From f271d2a2ef55fbc567b7b05ad775a9916ec839a4 Mon Sep 17 00:00:00 2001 From: Nathan McNulty <6653432+nathanmcnulty@users.noreply.github.com> Date: Thu, 7 Nov 2024 10:43:02 -0900 Subject: [PATCH 01/11] Fix PowerShell command -Search returns 3 results breaking the rest of the directions. Use Where-Object instead. --- docs/identity/users/groups-assign-sensitivity-labels.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/identity/users/groups-assign-sensitivity-labels.md b/docs/identity/users/groups-assign-sensitivity-labels.md index 86963014a7a..39b6e662f9c 100644 --- a/docs/identity/users/groups-assign-sensitivity-labels.md +++ b/docs/identity/users/groups-assign-sensitivity-labels.md @@ -46,7 +46,8 @@ All Microsoft operated regions should choose Microsoft. All other regions should 1. Fetch the current group settings for the Microsoft Entra organization and display the current group settings. ```powershell - $grpUnifiedSetting = Get-MgBetaDirectorySetting -Search DisplayName:"Group.Unified" + $grpUnifiedSetting = Get-MgBetaDirectorySetting | Where-Object { $_.Values.Name -eq "EnableMIPLabels" } + $grpUnifiedSetting.Values ``` If no group settings were created for this Microsoft Entra organization, you get an empty screen. In this case, you must first create the settings. Follow the steps in [Microsoft Entra cmdlets for configuring group settings](~/identity/users/groups-settings-cmdlets.md) to create group settings for this Microsoft Entra organization. From 78a9e899e6ce33298bf4012375cd30738755794e Mon Sep 17 00:00:00 2001 From: Alexander Pavlovsky Date: Wed, 27 Nov 2024 14:54:04 -0800 Subject: [PATCH 02/11] removing an erroneous character --- docs/global-secure-access/concept-traffic-forwarding.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/global-secure-access/concept-traffic-forwarding.md b/docs/global-secure-access/concept-traffic-forwarding.md index af312864ed5..431e4206289 100644 --- a/docs/global-secure-access/concept-traffic-forwarding.md +++ b/docs/global-secure-access/concept-traffic-forwarding.md @@ -34,7 +34,7 @@ The Microsoft traffic forwarding profile includes Microsoft Entra ID/ Microsoft Microsoft traffic is forwarded to the service through either [remote network connectivity](concept-remote-network-connectivity.md), such as branch office location, or through the [Global Secure Access client](how-to-install-windows-client.md). -[Learn more about the Microsoft traffic profile](concept-microsoft-traffic-profile.md)\ +[Learn more about the Microsoft traffic profile](concept-microsoft-traffic-profile.md) ### Licensing From 13e7876f038bd1607dfb785fa9ac40753af79d47 Mon Sep 17 00:00:00 2001 From: Andre Kolodochka <59625655+andrekolodochka@users.noreply.github.com> Date: Mon, 9 Dec 2024 11:05:20 +1100 Subject: [PATCH 03/11] Updating the text for OIDC Provisioning --- ...thub-enterprise-managed-user-oidc-provisioning-tutorial.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/identity/saas-apps/github-enterprise-managed-user-oidc-provisioning-tutorial.md b/docs/identity/saas-apps/github-enterprise-managed-user-oidc-provisioning-tutorial.md index 1610069011c..2d91a6dfd42 100644 --- a/docs/identity/saas-apps/github-enterprise-managed-user-oidc-provisioning-tutorial.md +++ b/docs/identity/saas-apps/github-enterprise-managed-user-oidc-provisioning-tutorial.md @@ -114,7 +114,7 @@ This section guides you through the steps to configure the Microsoft Entra provi 7. Select **Save**. -8. Under the **Mappings** section, select **Synchronize Microsoft Entra users to GitHub Enterprise Managed User (OIDC)**. +8. Under the **Mappings** section, select **Provision Microsoft Entra ID Users**. 9. Review the user attributes that are synchronized from Microsoft Entra ID to GitHub Enterprise Managed User (OIDC) in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in GitHub Enterprise Managed User (OIDC) for update operations. If you choose to change the [matching target attribute](~/identity/app-provisioning/customize-application-attributes.md), you need to ensure that the GitHub Enterprise Managed User (OIDC) API supports filtering users based on that attribute. Select the **Save** button to commit any changes. @@ -132,7 +132,7 @@ This section guides you through the steps to configure the Microsoft Entra provi |emails[type eq "home"].value|String| |emails[type eq "other"].value|String| -10. Under the **Mappings** section, select **Synchronize Microsoft Entra groups to GitHub Enterprise Managed User (OIDC)**. +10. Under the **Mappings** section, select **Provision Microsoft Entra ID Groups**. 