diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index f059ddd00ae..8dda7a95084 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -65,6 +65,11 @@
"redirect_url": "/entra/fundamentals/how-to-manage-support-access-requests",
"redirect_document_id": false
},
+ {
+ "source_path_from_root": "/docs/identity/monitoring-health/reference-azure-monitor-sign-ins-log-schema.md",
+ "redirect_url": "/entra/identity/monitoring-health/concept-activity-log-schemas",
+ "redirect_document_id": false
+ },
{
"source_path_from_root": "/docs/identity/monitoring-health/howto-configure-prerequisites-for-reporting-api.md",
"redirect_url": "/entra/identity/monitoring-health/howto-analyze-activity-logs-with-microsoft-graph",
diff --git a/docs/identity/authentication/certificate-based-authentication-federation-get-started.md b/docs/identity/authentication/certificate-based-authentication-federation-get-started.md
index 2583065a89d..dc771cec7b6 100644
--- a/docs/identity/authentication/certificate-based-authentication-federation-get-started.md
+++ b/docs/identity/authentication/certificate-based-authentication-federation-get-started.md
@@ -59,21 +59,21 @@ The related information exists for the following device platforms:
## Step 2: Configure the certificate authorities
-[!INCLUDE [Configure certificate authorities](../../includes/entra-authentication-configure-certificate-authorities.md)]
+[!INCLUDE [Configure certificate authorities](~/includes/entra-authentication-configure-certificate-authorities.md)]
### Connect
-[!INCLUDE [Connect-AzureAD](../../includes/entra-authentication-connect.md)]
+[!INCLUDE [Connect-AzureAD](~/includes/entra-authentication-connect.md)]
### Retrieve
-[!INCLUDE [Get-AzureAD](../../includes/entra-authentication-get-trusted.md)]
+[!INCLUDE [Get-AzureAD](~/includes/entra-authentication-get-trusted.md)]
To add, modify, or remove a CA, use the Microsoft Entra admin center:
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).
+1. [!INCLUDE [Privileged role](../../includes/privileged-role-include.md)]
1. Browse to **Protection** > **Show more** > **Security Center** (or **Identity Secure Score**) > **Certificate authorities**.
1. To upload a CA, select **Upload**:
1. Select the CA file.
diff --git a/docs/identity/authentication/concept-authentication-methods-manage.md b/docs/identity/authentication/concept-authentication-methods-manage.md
index a6920828b50..99d03e35eec 100644
--- a/docs/identity/authentication/concept-authentication-methods-manage.md
+++ b/docs/identity/authentication/concept-authentication-methods-manage.md
@@ -5,7 +5,7 @@ description: Learn about the authentication methods policy and different ways to
ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
-ms.date: 07/09/2024
+ms.date: 10/03/2024
ms.author: justinha
author: justinha
@@ -35,7 +35,9 @@ Only the [converged registration experience](concept-registration-mfa-sspr-combi
## Legacy MFA and SSPR policies
-Two other policies, located in **Multifactor authentication** settings and **Password reset** settings, provide a legacy way to manage some authentication methods for all users in the tenant. You can't control who uses an enabled authentication method, or how the method can be used. A [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator) is needed to manage these policies.
+Two other policies, located in **Multifactor authentication** settings and **Password reset** settings, provide a legacy way to manage some authentication methods for all users in the tenant. You can't control who uses an enabled authentication method, or how the method can be used.
+
+[!INCLUDE [Privileged role](~/includes/privileged-role-feature-include.md)]
>[!Important]
>In March 2023, we announced the deprecation of managing authentication methods in the legacy multifactor authentication and self-service password reset (SSPR) policies. Beginning September 30, 2025, authentication methods can't be managed in these legacy MFA and SSPR policies. We recommend customers use the manual migration control to migrate to the Authentication methods policy by the deprecation date.
diff --git a/docs/identity/authentication/concept-authentication-oath-tokens.md b/docs/identity/authentication/concept-authentication-oath-tokens.md
index 0124cdbff1c..26d5f7e62dc 100644
--- a/docs/identity/authentication/concept-authentication-oath-tokens.md
+++ b/docs/identity/authentication/concept-authentication-oath-tokens.md
@@ -6,7 +6,7 @@ services: active-directory
ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
-ms.date: 02/14/2024
+ms.date: 10/03/2024
ms.author: justinha
author: justinha
@@ -54,7 +54,7 @@ Helga@contoso.com,1234567,2234567abcdef2234567abcdef,60,Contoso,HardwareKey
> [!NOTE]
> Make sure you include the header row in your CSV file.
