices to protect frontline workers
Security
Learn about the best practices and general guidance for protecting frontline workers in an organization
Client credentials for web apps and web APIs calling downstream APIs
Security
Include file with a common configuration in web apps and web APIs calling downstream web APIs (ASP.NET Core and ASP.NET OWIN).
Configure Acronis Cyber Protect Cloud for Single Sign-On with Microsoft Entra ID
Security
A Microsoft Entra documentation page was updated: Configure Acronis Cyber Protect Cloud for Single Sign-On with Microsoft Entra ID.
Configure Global Secure Access cloud firewall with remote networks for internet access
Security
Learn how to configure and use cloud firewall to protect against unauthorized internet access from branch offices using Remote Networks for Internet Access.
Configure protected web API apps
Security
Learn how to build a protected web API and configure your application's code.
Configure risk-based step-up consent
Security
Learn how to disable and enable risk-based step-up consent to reduce user exposure to malicious apps that make illicit consent requests.
Configure Transport Layer Security Inspection Policies
Security
Learn how to configure a Transport Layer Security inspection policy and assign it to users in your organization.
Configure Transport Layer Security Inspection Settings
Security
Learn how to configure a Transport Layer Security inspection certificate authority
Create a custom Data Loss Prevention profile with the Global Secure Access and Netskope integration
Security
Learn how to protect your organization with a custom Data Loss Prevention (DLP) profile powered by Netskope.
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and IMPAC Risk Manager so that I…
Security
In this article, you learn how to integrate IMPAC Risk Manager with Microsoft Entra ID. When you integrate IMPAC Risk Manager with Microsoft Entra ID, you can:
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and IriusRisk so that I can contr…
Security
In this article, you learn how to integrate IriusRisk with Microsoft Entra ID. When you integrate IriusRisk with Microsoft Entra ID, you can:
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and KnowBe4 Security Awareness Tr…
Security
In this article, you learn how to integrate KnowBe4 Security Awareness Training with Microsoft Entra ID. When you integrate KnowBe4 Security Awareness Training with Microsoft Entra ID, you can:
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Menlo Security so that I can…
Security
In this article, you learn how to integrate Menlo Security with Microsoft Entra ID. When you integrate Menlo Security with Microsoft Entra ID, you can:
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Riskware so that I can contro…
Security
In this article, you learn how to integrate Riskware with Microsoft Entra ID. When you integrate Riskware with Microsoft Entra ID, you can:
Discover and deploy agents and solutions in Microsoft Entra
Security
Learn how to use Security Store in Microsoft Entra to discover, purchase, and deploy AI agents and security solutions for identity and access management.
Enable External ID High Scale Compatibility (HSC) mode
Security
Enable HSC mode on your Azure AD B2C tenant to adopt Microsoft Entra External ID endpoints while keeping existing users and credentials in place.
Enable single sign-on for an enterprise application with a relying party security token service
Security
Enable single sign-on for an enterprise application that has a relying party security token service in Microsoft Entra ID.
Find a Microsoft services partner
Security
Learn how you can adopt Microsoft's Security Service Edge (SSE) solution via Microsoft services partners.
Flexible federated identity credentials (preview)
Security
Learn about Microsoft Entra Workload ID Flexible federated identity credentials and its capabilities.
How to configure app instance property lock in your applications
Security
How to increase app security by configuring property modification locks for sensitive properties of the application.
How to migrate to Transport Layer Security (TLS) 1.2 enforcement for Microsoft Entra Domain Services | Microsoft Learn
Security
Learn how to enforce TLS 1.2 for a Microsoft Entra Domain Services managed domain.
How to use Continuous Access Evaluation enabled APIs in your applications
Security
Increase app security and resilience by adding support for Continuous Access Evaluation, enabling long-lived access tokens that can be revoked based on critical events and policy evaluation.
Increase application security with the principle of least privilege
Security
Learn how the principle of least privilege can help increase the security of an application and its data.