11. Review the group attributes that are synchronized from Microsoft Entra ID to GitHub Enterprise Managed User (OIDC) in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the groups in GitHub Enterprise Managed User (OIDC) for update operations. Select the **Save** button to commit any changes. From 7b04cd9c47569336ebb9160796d5b97c0b263602 Mon Sep 17 00:00:00 2001 From: Theano Petersen Date: Mon, 9 Dec 2024 14:32:37 -0800 Subject: [PATCH 04/11] Policheck Sev 1: Update how-to-region-code-opt-in.md Fix Policheck bug https://dev.azure.com/msft-skilling/learn-platform-policheck/_queries/edit/344910 --- docs/external-id/customers/how-to-region-code-opt-in.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/external-id/customers/how-to-region-code-opt-in.md b/docs/external-id/customers/how-to-region-code-opt-in.md index 2588b023d77..ed5154056fe 100644 --- a/docs/external-id/customers/how-to-region-code-opt-in.md +++ b/docs/external-id/customers/how-to-region-code-opt-in.md @@ -111,7 +111,7 @@ Starting January 2025, the following country codes will be deactivated by defaul | 234 | Nigeria | | 968 | Oman | | 92 | Pakistan | -| 970 | Palestine | +| 970 | Palestinian Authority | | 675 | Papua New Guinea | | 63 | Philippines | | 974 | Qatar | From 859ca906b06110a327c553c38f1dabebf11afa21 Mon Sep 17 00:00:00 2001 From: Brian Melton-Grace Date: Mon, 9 Dec 2024 16:31:34 -0800 Subject: [PATCH 05/11] Add known macOS concurrency issue to PSSO TSG Documents a known device configuration corruption issue that is currently being investigated by Apple --- ...hoot-macos-platform-single-sign-on-extension.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/identity/devices/troubleshoot-macos-platform-single-sign-on-extension.md b/docs/identity/devices/troubleshoot-macos-platform-single-sign-on-extension.md index 82dd244e234..5fb397da0a3 100644 --- a/docs/identity/devices/troubleshoot-macos-platform-single-sign-on-extension.md +++ b/docs/identity/devices/troubleshoot-macos-platform-single-sign-on-extension.md @@ -109,6 +109,20 @@ Users can reset the local password via Apple ID or an admin recovery key. ## Known issues +### Unexpected/frequent re-registration prompts on macOS Sequoia + +There is a known concurrency issue on macOS 15+ (Sequoia) that can cause the PSSO device configuration to become corrupted. The device configuration can be corrupted by simultaneous updates from the system AppSSOAgent and AppSSODaemon processes. The corrupted configuration causes the operating system to trigger its re-registration remediation flow, resulting in unexpected registration prompts for users. + +This issue is currently being investigated by Apple and is expected to be fixed in an upcoming operating system update. + +Sysdiagnose logs from affected users contain the following error: + +``` +Error Domain=com.apple.PlatformSSO Code=-1001 "Error deserializing device config." UserInfo={NSLocalizedDescription=Error deserializing device config., NSUnderlyingError=0x9480343f0 {Error Domain=NSCocoaErrorDomain Code=3840 "Garbage at end around line 27, column 1." UserInfo={NSDebugDescription=Garbage at end around line 27, column 1., NSJSONSerializationErrorIndex=3052}}} +``` + +We encourage users and admins who encounter this error to file an Apple Care issue and engage with Apple to resolve the issue. + ### Passcode policy complexity mismatches There's a known issue where an applied MDM configuration specifies a local password policy with a higher degree of complexity than the Microsoft Entra account used to sign-in to the machine. In this case, the password synchronization operation between Microsoft Entra ID and the local machine fails. From 4676275e46334469a93a3d1aba780ec4754a36c5 Mon Sep 17 00:00:00 2001 From: TheWriteDoc <187326664+TheWriteDoc@users.noreply.github.com> Date: Tue, 10 Dec 2024 09:12:03 -0800 Subject: [PATCH 06/11] november 2024 refresh set 22 --- docs/identity/hybrid/decommission-connect-sync-v1.md | 4 ++-- docs/identity/hybrid/exchange-hybrid-writeback.md | 2 +- docs/identity/hybrid/get-started.md | 2 +- docs/identity/hybrid/install.md | 10 +++++----- docs/identity/hybrid/on-demand-provision.md | 2 +- docs/identity/hybrid/prerequisites.md | 4 ++-- docs/identity/hybrid/sso.md | 4 ++-- docs/identity/hybrid/sync-tools.md | 2 +- docs/identity/hybrid/verify-sync-tool-version.md | 2 +- .../hybrid/what-is-inter-directory-provisioning.md | 2 +- docs/identity/hybrid/what-is-provisioning.md | 4 ++-- .../cross-tenant-synchronization-topology.md | 2 +- 12 files changed, 20 insertions(+), 20 deletions(-) diff --git a/docs/identity/hybrid/decommission-connect-sync-v1.md b/docs/identity/hybrid/decommission-connect-sync-v1.md index 7f4d32da598..f0a7245e9b8 100644 --- a/docs/identity/hybrid/decommission-connect-sync-v1.md +++ b/docs/identity/hybrid/decommission-connect-sync-v1.md @@ -9,7 +9,7 @@ editor: '' ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath @@ -20,7 +20,7 @@ ms.custom: docutune-disable The one-year advanced notice of Azure AD Connect V1's retirement was announced in August 2021. As of August 31, 2022, all V1 versions went out of support and were subject to stop working unexpectedly at any point. -On **October 1, 2023**, Microsoft Entra cloud services stopped accepting connections from Azure AD Connect V1 servers, and identities will no longer synchronize. +On **October 1, 2023**, Microsoft Entra cloud services stopped accepting connections from Azure AD Connect V1 servers, and identities no longer synchronize. If you are still using Azure AD Connect V1 you must take action immediately. diff --git a/docs/identity/hybrid/exchange-hybrid-writeback.md b/docs/identity/hybrid/exchange-hybrid-writeback.md index b2a4f7ed960..2513ffc4920 100644 --- a/docs/identity/hybrid/exchange-hybrid-writeback.md +++ b/docs/identity/hybrid/exchange-hybrid-writeback.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath diff --git a/docs/identity/hybrid/get-started.md b/docs/identity/hybrid/get-started.md index 700b12fe1fb..4d0df867e2a 100644 --- a/docs/identity/hybrid/get-started.md +++ b/docs/identity/hybrid/get-started.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath diff --git a/docs/identity/hybrid/install.md b/docs/identity/hybrid/install.md index a4dc9517762..54bb9b2a72f 100644 --- a/docs/identity/hybrid/install.md +++ b/docs/identity/hybrid/install.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath @@ -30,8 +30,8 @@ Cloud sync uses the Microsoft Entra provisioning agent. Use the steps below to >See "[Install an agent in the US government cloud](cloud-sync/how-to-install.md#install-an-agent-in-the-us-government-cloud)" for more information. 7. On the splash screen, select **I agree to the license and conditions**, and then select **Install**. - 8. Once the installation operation completes, the configuration wizard will launch. Select **Next** to start the configuration. - 9. On the **Select Extension** screen, select **HR-driven provisioning (Workday and SuccessFactors) / Microsoft Entra Connect cloud sync** and click **Next**. + 8. Once the installation operation completes, the configuration wizard launches. Select **Next** to start the configuration. + 9. On the **Select Extension** screen, select **HR-driven provisioning (Workday and SuccessFactors) / Microsoft Entra Connect cloud sync** and select **Next**. 10. Sign in with your Microsoft Entra Hybrid Identity Administrator account. 11. On the **Configure Service Account** screen, select a group Managed Service Account (gMSA). This account is used to run the agent service. To continue, select **Next**. 12. On the **Connect Active Directory** screen, if your domain name appears under **Configured domains**, skip to the next step. Otherwise, type your Active Directory domain name, and select **Add directory**. @@ -48,8 +48,8 @@ For more information, see [Installing the provisioning agent](cloud-sync/how-to- ## Install Microsoft Entra Connect with express settings Express settings are the default option to install Microsoft Entra Connect, and it's used for the most commonly deployed scenario. - 1. Sign in as Local Administrator on the server you want to install Microsoft Entra Connect on. The server you sign in on will be the sync server. - 2. Go to *AzureADConnect.msi* and double-click to open the installation file. + 1. Sign in as Local Administrator on the server you want to install Microsoft Entra Connect on. The server you sign in on is the sync server. + 2. Go to *AzureADConnect.msi* and double-select to open the installation file. 3. On **Welcome**, select the checkbox to agree to the licensing terms, and then select **Continue**. 4. On **Express settings**, select **Use express settings**. 5. On **Connect to Microsoft Entra ID**, enter the username and password of the Hybrid Identity Administrator account, and then select **Next**. diff --git a/docs/identity/hybrid/on-demand-provision.md b/docs/identity/hybrid/on-demand-provision.md index 687c2509c67..eea58e5bab1 100644 --- a/docs/identity/hybrid/on-demand-provision.md +++ b/docs/identity/hybrid/on-demand-provision.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath diff --git a/docs/identity/hybrid/prerequisites.md b/docs/identity/hybrid/prerequisites.md index f15d8bdb50c..4c8f92ca08d 100644 --- a/docs/identity/hybrid/prerequisites.md +++ b/docs/identity/hybrid/prerequisites.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath @@ -24,7 +24,7 @@ The following document provides the prerequisites for integrating with Active Di |-----|-----| |Windows server 2016 or greater that is or has:|• 4 GB RAM or more
• .NET 4.7.1 runtime or greater
• domain-joined