-Once properly formatted as a CSV file, a Global Administrator can then sign in to the Microsoft Entra admin center, navigate to **Protection** > **Multifactor authentication** > **OATH tokens**, and upload the resulting CSV file.
+Once properly formatted as a CSV file, an administrator can then sign in to the Microsoft Entra admin center, navigate to **Protection** > **Multifactor authentication** > **OATH tokens**, and upload the resulting CSV file.
Depending on the size of the CSV file, it can take a few minutes to process. Select the **Refresh** button to get the current status. If there are any errors in the file, you can download a CSV file that lists any errors for you to resolve. The field names in the downloaded CSV file are different than the uploaded version.
diff --git a/docs/identity/authentication/concept-certificate-based-authentication-migration.md b/docs/identity/authentication/concept-certificate-based-authentication-migration.md
index 82d7780fb94..9133cc05da0 100644
--- a/docs/identity/authentication/concept-certificate-based-authentication-migration.md
+++ b/docs/identity/authentication/concept-certificate-based-authentication-migration.md
@@ -5,7 +5,7 @@ description: Learn how to migrate from Federated server to Microsoft Entra ID
ms.service: entra-id
ms.subservice: authentication
ms.topic: how-to
-ms.date: 09/13/2023
+ms.date: 10/03/2024
ms.author: justinha
@@ -75,7 +75,7 @@ For synchronized accounts:
### Should organizations eliminate federated servers like AD FS to prevent the capability to pivot from AD FS to Azure?
-With federation, an attacker could impersonate anyone, such as a CIO, even if they can't obtain a cloud-only role like the Global Administrator account.
+With federation, an attacker could impersonate anyone, such as a CIO, even if they can't obtain a cloud-only role like a highly privileged administrator account.
When a domain is federated in Microsoft Entra ID, a high level of trust is being placed on the Federated IdP. AD FS is one example, but the notion holds true for *any* federated IdP. Many organizations deploy a federated IdP such as AD FS exclusively to accomplish certificate based authentication. Microsoft Entra CBA completely removes the AD FS dependency in this case. With Microsoft Entra CBA, customers can move their application estate to Microsoft Entra ID to modernize their IAM infrastructure and reduce costs with increased security.
diff --git a/docs/identity/authentication/concept-mfa-authprovider.md b/docs/identity/authentication/concept-mfa-authprovider.md
index 047b6bb13ab..b1223fb2387 100644
--- a/docs/identity/authentication/concept-mfa-authprovider.md
+++ b/docs/identity/authentication/concept-mfa-authprovider.md
@@ -6,21 +6,21 @@ description: When should you use an authentication provider with Microsoft Entra
ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
-ms.date: 09/14/2023
+ms.date: 10/03/2024
ms.author: justinha
author: justinha
manager: amycolannino
-ms.reviewer: michmcla
+ms.reviewer: jpettere
---
# When to use a Microsoft Entra multifactor authentication provider
> [!IMPORTANT]
> Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multifactor authentication will continue to be available as a feature in Microsoft Entra ID P1 or P2 licenses.
-Two-step verification is available by default for Global Administrators who have Microsoft Entra ID, and Microsoft 365 users. However, if you wish to take advantage of [advanced features](howto-mfa-mfasettings.md) then you should purchase the full version of Microsoft Entra multifactor authentication.
+Two-step verification is available by default for administrators in Microsoft Entra ID, and Microsoft 365 users. However, if you wish to take advantage of [advanced features](howto-mfa-mfasettings.md) then you should enable Microsoft Entra multifactor authentication by using Conditional Access. For more information, see [Common Conditional Access policy: Require MFA for all users](~/identity/conditional-access/howto-conditional-access-policy-all-users-mfa.md).
