From d2137cb78ed885ddc9eb7b8b2718696d9c10b94b Mon Sep 17 00:00:00 2001 From: Ortagus Winfrey <85191667+OWinfreyATL@users.noreply.github.com> Date: Mon, 7 Oct 2024 07:56:08 -0400 Subject: [PATCH 01/13] Access review note --- docs/id-governance/create-access-review.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/id-governance/create-access-review.md b/docs/id-governance/create-access-review.md index bc469bd843d..445172ca7a7 100644 --- a/docs/id-governance/create-access-review.md +++ b/docs/id-governance/create-access-review.md @@ -28,6 +28,9 @@ This article describes how to create one or more access reviews for group member - To review Azure resource or Microsoft Entra roles, see [Create an access review of Azure resource and Microsoft Entra roles in Privileged Identity Management](privileged-identity-management/pim-create-roles-and-resource-roles-review.md). - For reviews of PIM for Groups, see [create an access review of PIM for Groups](create-access-review-pim-for-groups.md). +> [!NOTE] +> In a group review, nested groups will be automatically flattened, so users from nested groups will appear as individual users. If a user is flagged for removal due to their membership in a nested group, they will not be automatically removed from the nested group—only from direct group membership. + ## Prerequisites - Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses. From b9b3cf20f4b312c52a0d956f582f7f8be384d523 Mon Sep 17 00:00:00 2001 From: Ortagus Winfrey <85191667+OWinfreyATL@users.noreply.github.com> Date: Mon, 7 Oct 2024 08:02:25 -0400 Subject: [PATCH 02/13] GDPR note was removed --- docs/fundamentals/how-to-create-delete-users.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/fundamentals/how-to-create-delete-users.yml b/docs/fundamentals/how-to-create-delete-users.yml index 380a3149078..192209e6ed3 100644 --- a/docs/fundamentals/how-to-create-delete-users.yml +++ b/docs/fundamentals/how-to-create-delete-users.yml @@ -23,7 +23,6 @@ introduction: | This article explains how to create a new user, invite an external guest, and delete a user in your workforce tenant. It also includes information about creating users in an external tenant for [Microsoft Entra External ID](~/external-id/customers/overview-customers-ciam.md) scenarios. - [!INCLUDE [GDPR-related guidance](~/../azure-docs-pr/includes/gdpr-hybrid-note.md)] ## Types of users From 91670fa6cd9c1bb7ce4b5ae94120b45116f0741b Mon Sep 17 00:00:00 2001 From: Ortagus Winfrey <85191667+OWinfreyATL@users.noreply.github.com> Date: Mon, 7 Oct 2024 08:07:10 -0400 Subject: [PATCH 03/13] Update location --- docs/id-governance/create-access-review.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/id-governance/create-access-review.md b/docs/id-governance/create-access-review.md index 445172ca7a7..d1c64795d22 100644 --- a/docs/id-governance/create-access-review.md +++ b/docs/id-governance/create-access-review.md @@ -28,9 +28,6 @@ This article describes how to create one or more access reviews for group member - To review Azure resource or Microsoft Entra roles, see [Create an access review of Azure resource and Microsoft Entra roles in Privileged Identity Management](privileged-identity-management/pim-create-roles-and-resource-roles-review.md). - For reviews of PIM for Groups, see [create an access review of PIM for Groups](create-access-review-pim-for-groups.md). -> [!NOTE] -> In a group review, nested groups will be automatically flattened, so users from nested groups will appear as individual users. If a user is flagged for removal due to their membership in a nested group, they will not be automatically removed from the nested group—only from direct group membership. - ## Prerequisites - Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses. @@ -49,6 +46,9 @@ If you're reviewing access to an application, then before you create the review, > [!NOTE] > Access reviews capture a snapshot of access at the beginning of each review instance. Any changes made during the review process will be reflected in the subsequent review cycle. Essentially, with the commencement of each new recurrence, pertinent data regarding the users, resources under review, and their respective reviewers is retrieved. +> [!NOTE] +> In a group review, nested groups will be automatically flattened, so users from nested groups will appear as individual users. If a user is flagged for removal due to their membership in a nested group, they will not be automatically removed from the nested group—only from direct group membership. + ## Create a single-stage access review ### Scope From 0ced8d33418e9441e42a0246df32f632c0087951 Mon Sep 17 00:00:00 2001 From: Ortagus Winfrey <85191667+OWinfreyATL@users.noreply.github.com> Date: Mon, 7 Oct 2024 08:14:45 -0400 Subject: [PATCH 04/13] clarification --- docs/id-governance/create-access-review.