• PowerShell execution policy set to **Undefined** or **RemoteSigned**
• TLS 1.2 enabled
| |Active Directory|• On-premises AD that has a forest functional level 2003 or higher| -|Microsoft Entra tenant|• A tenant in Azure that will be used to synchronize from on-premises| +|Microsoft Entra tenant|• A tenant in Azure that's used to synchronize from on-premises| For more information on the cloud sync prerequisites, see [Cloud sync prerequisites](cloud-sync/how-to-prerequisites.md). diff --git a/docs/identity/hybrid/sso.md b/docs/identity/hybrid/sso.md index 130ca7936e0..78880f4046f 100644 --- a/docs/identity/hybrid/sso.md +++ b/docs/identity/hybrid/sso.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath @@ -19,7 +19,7 @@ Setting up single sign-on, depends on which synchronization tool you are using a ## Cloud sync -After installing the Microsoft Entra Connect provisioning agent, you will need to configure single sign-on for cloud sync. The following table provides a list of steps required for using single sign-on. +After installing the Microsoft Entra Connect provisioning agent, you need to configure single sign-on for cloud sync. The following table provides a list of steps required for using single sign-on. |Task|Description| |-----|-----| diff --git a/docs/identity/hybrid/sync-tools.md b/docs/identity/hybrid/sync-tools.md index 674658cee1d..0b0155498f2 100644 --- a/docs/identity/hybrid/sync-tools.md +++ b/docs/identity/hybrid/sync-tools.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath diff --git a/docs/identity/hybrid/verify-sync-tool-version.md b/docs/identity/hybrid/verify-sync-tool-version.md index 1d028da4673..3f897165427 100644 --- a/docs/identity/hybrid/verify-sync-tool-version.md +++ b/docs/identity/hybrid/verify-sync-tool-version.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id ms.topic: conceptual ms.tgt_pltfrm: na -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath diff --git a/docs/identity/hybrid/what-is-inter-directory-provisioning.md b/docs/identity/hybrid/what-is-inter-directory-provisioning.md index d99690388d9..0529e8a0091 100644 --- a/docs/identity/hybrid/what-is-inter-directory-provisioning.md +++ b/docs/identity/hybrid/what-is-inter-directory-provisioning.md @@ -6,7 +6,7 @@ author: billmath manager: amycolannino ms.service: entra-id ms.topic: overview -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath diff --git a/docs/identity/hybrid/what-is-provisioning.md b/docs/identity/hybrid/what-is-provisioning.md index 08d1577578d..ba3b2c185b5 100644 --- a/docs/identity/hybrid/what-is-provisioning.md +++ b/docs/identity/hybrid/what-is-provisioning.md @@ -6,7 +6,7 @@ author: billmath manager: amycolannino ms.service: entra-id ms.topic: overview -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: hybrid ms.author: billmath @@ -35,7 +35,7 @@ Provisioning from HR to the cloud involves the creation of objects (users, roles The most common scenario would be, when a new employee joins your company, they're entered into the HR system. Once that occurs, they're provisioned to the cloud. In this case, Microsoft Entra ID. Provisioning from HR can cover the following scenarios. - **Hiring new employees** - When a new employee is added to cloud HR, a user account is automatically created in Active Directory, Microsoft Entra ID, and optionally Microsoft 365 and other SaaS applications supported by Microsoft Entra ID, with write-back of the email address to Cloud HR. -- **Employee attribute and profile updates** - When an employee record is updated in cloud HR (such as their name, title, or manager), their user account will be automatically updated in Active Directory, Microsoft Entra ID, and optionally Microsoft 365 and other SaaS applications supported by Microsoft Entra ID. +- **Employee attribute and profile updates** - When an employee record is updated in cloud HR (such as their name, title, or manager), their user account automatically updates in Active Directory, Microsoft Entra ID, and optionally Microsoft 365 and other SaaS applications supported by Microsoft Entra ID. - **Employee terminations** - When an employee is terminated in cloud HR, their user account is automatically disabled in Active Directory, Microsoft Entra ID, and optionally Office 365 and other SaaS applications supported by Microsoft Entra ID. - **Employee rehires** - When an employee is rehired in cloud HR, their old account can be automatically reactivated or re-provisioned (depending on your preference) to Active Directory, Microsoft Entra ID, and optionally Microsoft 365 and other SaaS applications supported by Microsoft Entra ID. diff --git a/docs/identity/multi-tenant-organizations/cross-tenant-synchronization-topology.md