-A Microsoft Entra multifactor authentication provider is used to take advantage of features provided by Microsoft Entra multifactor authentication for users who **do not have licenses**.
+A Microsoft Entra multifactor authentication provider is used to take advantage of features provided by Microsoft Entra multifactor authentication for users who **don't have licenses**.
## Caveats related to the Azure MFA SDK
@@ -70,3 +70,5 @@ After you confirm that all settings are migrated, browse to **Providers** and se
## Next steps
[Configure multifactor authentication settings](howto-mfa-mfasettings.md)
+
+[Common Conditional Access policy: Require MFA for all users](~/identity/conditional-access/howto-conditional-access-policy-all-users-mfa.md)
diff --git a/docs/identity/authentication/concept-mfa-licensing.md b/docs/identity/authentication/concept-mfa-licensing.md
index afe68e1cb53..67f60e333e1 100644
--- a/docs/identity/authentication/concept-mfa-licensing.md
+++ b/docs/identity/authentication/concept-mfa-licensing.md
@@ -6,7 +6,7 @@ description: Learn about the Microsoft Entra multifactor authentication client a
ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
-ms.date: 01/29/2023
+ms.date: 10/03/2024
ms.author: justinha
author: justinha
@@ -15,16 +15,16 @@ ms.reviewer: michmcla
---
# Features and licenses for Microsoft Entra multifactor authentication
-To protect user accounts in your organization, multifactor authentication should be used. This feature is especially important for accounts that have privileged access to resources. Basic multifactor authentication features are available to Microsoft 365 and Microsoft Entra users and Global Administrators for no extra cost. If you want to upgrade the features for your admins or extend multifactor authentication to the rest of your users with more authentication methods and greater control, you can purchase Microsoft Entra multifactor authentication in several ways.
+To protect user accounts in your organization, multifactor authentication should be used. This feature is especially important for accounts that have privileged access to resources. Basic multifactor authentication features are available to Microsoft 365 and Microsoft Entra ID users and administrators for no extra cost. If you want to upgrade the features for your admins or extend multifactor authentication to the rest of your users with more authentication methods and greater control, you can enable Microsoft Entra multifactor authentication by using Conditional Access. For more information, see [Common Conditional Access policy: Require MFA for all users](~/identity/conditional-access/howto-conditional-access-policy-all-users-mfa.md).
> [!IMPORTANT]
-> This article details the different ways that Microsoft Entra multifactor authentication can be licensed and used. For specific details about pricing and billing, see the [Microsoft Entra pricing page](https://www.microsoft.com/en-us/security/business/identity-access-management/azure-ad-pricing).
+> This article details the different ways that Microsoft Entra multifactor authentication can be licensed and used. For specific details about pricing and billing, see the [Microsoft Entra pricing page](https://www.microsoft.com/security/business/microsoft-entra-pricing).
## Available versions of Microsoft Entra multifactor authentication
-Microsoft Entra multifactor authentication can be used, and licensed, in a few different ways depending on your organization's needs. All tenants are entitled to basic multifactor authentication features via Security Defaults. You may already be entitled to use advanced Microsoft Entra multifactor authentication depending on the Microsoft Entra ID, EMS, or Microsoft 365 license you currently have. For example, the first 50,000 monthly active users in Microsoft Entra External ID can use MFA and other Premium P1 or P2 features for free. For more information, see [Microsoft Entra External ID pricing](https://azure.microsoft.com/pricing/details/active-directory/external-identities/).
+Microsoft Entra multifactor authentication can be used, and licensed, in a few different ways depending on your organization's needs. All tenants are entitled to basic multifactor authentication features by using security defaults. You may already be entitled to use advanced Microsoft Entra multifactor authentication depending on the license you currently have. For example, the first 50,000 monthly active users in Microsoft Entra External ID can use MFA and other Premium P1 or P2 features for free. For more information, see [Azure Active Directory B2C pricing](https://azure.microsoft.com/pricing/details/active-directory/external-identities/).
The following table details the different ways to get Microsoft Entra multifactor authentication and some of the features and use cases for each.