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/id-governance/create-access-review.md b/docs/id-governance/create-access-review.md index d1c64795d22..378a4b93ce0 100644 --- a/docs/id-governance/create-access-review.md +++ b/docs/id-governance/create-access-review.md @@ -47,7 +47,7 @@ If you're reviewing access to an application, then before you create the review, > Access reviews capture a snapshot of access at the beginning of each review instance. Any changes made during the review process will be reflected in the subsequent review cycle. Essentially, with the commencement of each new recurrence, pertinent data regarding the users, resources under review, and their respective reviewers is retrieved. > [!NOTE] -> In a group review, nested groups will be automatically flattened, so users from nested groups will appear as individual users. If a user is flagged for removal due to their membership in a nested group, they will not be automatically removed from the nested group—only from direct group membership. +> In a group review, nested groups will be automatically flattened, so users from nested groups will appear as individual users. If a user is flagged for removal due to their membership in a nested group, they will not be automatically removed from the nested group, but only from direct group membership. ## Create a single-stage access review From b11126662e684491e32babb07134fea061516f21 Mon Sep 17 00:00:00 2001 From: Ken Withee <27743960+kenwith@users.noreply.github.com> Date: Mon, 7 Oct 2024 08:59:19 -0700 Subject: [PATCH 05/13] Adds clarity around pre authentication. --- docs/identity/app-proxy/application-proxy-faq.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/identity/app-proxy/application-proxy-faq.yml b/docs/identity/app-proxy/application-proxy-faq.yml index 010dd9ce048..898a7df9ec8 100644 --- a/docs/identity/app-proxy/application-proxy-faq.yml +++ b/docs/identity/app-proxy/application-proxy-faq.yml @@ -206,12 +206,12 @@ sections: In this case there's a fallback to “User principal name”. For more details on the B2B scenario, please read [Grant B2B users in Microsoft Entra ID access to your on-premises applications](~/external-id/hybrid-cloud-to-on-premises.md). - - name: Pass-through authentication + - name: Passthrough pre authentication questions: - question: | - Can I use Conditional Access Policies for applications published with pass-through authentication? + Can I use Conditional Access Policies for applications published with passthrough pre authentication? answer: | - Conditional Access Policies are only enforced for successfully preauthenticated users in Microsoft Entra ID. Pass-through authentication doesn’t trigger Microsoft Entra authentication, so Conditional Access Policies can't be enforced. With pass-through authentication, MFA policies must be implemented on the on-premises server, if possible, or by enabling preauthentication with Microsoft Entra application proxy. + Conditional Access Policies are only enforced for successfully preauthenticated users in Microsoft Entra ID. Passthrough pre authentication doesn’t trigger Microsoft Entra authentication, so Conditional Access Policies can't be enforced. With passthrough pre authentication, MFA policies must be implemented on the on-premises server, if possible, or by enabling Microsoft Entra ID pre authentication with Microsoft Entra application proxy. - question: | Can I publish a web application with client certificate authentication requirement? From 34b107b008628d50d6d90119c19ca0a8931b9245 Mon Sep 17 00:00:00 2001 From: Ken Withee <27743960+kenwith@users.noreply.github.com> Date: Mon, 7 Oct 2024 09:07:59 -0700 Subject: [PATCH 06/13] Changes to one word, preauthentication, for clarity. --- docs/identity/app-proxy/application-proxy-faq.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/identity/app-proxy/application-proxy-faq.yml b/docs/identity/app-proxy/application-proxy-faq.yml index 898a7df9ec8..74670cdf015 100644 --- a/docs/identity/app-proxy/application-proxy-faq.yml +++ b/docs/identity/app-proxy/application-proxy-faq.yml @@ -206,12 +206,12 @@ sections: In this case there's a fallback to “User principal name”. For more details on the B2B scenario, please read [Grant B2B users in Microsoft Entra ID access to your on-premises applications](~/external-id/hybrid-cloud-to-on-premises.md). - - name: Passthrough pre authentication + - name: Passthrough preauthentication questions: - question: | - Can I use Conditional Access Policies for applications published with passthrough pre authentication? + Can I use Conditional Access Policies for applications published with passthrough preauthentication? answer: | - Conditional Access Policies are only enforced for successfully preauthenticated users in Microsoft Entra ID. Passthrough pre authentication doesn’t trigger Microsoft Entra authentication, so Conditional Access Policies can't be enforced. With passthrough pre authentication, MFA policies must be implemented on the on-premises server, if possible, or by enabling Microsoft Entra ID pre authentication with Microsoft Entra application proxy. + Conditional Access Policies are only enforced for successfully preauthenticated users in Microsoft Entra ID. Passthrough preauthentication doesn’t trigger Microsoft Entra authentication, so Conditional Access Policies can't be enforced. With passthrough preauthentication, MFA policies must be implemented on the on-premises server, if possible, or by enabling Microsoft Entra ID preauthentication with Microsoft Entra application proxy. - question: | Can I publish a web application with client certificate authentication requirement? From 789921435ae79aaaee92ff7d3e3d5e5f8df7ab3c Mon Sep 17 00:00:00 2001 From: Justinha Date: Mon, 7 Oct 2024 09:24:45 -0700 Subject: [PATCH 07/13] removed Global