b/docs/identity/multi-tenant-organizations/cross-tenant-synchronization-topology.md index 27a42a70e16..33df44fa39f 100644 --- a/docs/identity/multi-tenant-organizations/cross-tenant-synchronization-topology.md +++ b/docs/identity/multi-tenant-organizations/cross-tenant-synchronization-topology.md @@ -6,7 +6,7 @@ manager: amycolannino ms.service: entra-id ms.subservice: multitenant-organizations ms.topic: conceptual -ms.date: 11/03/2023 +ms.date: 12/10/2024 ms.author: rolyon ms.custom: it-pro #Customer intent: As a dev, devops, or it admin, I want to From 18f49e71a2858356adfcd3b0de0760478126d812 Mon Sep 17 00:00:00 2001 From: TheWriteDoc <187326664+TheWriteDoc@users.noreply.github.com> Date: Tue, 10 Dec 2024 09:26:27 -0800 Subject: [PATCH 07/11] fix Acro scores --- docs/identity/hybrid/decommission-connect-sync-v1.md | 6 +++--- docs/identity/hybrid/get-started.md | 6 +++--- docs/identity/hybrid/prerequisites.md | 8 ++++---- docs/identity/hybrid/sso.md | 8 ++++---- docs/identity/hybrid/sync-tools.md | 8 ++++---- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/identity/hybrid/decommission-connect-sync-v1.md b/docs/identity/hybrid/decommission-connect-sync-v1.md index f0a7245e9b8..0a86fd7cfc9 100644 --- a/docs/identity/hybrid/decommission-connect-sync-v1.md +++ b/docs/identity/hybrid/decommission-connect-sync-v1.md @@ -18,17 +18,17 @@ ms.custom: docutune-disable # Decommission Azure AD Connect V1 -The one-year advanced notice of Azure AD Connect V1's retirement was announced in August 2021. As of August 31, 2022, all V1 versions went out of support and were subject to stop working unexpectedly at any point. +The one-year advanced notice of Azure AD Connect V1's retirement was announced in August 2021. As of August 31, 2022, all V1 versions went out of support and were subject to stop working unexpectedly at any point. On **October 1, 2023**, Microsoft Entra cloud services stopped accepting connections from Azure AD Connect V1 servers, and identities no longer synchronize. -If you are still using Azure AD Connect V1 you must take action immediately. +If you're still using Azure AD Connect V1, you must take action immediately. ## Migrate to cloud sync Before moving to Microsoft Entra Connect Sync, you should see if cloud sync is right for you instead. Cloud sync uses a light-weight provisioning agent and is fully configurable through the portal. To choose the best sync tool for your situation, use the [Wizard to evaluate sync options.](https://aka.ms/EvaluateSyncOptions) -Based on your environment and needs, you may qualify for moving to cloud sync. For a comparison of cloud sync and connect sync, see [Comparison between cloud sync and connect sync](cloud-sync/what-is-cloud-sync.md#comparison-between-azure-ad-connect-and-cloud-sync). To learn more, read [What is cloud sync?](cloud-sync/what-is-cloud-sync.md) and [What is the provisioning agent?](cloud-sync/what-is-provisioning-agent.md) +Based on your environment and needs, you may qualify for moving to cloud sync. For a comparison of cloud sync and connect sync, see [Comparison between cloud sync and connect sync](cloud-sync/what-is-cloud-sync.md#comparison-between-azure-ad-connect-and-cloud-sync). To learn more, read [What is cloud sync?](cloud-sync/what-is-cloud-sync.md) and [What is the provisioning agent?](cloud-sync/what-is-provisioning-agent.md) ## Migrating to Microsoft Entra Connect V2 If you aren't yet eligible to move to cloud sync, use this table for more information on migrating to V2. diff --git a/docs/identity/hybrid/get-started.md b/docs/identity/hybrid/get-started.md index 4d0df867e2a..ada65763596 100644 --- a/docs/identity/hybrid/get-started.md +++ b/docs/identity/hybrid/get-started.md @@ -15,11 +15,11 @@ ms.author: billmath # Steps to start integrating with Microsoft Entra ID -If you're new to hybrid identity, then this documentation is the place that you want to start. If you haven't done so, it's recommended that you familiarize yourself with the [What is hybrid identity?](whatis-hybrid-identity.md) documentation before jumping in. +If you're new to hybrid identity, then this documentation is the place that you want to start. If you haven't done so, familiarize yourself with the [What is hybrid identity?](whatis-hybrid-identity.md) documentation before jumping in. -This document provides the steps that are required to integrate your on-premises Active Directory with Microsoft Entra ID. Integrating with Active Directory is the process of setting up synchronization for users and groups with Microsoft Entra ID. These steps differ slightly depending on which tool you use. +This document provides the steps that are required to integrate your on-premises Active Directory with Microsoft Entra ID. Integrating with Active