@@ -34,7 +34,7 @@ The following table details the different ways to get Microsoft Entra multifacto
| [Microsoft Entra ID P1](~/fundamentals/get-started-premium.md) | You can use [Microsoft Entra Conditional Access](~/identity/conditional-access/howto-conditional-access-policy-all-users-mfa.md) to prompt users for multifactor authentication during certain scenarios or events to fit your business requirements. |
| [Microsoft Entra ID P2](~/fundamentals/get-started-premium.md) | Provides the strongest security position and improved user experience. Adds [risk-based Conditional Access](~/identity/conditional-access/howto-conditional-access-policy-risk.md) to the Microsoft Entra ID P1 features that adapts to user's patterns and minimizes multifactor authentication prompts. |
| [All Microsoft 365 plans](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans) | Microsoft Entra multifactor authentication can be enabled for all users using [security defaults](~/fundamentals/security-defaults.md). Management of Microsoft Entra multifactor authentication is through the Microsoft 365 portal. For an improved user experience, upgrade to Microsoft Entra ID P1 or P2 and use Conditional Access. For more information, see [secure Microsoft 365 resources with multifactor authentication](/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication). |
-| [Office 365 free](https://www.microsoft.com/microsoft-365/enterprise/compare-office-365-plans)
[Microsoft Entra ID Free](~/verified-id/how-to-create-a-free-developer-account.md) | You can use [security defaults](~/fundamentals/security-defaults.md) to prompt users for multifactor authentication as needed but you don't have granular control of enabled users or scenarios, but it does provide that additional security step.
Even when security defaults aren't used to enable multifactor authentication for everyone, users assigned the *Microsoft Entra Global Administrator* role can be configured to use multifactor authentication. This feature of the free tier makes sure the critical administrator accounts are protected by multifactor authentication. |
+| [Office 365 free](https://www.microsoft.com/microsoft-365/enterprise/compare-office-365-plans)
[Microsoft Entra ID Free](~/verified-id/how-to-create-a-free-developer-account.md) | You can use [security defaults](~/fundamentals/security-defaults.md) to prompt users for multifactor authentication as needed but you don't have granular control of enabled users or scenarios, but it does provide that additional security step. |
## Feature comparison based on licenses
@@ -61,7 +61,7 @@ The following table provides a list of the features that are available in the va
## Compare multifactor authentication policies
-Our recommended approach to enforce MFA is using [Conditional Access](~/identity/conditional-access/overview.md). Review the following table to determine the what capabilities are included in your licenses.
+Our recommended approach to enforce MFA is using [Conditional Access](~/identity/conditional-access/overview.md). Review the following table to determine what capabilities are included in your licenses.
| Policy | Security defaults | Conditional Access | Per-user MFA |
| --- |:---:|:---:|:---:|
@@ -84,28 +84,17 @@ Our recommended approach to enforce MFA is using [Conditional Access](~/identity
| Support for "report only" mode | | ● | |
| Ability to completely block users/services | | ● | |
-
-
-## Purchase and enable Microsoft Entra multifactor authentication
-
-To use Microsoft Entra multifactor authentication, register for or purchase an eligible Microsoft Entra tier. Microsoft Entra ID comes in four editions—Free, Office 365, Premium P1, and Premium P2.
-
-The Free edition is included with an Azure subscription. See the [section below](#azure-ad-free-tier) for information on how to use security defaults or protect accounts with the *Microsoft Entra Global Administrator* role.
-
-The Microsoft Entra ID P1 or P2 editions are available through your Microsoft representative, the [Open Volume License Program](https://www.microsoft.com/licensing/licensing-programs/open-license.aspx), and the [Cloud Solution Providers program](https://go.microsoft.com/fwlink/?LinkId=614968&clcid=0x409). Azure and Microsoft 365 subscribers can also buy Microsoft Entra ID P1 and P2 online. [Sign in](https://portal.office.com/Commerce/Catalog.aspx) to purchase.
-
-After you have purchased the required Microsoft Entra tier, [plan and deploy Microsoft Entra multifactor authentication](howto-mfa-getstarted.md).