Integrate F5 BIG-IP with Microsoft Entra ID
Security
Integrate F5 BIG-IP with Microsoft Entra ID for secure hybrid access (SHA) to improve access and security.
Integrate Global Secure Access with Microsoft Sentinel
Security
Strengthen your organization's security posture by integrating Global Secure Access with Microsoft Sentinel using preconfigured workbooks and analytics rules.
Investigate app risk using Microsoft Security Copilot
Security
Use Microsoft Security Copilot and Microsoft Entra skills to quickly investigate potential risky applications.
Microsoft Entra Agents
Security
Learn about Microsoft Entra agents, AI-powered automation tools that enhance identity and access management operations.
Network Content Filtering
Security
Discover how to configure network content filtering with Global Secure Access to enforce data protection policies and secure sensitive files in real time.
PowerShell Sample - Create a TLS Certificate Using OpenSSL
Security
Use this PowerShell script to generate and sign Transport Layer Security (TLS) certificates using OpenSSL in a test environment.
Protect against consent phishing
Security
Learn ways of mitigating against application-based consent phishing attacks using Microsoft Entra ID.
Protecting Tokens Microsoft Entra Id
Security
A Microsoft Entra documentation page was updated: Protecting Tokens Microsoft Entra Id.
Quickstart: Get token & call Microsoft Graph in a console app
Security
In this quickstart, you learn how a .NET sample app can use the client credentials flow to get a token and call Microsoft Graph.
Secure hybrid access, protect legacy apps with Microsoft Entra ID
Security
Find partner solutions to integrate your legacy on-premises, public cloud, or private cloud applications with Microsoft Entra ID.
Security best practices for application properties
Security
Learn about the best practices and general guidance for security related application properties in Microsoft Entra ID.
Set up a Flexible Federated identity credential (preview)
Security
Learn how to set up a Flexible Federated identity credential in the Azure portal or Microsoft Graph Explorer.
Transition to Microsoft Entra External ID for CIAM
Security
Transition to Microsoft Entra External ID for CIAM: Learn how to migrate your legacy customer identity solutions to enhance security, compliance, and scalability.
Tutorial - Access Storage from a Web App with managed identities
Security
Learn how to access Azure Storage from a web app in Azure App Service using managed identities. Simplify security and avoid managing secrets.
Use role-based access control in your Node.js web app
Security
Learn how to configure groups and user roles in your external tenant, so you can receive them as claims in a security token for your Node.js application
Verify scopes and app roles protected web API
Security
Verify that the API is only called by applications on behalf of users who have the right scopes and by daemon apps that have the right application roles.
Workload identity federation for app considerations
Security
Important considerations and restrictions for creating a federated identity credential on an app.
Configure Acronis Cyber Protect Cloud for Single Sign-On with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Acronis Cyber Protect Cloud.
Configure Banyan Security Zero Trust Remote Access Platform for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Banyan Security Zero Trust Remote Access Platform.
Configure Cequence Application Security Platform for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Cequence Application Security Platform.
Configure Contrast Security for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Contrast Security.
Configure Coupa Risk Assess for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Coupa Risk Assess.
Configure Coverity Static Application Security Testing for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Coverity Static Application Security Testing.
Configure CylancePROTECT for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and CylancePROTECT.
Configure Datto File Protection Single Sign On for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Datto File Protection Single Sign On.
Configure Directory Services Protector for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Directory Services Protector.
Configure Guardium Data Protection for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Guardium Data Protection.
Configure IMPAC Risk Manager for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and IMPAC Risk Manager.
Configure Imperva Data Security for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Imperva Data Security.
Configure IriusRisk for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and IriusRisk.
Configure Kisi Physical Security for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and Kisi Physical Security.
Configure KnowBe4 Security Awareness Training for Single sign-on with Microsoft Entra ID
Security
Learn how to configure single sign-on between Microsoft Entra ID and KnowBe4 Security Awareness Training.