Directory is the process of setting up synchronization for users and groups with Microsoft Entra ID. These steps differ slightly depending on which tool you use. -Use the [Choosing the right sync tool](https://setup.microsoft.com/azure/add-or-sync-users-to-azure-ad) first, to determine which one is right for you. Use the next section, for the tool that was recommended for you. +Use the [Choosing the right sync tool](https://setup.microsoft.com/azure/add-or-sync-users-to-azure-ad) first, to determine which one is right for you. Use the next section, for the tool that was recommended for you. ## Cloud sync Use these tasks if you're deploying cloud sync to integrate with Active Directory. diff --git a/docs/identity/hybrid/prerequisites.md b/docs/identity/hybrid/prerequisites.md index 4c8f92ca08d..0dd066f8042 100644 --- a/docs/identity/hybrid/prerequisites.md +++ b/docs/identity/hybrid/prerequisites.md @@ -22,7 +22,7 @@ The following document provides the prerequisites for integrating with Active Di |Requirement|Description and more requirements| |-----|-----| -|Windows server 2016 or greater that is or has:|• 4 GB RAM or more
• .NET 4.7.1 runtime or greater
• domain-joined
• PowerShell execution policy set to **Undefined** or **RemoteSigned**
• TLS 1.2 enabled
| +|Windows server 2016 or greater that is or has:|• 4-GB RAM or more
• .NET 4.7.1 runtime or greater
• domain-joined
• PowerShell execution policy set to **Undefined** or **RemoteSigned**
• TLS 1.2 enabled
| |Active Directory|• On-premises AD that has a forest functional level 2003 or higher| |Microsoft Entra tenant|• A tenant in Azure that's used to synchronize from on-premises| @@ -33,7 +33,7 @@ For more information on the cloud sync prerequisites, see [Cloud sync prerequisi |Requirement|Description and more requirements| |-----|-----| |Domain/Enterprise administrator|Required to install the agent on the server and create the gMSA service account.| -|Hybrid Identity Administrator|Required to configure cloud sync. This account cannot be a guest account.| +|Hybrid Identity Administrator|Required to configure cloud sync. This account can't be a guest account.| |gMSA service account|Required to run the agent.| For more information on the cloud sync accounts, and how to set up a custom gMSA account, see [Cloud sync prerequisites](cloud-sync/how-to-prerequisites.md). @@ -46,7 +46,7 @@ For more information on the cloud sync accounts, and how to set up a custom gMSA |Requirement|Description and more requirements| |-----|-----| -|Windows server 2016 or greater that is or has:|• 4 GB RAM or more
• .NET 4.6.2 runtime or greater
• domain-joined
• PowerShell execution policy set to **RemoteSigned**
• TLS 1.2 enabled
• if federation is being used, the AD FS severs must be Windows Server 2012 R2 or higher and TLS/SSL certificates must be configured.| +|Windows server 2016 or greater that is or has:|• 4-GB RAM or more
• .NET 4.6.2 runtime or greater
• domain-joined
• PowerShell execution policy set to **RemoteSigned**
• TLS 1.2 enabled
• if federation is being used, the AD FS severs must be Windows Server 2012 R2 or higher and TLS/SSL certificates must be configured.| |Active Directory|• On-premises AD that has a forest functional level 2003 or higher
• a writeable domain controller| |Microsoft Entra tenant|• A tenant in Azure used to synchronize from on-premises| |SQL Server|Microsoft Entra Connect requires a SQL Server database to store identity data. By default, a SQL Server 2019 Express LocalDB (a light version of SQL Server Express) is installed. For more information on using a SQL server, see [Microsoft Entra Connect SQL server requirements](connect/how-to-connect-install-prerequisites.md#sql-server-used-by-azure-ad-connect) @@ -59,7 +59,7 @@ For more information on the cloud sync prerequisites, see [Microsoft Entra Conne |Requirement|Description and more requirements| |-----|-----| |Enterprise administrator|Required to install Microsoft Entra Connect.| -|Hybrid Identity Administrator|Required to configure cloud sync. This account cannot be a guest account. This account must be a school or organization account and can't be a Microsoft account.| +|Hybrid Identity Administrator|Required to configure cloud sync. This account can't be a guest account. This account must be a school or organization account and can't be a Microsoft account.| |Custom settings|If you use the custom settings installation path, you have more options. You can specify the following information:
• [AD DS Connector account](./connect/reference-connect-accounts-permissions.md)
• [ADSync Service account](./connect/reference-connect-accounts-permissions.md)
• [Microsoft Entra Connector account](./connect/reference-connect-accounts-permissions.md).