-### Microsoft Entra ID Free tier
+## Microsoft Entra ID Free tier
All users in a Microsoft Entra ID Free tenant can use Microsoft Entra multifactor authentication by using security defaults. The mobile authentication app can be used for Microsoft Entra multifactor authentication when using Microsoft Entra ID Free security defaults.
* [Learn more about Microsoft Entra security defaults](~/fundamentals/security-defaults.md)
* [Enable security defaults for users in Microsoft Entra ID Free](~/fundamentals/security-defaults.md#enabling-security-defaults)
-If you don't want to enable Microsoft Entra multifactor authentication for all users, you can instead choose to only protect user accounts with the *Microsoft Entra Global Administrator* role. This approach provides more authentication prompts for critical administrator accounts. You enable Microsoft Entra multifactor authentication in one of the following ways, depending on the type of account you use:
+You enable Microsoft Entra multifactor authentication in one of the following ways, depending on the type of account you use:
* If you use a Microsoft Account, [register for multifactor authentication](https://support.microsoft.com/help/12408/microsoft-account-about-two-step-verification).
* If you aren't using a Microsoft Account, [turn on multifactor authentication for a user or group in Microsoft Entra ID](howto-mfa-userstates.md).
diff --git a/docs/identity/authentication/concept-sspr-deploy.md b/docs/identity/authentication/concept-sspr-deploy.md
index 1ebdedb6416..a9dcf3c212d 100644
--- a/docs/identity/authentication/concept-sspr-deploy.md
+++ b/docs/identity/authentication/concept-sspr-deploy.md
@@ -5,7 +5,7 @@ description: Learn about deployment considerations and strategy for successful i
ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
-ms.date: 01/29/2023
+ms.date: 10/04/2024
ms.author: justinha
author: gargi-sinha
@@ -66,7 +66,7 @@ For more information about pricing, see [Microsoft Entra pricing](https://www.mi
* A working Microsoft Entra tenant with at least a trial license enabled. If needed, [create one for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
-* An account with Global Administrator privileges.
+* [!INCLUDE [Privileged role feature](../../includes/privileged-role-feature-include.md)]
### Guided walkthrough
@@ -134,7 +134,7 @@ When technology projects fail, they typically do so due to mismatched expectatio
| - | - |
| Level 1 helpdesk| Password Administrator |
| Level 2 helpdesk| User Administrator |
-| SSPR administrator| Global Administrator |
+| SSPR administrator| Authentication Administrator |
### Plan a pilot
@@ -311,10 +311,12 @@ Microsoft Entra ID can provide additional information on your SSPR performance t
### Password management activity reports
-You can use pre-built reports on Microsoft Entra admin center to measure the SSPR performance. If you're appropriately licensed, you can also create custom queries. For more information, see [Reporting options for Microsoft Entra password management](./howto-sspr-reporting.md)
+You can use pre-built reports on Microsoft Entra admin center to measure the SSPR performance. If you're appropriately licensed, you can also create custom queries. For more information, see [Reporting options for Microsoft Entra password management](./howto-sspr-reporting.md).
+
+[!INCLUDE [Privileged role feature](../../includes/privileged-role-feature-include.md)]
> [!NOTE]
-> You must be a [Global Administrator](../role-based-access-control/permissions-reference.md#global-administrator), and you must opt-in for this data to be gathered for your organization. To opt in, you must visit the Reporting tab or the audit logs on the Microsoft Entra admin center at least once. Until then, the data doesn't collect for your organization.
+> You must opt-in for this data to be gathered for your organization. To opt in, you must visit the Reporting tab or the audit logs on the Microsoft Entra admin center at least once. Until then, the data doesn't collect for your organization.
Audit logs for registration and password reset are available for 30 days. If security auditing within your corporation requires longer retention, the logs need to be exported and consumed into a SIEM tool such as [Microsoft Sentinel](/azure/sentinel/connect-azure-active-directory), Splunk, or ArcSight.
diff --git a/docs/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md b/docs/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md
index 1dcac9af675..0602e3bf850 100644
--- a/docs/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md
+++ b/docs/identity/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md
@@ -7,7 +7,7 @@ ms.service: entra-id
ms.subservice: authentication
ms.custom: has-azure-ad-ps-ref
ms.topic: conceptual
-ms.date: 09/14/2023
+ms.date: 10/04/2024
ms.author: justinha
author: justinha
@@ -108,7 +108,7 @@ Under each sign-in log, go to the **Authentication Details** tab and explore **S
To configure or review the *Remain signed-in* option, complete the following steps:
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).