Admin --- docs/identity/domain-services/check-health.md | 4 ++-- docs/identity/domain-services/csp.md | 9 +++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/identity/domain-services/check-health.md b/docs/identity/domain-services/check-health.md index ce0127432ec..82dfd49346e 100644 --- a/docs/identity/domain-services/check-health.md +++ b/docs/identity/domain-services/check-health.md @@ -8,7 +8,7 @@ ms.assetid: 8999eec3-f9da-40b3-997a-7a2587911e96 ms.service: entra-id ms.subservice: domain-services ms.topic: how-to -ms.date: 09/13/2023 +ms.date: 10/07/2023 ms.author: justinha --- # Check the health of a Microsoft Entra Domain Services managed domain @@ -21,7 +21,7 @@ This article shows you how to view the Domain Services health status and underst The health status for a managed domain is viewed using the Microsoft Entra admin center. Information on the last backup time and synchronization with Microsoft Entra ID can be seen, along with any alerts that indicate a problem with the managed domain's health. To view the health status for a managed domain, complete the following steps: -1. Sign in to [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator). +1. [!INCLUDE [Privileged role](~/includes/privileged-role-include.md)] 1. Search for and select **Microsoft Entra Domain Services**. 1. Select your managed domain, such as *aaddscontoso.com*. 1. On the left-hand side of the Domain Services resource window, select **Health**. The following example screenshot shows a healthy managed domain and the status of the last backup and Microsoft Entra synchronization: diff --git a/docs/identity/domain-services/csp.md b/docs/identity/domain-services/csp.md index a7473c4a998..b7c77c247ca 100644 --- a/docs/identity/domain-services/csp.md +++ b/docs/identity/domain-services/csp.md @@ -7,7 +7,7 @@ ms.assetid: 56ccb219-11b2-4e43-9f07-5a76e3cd8da8 ms.service: entra-id ms.subservice: domain-services ms.topic: conceptual -ms.date: 09/15/2023 +ms.date: 10/07/2024 ms.author: justinha --- # Microsoft Entra Domain Services deployment and management for Azure Cloud Solution Providers @@ -50,8 +50,9 @@ There are two ways in which you can use Domain Services with an Azure CSP subscr In this deployment model, Domain Services is enabled within a virtual network that belongs to the Azure CSP subscription. The CSP partner's admin agents have the following privileges: -* *Global Administrator* privileges in the customer's Microsoft Entra tenant. -* *Subscription owner* privileges on the Azure CSP subscription. +[!INCLUDE [Privileged role feature](~/includes/privileged-role-feature-include.md)] + +Subscription owner privileges on the Azure CSP subscription are required for this feature. ![Direct deployment model](./media/csp/csp_direct_deployment_model.png) @@ -67,7 +68,7 @@ With this deployment, the workloads or applications deployed by the CSP partner ![Peered deployment model](./media/csp/csp_peered_deployment_model.png) -This deployment model provides a separation of privileges and enables the CSP partner's helpdesk agents to administer the Azure subscription and deploy and manage resources within it. However, the CSP partner's helpdesk agents don't need to have Global Administrator privileges on the customer's Microsoft Entra directory. The customer's identity administrators can continue to manage identities for their organization. +This deployment model provides a separation of privileges and enables the CSP partner's helpdesk agents to administer the Azure subscription and deploy and manage resources within it. However, the CSP partner's helpdesk agents don't need a highly privileged role in the customer's Microsoft Entra directory. The customer's identity administrators can continue to manage identities for their organization. This deployment model may be suited to scenarios where an ISV provides a hosted version of their on-premises application, which also needs to connect to the customer's Microsoft Entra ID. From 99374e5494edd03b2773801956fdc6b2218e692b Mon Sep 17 00:00:00 2001 From: Michele Martin <36167252+msmimart@users.noreply.github.com> Date: Mon, 7 Oct 2024 11:27:00 -0500 Subject: [PATCH 08/13] SMS MFA general availability --- .../concept-multifactor-authentication-customers.md | 8 +++++--- .../customers/concept-supported-features-customers.md | 5 +++-- .../how-to-multifactor-authentication-customers.md | 8 ++++---- docs/external-id/customers/reference-service-limits.md | 3 ++- 4 files changed, 14 insertions(+), 10 deletions(-) diff --git a/docs/external-id/customers/concept-multifactor-authentication-customers.md b/docs/external-id/customers/concept-multifactor-authentication-customers.md index 6c2f8b89bfb..9398db5f7eb 100644 --- a/docs/external-id/customers/concept-multifactor-authentication-customers.md +++ b/docs/external-id/customers/concept-multifactor-authentication-customers.md @@ -23,7 +23,7 @@ ms.custom: it-pro, references_regions [Multifactor authentication (MFA)](~/identity/authentication/concept-mfa-howitworks.md) adds a layer of security to your applications by requiring users to provide a second method for verifying their identity during sign-up or sign-in. External tenants support two methods for authentication as a second factor: - Email one-time passcode -- SMS based authentication, available as an add-on [see