For more information, see [Custom installation settings](./connect/reference-connect-accounts-permissions.md#custom-settings).| For more information on the Microsoft Entra Connect accounts, see [Microsoft Entra Connect: Accounts and permissions](connect/reference-connect-accounts-permissions.md). diff --git a/docs/identity/hybrid/sso.md b/docs/identity/hybrid/sso.md index 78880f4046f..01d5c82369e 100644 --- a/docs/identity/hybrid/sso.md +++ b/docs/identity/hybrid/sso.md @@ -15,17 +15,17 @@ ms.author: billmath # Get started with single sign-on -Setting up single sign-on, depends on which synchronization tool you are using and what your business goals are. Use the following tables to determine which features meet your target objectives. +Setting up single sign-on, depends on which synchronization tool you're using and what your business goals are. Use the following tables to determine which features meet your target objectives. ## Cloud sync -After installing the Microsoft Entra Connect provisioning agent, you need to configure single sign-on for cloud sync. The following table provides a list of steps required for using single sign-on. +After installing the Microsoft Entra Connect provisioning agent, you need to configure single sign-on for cloud sync. The following table provides a list of steps required for using single sign-on. |Task|Description| |-----|-----| |Download and extract Microsoft Entra Connect files|Download and extract the Microsoft Entra Connect files to use the PowerShell modules.| |Import the Seamless single sign-on PowerShell module|Import the PowerShell modules into a PowerShell session.| -|Get the list of Active Directory forests on which Seamless single sign-on has been enabled|Determine where single sign-on has been enabled.| +|Get the list of Active Directory forests with Seamless single sign-on enabled.|Determine where single sign-on is enabled.| |Enable Seamless single sign-on for each Active Directory forest|Enable single sign-on on your forests.| |Enable the feature on your tenant|Enable single sign-on on your tenant.| @@ -34,7 +34,7 @@ For more information, see [configuring single sign-on with cloud sync](cloud-syn ## Microsoft Entra Connect -Microsoft Entra seamless single sign-on (Seamless single sign-on) automatically signs in users when they're using their corporate desktops that are connected to your corporate network. The following table provides a list of steps required for using single sign-on. +Microsoft Entra seamless single sign-on (Seamless single sign-on) automatically signs in users when they're using their corporate desktops that are connected to your corporate network. The following table provides a list of steps required for using single sign-on. |Task|Description| |-----|-----| diff --git a/docs/identity/hybrid/sync-tools.md b/docs/identity/hybrid/sync-tools.md index 0b0155498f2..17bb0294204 100644 --- a/docs/identity/hybrid/sync-tools.md +++ b/docs/identity/hybrid/sync-tools.md @@ -18,16 +18,16 @@ ms.author: billmath ## List of tools -- **Cloud sync and the provisioning agent** - Microsoft Entra Cloud Sync is the newest offering from Microsoft designed to meet and accomplish your hybrid identity goals for synchronization of users, groups, and contacts to Microsoft Entra ID. It uses the light-weight provisioning agent and is fully configurable via the portal. For more information, see [What is cloud sync?](cloud-sync/what-is-cloud-sync.md) and [What is the provisioning agent?](cloud-sync/what-is-provisioning-agent.md) +- **Cloud sync and the provisioning agent** - Microsoft Entra Cloud Sync is the newest offering from Microsoft designed to meet and accomplish your hybrid identity goals for synchronization of users, groups, and contacts to Microsoft Entra ID. It uses the light-weight provisioning agent and is fully configurable via the portal. For more information, see [What is cloud sync?](cloud-sync/what-is-cloud-sync.md) and [What is the provisioning agent?](cloud-sync/what-is-provisioning-agent.md) -- **Connect sync** - Microsoft Entra Connect is an on-premises Microsoft application that's designed to meet and accomplish your hybrid identity goals. For more information, see [What is Microsoft Entra Connect?](connect/whatis-azure-ad-connect-v2.md). +- **Connect sync** - Microsoft Entra Connect is an on-premises Microsoft application designed to meet and accomplish your hybrid identity goals. For more information, see [What is Microsoft Entra Connect?](connect/whatis-azure-ad-connect-v2.md). -- **Microsoft Identity Manager with the Graph connector** - Microsoft's on-premises identity and access management solution that provides advanced inter-directory provisioning to achieve hybrid identity environments for Active Directory, Microsoft Entra ID, and other directories. For more information, see [Microsoft Identity Manager](/microsoft-identity-manager/microsoft-identity-manager-2016). MIM is slowly being deprecated and should only be used in advanced scenarios. For more