+1. [!INCLUDE [Privileged role](../../includes/privileged-role-include.md)]
1. Browse to **Identity** > **Company Branding**, then for each locale, choose **Show option to remain signed in**.
1. Choose *Yes*, then select **Save**.
diff --git a/docs/identity/authentication/how-to-authentication-methods-manage.md b/docs/identity/authentication/how-to-authentication-methods-manage.md
index cb3f22ea7ba..49019bc07ec 100644
--- a/docs/identity/authentication/how-to-authentication-methods-manage.md
+++ b/docs/identity/authentication/how-to-authentication-methods-manage.md
@@ -5,7 +5,7 @@ description: Learn about how to centrally manage multifactor authentication and
ms.service: entra-id
ms.subservice: authentication
ms.topic: conceptual
-ms.date: 09/24/2023
+ms.date: 10/04/2024
ms.author: justinha
author: justinha
@@ -33,7 +33,12 @@ If you aren't using SSPR and aren't yet using the Authentication methods policy,
### Review the legacy MFA policy
-Start by documenting which methods are available in the legacy MFA policy. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator). Go to **Identity** > **Users** > **All users** > **Per-user MFA** > **service settings** to view the settings. These settings are tenant-wide, so there's no need for user or group information.
+Start by documenting which methods are available in the legacy MFA policy.
+
+[!INCLUDE [Privileged role](../../includes/privileged-role-include.md)]
+
+Go to **Identity** > **Users** > **All users** > **Per-user MFA** > **service settings** to view the settings.
+These settings are tenant-wide, so there's no need for user or group information.
:::image type="content" border="false" source="media/how-to-authentication-methods-manage/legacy-mfa-policy.png" alt-text="Screenshot the shows the legacy Microsoft Entra multifactor authentication policy." lightbox="media/how-to-authentication-methods-manage/legacy-mfa-policy.png":::
diff --git a/docs/identity/authentication/howto-authentication-methods-activity.md b/docs/identity/authentication/howto-authentication-methods-activity.md
index 165302626ef..0aea79f5566 100644
--- a/docs/identity/authentication/howto-authentication-methods-activity.md
+++ b/docs/identity/authentication/howto-authentication-methods-activity.md
@@ -136,7 +136,9 @@ The registration details report shows the following information for each user:
## Limitations
- The data in the report is not updated in real-time and may reflect a latency of up to a few hours.
-- The **PhoneAppNotification** or **PhoneAppOTP** methods that a user might have configured are not displayed in the dashboard on **Microsoft Entra authentication methods - Policies**.
+- The **PhoneAppNotification** or **PhoneAppOTP** methods that a user might have configured are not displayed in the dashboard on **Microsoft Entra authentication methods - Policies**.
+- Bulk operations in the Microsoft Entra admin portal could time out and fail on very large tenants. This limitation is a known issue due to scaling limitations. For more information, see [Bulk operations](/entra/fundamentals/bulk-operations-service-limitations?WT.mc_id=Portal-Microsoft_AAD_IAM).
+
## Next steps
diff --git a/docs/identity/authentication/howto-authentication-passwordless-phone.md b/docs/identity/authentication/howto-authentication-passwordless-phone.md
index d6bd9c00a9a..6541e63c270 100644
--- a/docs/identity/authentication/howto-authentication-passwordless-phone.md
+++ b/docs/identity/authentication/howto-authentication-passwordless-phone.md
@@ -7,7 +7,7 @@ ms.service: entra-id
ms.subservice: authentication
ms.custom: has-azure-ad-ps-ref
ms.topic: how-to
-ms.date: 08/13/2024
+ms.date: 10/04/2024
ms.author: justinha
@@ -141,7 +141,6 @@ The Authentication methods policy is the recommended way to manage Microsoft Aut
Admins can also configure parameters to better control how Microsoft Authenticator can be used. For example, they can add location or app name to the sign-in request so users have greater context before they approve.