details](#sms-based-authentication-preview). +- SMS based authentication, available as an add-on [see details](#sms-based-authentication). Enforcing MFA enhances your organization's security by adding an extra layer of verification, making it more difficult for unauthorized users to gain access. @@ -52,9 +52,9 @@ Email one-time passcode authentication is available in an external tenant both a When email one-time passcode is enabled for MFA, the user signs in with their primary sign-in method and is notified that a code will be sent to the user's email address. The user chooses to send the code, retrieves the passcode from their email inbox, and enters it in the sign-in window. -## SMS-based authentication (preview) +## SMS-based authentication -SMS is available at additional cost for second-factor verification in external tenants. Currently, SMS is not available for first-factor authentication or self-service password reset in external tenants. +SMS is available at additional cost for second-factor verification in external tenants. Currently, SMS isn't available for first-factor authentication or self-service password reset in external tenants. When SMS is enabled for MFA, users sign in with their primary method and are prompted to verify their identity with a code sent via text. They enter their phone number and receive an SMS with the verification code. @@ -69,6 +69,8 @@ External ID mitigates fraudulent sign-ups and sign-ins via SMS by enforcing the The following table provides details about the different pricing tiers for SMS based authentication services across various countries or regions. For pricing details, see [Microsoft Entra External ID pricing](https://aka.ms/ExternalIDPricing). +The SMS feature requires a [linked subscription](../external-identities-pricing.md#link-an-external-tenant-to-a-subscription) and the External ID SMS Phone Authentication add-on. If your subscription expires or is cancelled, the feature will be disabled. + |Tier |Countries/Regions | |-----------------------------------|-------------------| |Phone Authentication Low Cost |Australia, Brazil, Brunei, Canada, Chile, China, Colombia, Cyprus, Macedonia, Poland, Portugal, South Korea, Thailand, Turkey, United States | diff --git a/docs/external-id/customers/concept-supported-features-customers.md b/docs/external-id/customers/concept-supported-features-customers.md index 6ee279ccfd6..2d392ddb58f 100644 --- a/docs/external-id/customers/concept-supported-features-customers.md +++ b/docs/external-id/customers/concept-supported-features-customers.md @@ -71,7 +71,7 @@ The following table compares the [identity providers](../identity-providers.md) |Feature |Workforce tenant | External tenant | |---------|---------|---------| | **Identity providers for external users (primary authentication)** | **For self-service sign-up guests**
- Microsoft Entra accounts
- Microsoft accounts
- Email one-time passcode
- Google federation
- Facebook federation

**For invited guests**
- Microsoft Entra accounts
- Microsoft accounts
- Email one-time passcode
- Google federation
- SAML/WS-Fed federation | **For self-service sign-up users (consumers, business customers)**
- [Email with password](concept-authentication-methods-customers.md#email-and-password-sign-in)
- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)
- [Google federation (preview)](./how-to-google-federation-customers.md)
- [Facebook federation (preview)](./how-to-facebook-federation-customers.md)

**For invited guests (preview)**
Guests invited with a directory role (for example, admins):
- Microsoft Entra accounts
- Microsoft accounts
- [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in) | -| **Authentication methods for MFA** | **For internal users (employees and admins)**
- [Authentication and verification methods](~/identity/authentication/concept-authentication-methods.md)
**For guests (invited or self-service sign-up)**
- [Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users) | **For self-service sign-up users (consumers, business customers) or invited users (preview)**
- [Email one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)
- [SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication-preview) | +| **Authentication methods for MFA** | **For internal users (employees and admins)**
- [Authentication and verification methods](~/identity/authentication/concept-authentication-methods.md)
**For guests (invited or self-service sign-up)**
- [Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users) | **For self-service sign-up users (consumers, business customers) or invited users (preview)**
- [Email one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)
- [SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication) | ## Application registration @@ -81,7 +81,7 @@ The following table compares the features available for [Application registratio |---------|---------|---------| | **Protocol** | SAML relying parties, OpenID Connect, and OAuth2 | OpenID Connect and OAuth2 | | **Supported account types**| The following [account types](~/identity-platform/quickstart-register-app.md#register-an-application): | Always use *Accounts in this organizational directory only (Single tenant)*. | -| **Platform** | The following [platforms](~/identity-platform/quickstart-register-app.md#configure-platform-settings):