-Global Administrators can also manage Microsoft Authenticator on a tenant-wide basis by using legacy MFA and SSPR policies. These policies allow Microsoft Authenticator to be enabled or disabled for all users in the tenant. There are no options to include or exclude anyone, or control how Microsoft Authenticator can be used for sign-in.
## Known issues
diff --git a/docs/identity/authentication/howto-authentication-passwordless-security-key-on-premises.md b/docs/identity/authentication/howto-authentication-passwordless-security-key-on-premises.md
index 32904683be6..20ca598c54c 100644
--- a/docs/identity/authentication/howto-authentication-passwordless-security-key-on-premises.md
+++ b/docs/identity/authentication/howto-authentication-passwordless-security-key-on-premises.md
@@ -132,17 +132,17 @@ _(Example: For US Government Cloud)_
### Example 1 prompt for all credentials
```powershell
- # Specify the on-premises Active Directory domain. A new Azure AD
+ # Specify the on-premises Active Directory domain. A new Microsoft Entra ID
# Kerberos Server object will be created in this Active Directory domain.
$domain = $env:USERDNSDOMAIN
# Enter an Azure Active Directory Global Administrator username and password.
- $cloudCred = Get-Credential -Message 'An Active Directory user who is a member of the Global Administrators group for Azure AD.'
+ $cloudCred = Get-Credential -Message 'An Active Directory user who is a member of the Global Administrators group for Microsoft Entra ID.'
# Enter a Domain Administrator username and password.
$domainCred = Get-Credential -Message 'An Active Directory user who is a member of the Domain Admins group.'
- # Create the new Azure AD Kerberos Server object in Active Directory
+ # Create the new Microsoft Entra ID Kerberos Server object in Active Directory
# and then publish it to Azure Active Directory.
Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred -DomainCredential $domainCred
```
@@ -152,14 +152,14 @@ _(Example: For US Government Cloud)_
> If you're working on a domain-joined machine with an account that has domain administrator privileges, you can skip the "-DomainCredential" parameter. If the "-DomainCredential" parameter isn't provided, the current Windows login credential is used to access your on-premises Active Directory Domain Controller.
```powershell
- # Specify the on-premises Active Directory domain. A new Azure AD
+ # Specify the on-premises Active Directory domain. A new Microsoft Entra ID
# Kerberos Server object will be created in this Active Directory domain.
$domain = $env:USERDNSDOMAIN
# Enter an Azure Active Directory Global Administrator username and password.
$cloudCred = Get-Credential
- # Create the new Azure AD Kerberos Server object in Active Directory
+ # Create the new Microsoft Entra ID Kerberos Server object in Active Directory
# and then publish it to Azure Active Directory.
# Use the current windows login credential to access the on-premises AD.
Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred
@@ -172,7 +172,7 @@ _(Example: For US Government Cloud)_
> - Replace `administrator@contoso.onmicrosoft.com` in the following example with the UPN of a Global Administrator.
```powershell
- # Specify the on-premises Active Directory domain. A new Azure AD
+ # Specify the on-premises Active Directory domain. A new Microsoft Entra ID
# Kerberos Server object will be created in this Active Directory domain.
$domain = $env:USERDNSDOMAIN
@@ -182,9 +182,9 @@ _(Example: For US Government Cloud)_
# Enter a Domain Administrator username and password.
$domainCred = Get-Credential
- # Create the new Azure AD Kerberos Server object in Active Directory
+ # Create the new Microsoft Entra ID Kerberos Server object in Active Directory
# and then publish it to Azure Active Directory.
- # Open an interactive sign-in prompt with given username to access the Azure AD.
+ # Open an interactive sign-in prompt with given username to access the Microsoft Entra ID.
Set-AzureADKerberosServer -Domain $domain -UserPrincipalName $userPrincipalName -DomainCredential $domainCred
```
@@ -194,16 +194,16 @@ _(Example: For US Government Cloud)_
> - Replace `administrator@contoso.onmicrosoft.com` in the following example with the UPN of a Global Administrator.
```powershell
- # Specify the on-premises Active Directory domain. A new Azure AD
+ # Specify the on-premises Active Directory domain. A new Microsoft Entra ID
# Kerberos Server object will be created in this Active Directory domain.
$domain = $env:USERDNSDOMAIN
# Enter a UPN of a Global Administrator
$userPrincipalName = "administrator@contoso.onmicrosoft.com"
- # Create the new Azure AD Kerberos Server object in Active Directory
+ # Create the new Microsoft Entra ID Kerberos Server object in Active Directory
# and then publish it to Azure Active Directory.
- # Open an interactive sign-in prompt with given username to access the Azure AD.
+ # Open an interactive sign-in prompt with given username to access the Microsoft Entra ID.
Set-AzureADKerberosServer -Domain $domain -UserPrincipalName $userPrincipalName
```
diff --git a/docs/identity/authentication/howto-authentication-temporary-access-pass.md b/docs/identity/authentication/howto-authentication-temporary-access-pass.md
index d96a9c077e1..8971afeba0e 100644
--- a/docs/identity/authentication/howto-authentication-temporary-access-pass.md
+++ b/docs/identity/authentication/howto-authentication-temporary-access-pass.md
@@ -67,8 +67,7 @@ To configure the TAP authentication method policy:
After you enable a TAP policy, you can create TAPs for users in Microsoft Entra ID. These following roles can perform various actions related to a TAP.
-- Global Administrators can create, delete, and view a TAP for any user (except themselves).
-- Privileged Authentication Administrators can create, delete, and view a TAP for admins and members (except themselves).
+- Those assigned at least the Privileged Authentication Administrator role can create, delete, and view a TAP for admins and members (except themselves).
- Authentication Administrators can create, delete, and view a TAP for members (except themselves).
- Global Readers can view TAP details for the user (without reading the code itself).
diff --git a/docs/identity/authentication/howto-mfa-reporting-datacollection.md b/docs/identity/authentication/howto-mfa-reporting-datacollection.md
index 10df3eb109d..7ebc41fcbd6 100644
--- a/docs/identity/authentication/howto-mfa-reporting-datacollection.md
+++ b/docs/identity/authentication/howto-mfa-reporting-datacollection.md
@@ -195,7 +195,7 @@ Use the Microsoft Privacy portal to make a request for Account Close to delete a
Users can add answers to security questions as part of SSPR. Security questions and answers are hashed to prevent unauthorized access. Only the hashed data is saved, so the security questions and answers can't be exported. Users can go to [My sign-ins](https://mysignins.microsoft.com/security-info) to edit or delete them. The only other information saved for SSPR is the user email address.
-Global Administrators can remove data collected for any user. On the **Users** page in Microsoft Entra ID, click **Authentication methods** and select a user to remove their phone or email address.
+Those assigned the [Privileged Authentication Administrator](/entra/identity/role-based-access-control/permissions-reference#privileged-authentication-administrator) role can remove data collected for any user. On the **Users** page in Microsoft Entra ID, click **Authentication methods** and select a user to remove their phone or email address.
## Next steps
diff --git a/docs/identity/authentication/howto-registration-mfa-sspr-combined-troubleshoot.md b/docs/identity/authentication/howto-registration-mfa-sspr-combined-troubleshoot.md
index a17ebfbba5f..13971d14db9 100644
--- a/docs/identity/authentication/howto-registration-mfa-sspr-combined-troubleshoot.md
+++ b/docs/identity/authentication/howto-registration-mfa-sspr-combined-troubleshoot.md
@@ -131,7 +131,7 @@ The steps that follow will help you roll back a user or group of users.
#### Rollback
-In a PowerShell window, run the following command, providing the script and user file locations. Enter Global Administrator credentials when prompted. The script will output the outcome of each user update operation.
+In a PowerShell window, run the following command, providing the script and user file locations. Provide at least [Privileged Authentication Administrator](/entra/identity/role-based-access-control/permissions-reference#privileged-authentication-administrator) credentials when prompted. The script will output the outcome of each user update operation.
`