information, see [Deprecated Features and planning for the future](/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features) +- **Microsoft Identity Manager with the Graph connector** - Microsoft's on-premises identity and access management solution that provides advanced inter-directory provisioning to achieve hybrid identity environments for Active Directory, Microsoft Entra ID, and other directories. For more information, see [Microsoft Identity Manager](/microsoft-identity-manager/microsoft-identity-manager-2016). MIM is slowly being deprecated and should only be used in advanced scenarios. For more information, see [Deprecated Features and planning for the future](/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features) - **ECMA Host connector** - The ECMA host works with the provisioning agent to provision and synchronize users from the cloud into on-premises applications such as SQL and LDAP. For more information, see [Microsoft Entra on-premises application identity provisioning architecture](~/identity/app-provisioning/on-premises-application-provisioning-architecture.md) and [What is the provisioning agent?](cloud-sync/what-is-provisioning-agent.md) ## Selecting the right tool -Each of these tools can accomplish similar results. So selecting the right tool is essential. For most scenarios, cloud sync is going to be the recommended tool. Then connect sync and for advanced/complex scenarios, MIM. For on-premises applications, the ECMA Host would be the preferred tool. For more information, [see the supported sync scenarios table](common-scenarios.md#supported-sync-scenarios). To determine which tool is right for you, you should use the wizard at the [Choosing the right sync tool](https://setup.microsoft.com/azure/add-or-sync-users-to-azure-ad) site. +Each of these tools can accomplish similar results. So selecting the right tool is essential. For most scenarios, cloud sync is going to be the recommended tool. Then connect sync and for advanced/complex scenarios, MIM. For on-premises applications, the ECMA Host would be the preferred tool. For more information, [see the supported sync scenarios table](common-scenarios.md#supported-sync-scenarios). To determine which tool is right for you, you should use the wizard at the [Choosing the right sync tool](https://setup.microsoft.com/azure/add-or-sync-users-to-azure-ad) site. ## Next steps - [Common scenarios](common-scenarios.md) From 18b101ea8d84a9ea3487b190429cdc4b239d8489 Mon Sep 17 00:00:00 2001 From: Alexander Pavlovsky Date: Tue, 10 Dec 2024 09:29:47 -0800 Subject: [PATCH 08/11] updating TR documentation in GSA --- .../how-to-manage-microsoft-profile.md | 2 +- .../how-to-universal-tenant-restrictions.md | 27 ++++++++++++------- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/docs/global-secure-access/how-to-manage-microsoft-profile.md b/docs/global-secure-access/how-to-manage-microsoft-profile.md index 471f287a4fd..337f3a3dc8c 100644 --- a/docs/global-secure-access/how-to-manage-microsoft-profile.md +++ b/docs/global-secure-access/how-to-manage-microsoft-profile.md @@ -60,7 +60,7 @@ The policy groups include the following details: You can configure the traffic acquisition rules to bypass traffic acquisition. If you do, the users will still be able to access resources; however, the Global Secure Access service will not process the traffic. You can bypass traffic to a specific FQDN or IP address, an entire policy group within the profile, or the entire Microsoft profile itself. If you only need to forward some of the Microsoft resources within a policy group, enable the group then change the **Action** in the details accordingly. > [!IMPORTANT] -> When a rule is set to Bypass, the Internet Access traffic profile will not acquire this traffic. Even with the Internet Access profile enabled, the bypassed traffic will skip Global Secure Access acquisition and use that client's network routing path to egress to the Internet. Traffic available for acquisition in the Microsoft traffic profile can be only acquired in the Microsoft traffic profile. +> When a rule is set to Bypass in the Microsoft traffic profile, the Internet Access traffic profile will not acquire this traffic. Even with the Internet Access profile enabled, the bypassed traffic will skip Global Secure Access acquisition and use that client's network routing path to egress to the Internet. Traffic available for acquisition in the Microsoft traffic profile can be only acquired in the Microsoft traffic profile. The following example shows setting the `*.sharepoint.com` FQDN to **Bypass** so the traffic isn't forwarded to the service. diff --git a/docs/global-secure-access/how-to-universal-tenant-restrictions.md b/docs/global-secure-access/how-to-universal-tenant-restrictions.md index cd81a640362..c0eb8ab5415 100644 --- a/docs/global-secure-access/how-to-universal-tenant-restrictions.md +++ b/docs/global-secure-access/how-to-universal-tenant-restrictions.md @@ -24,25 +24,28 @@ The following table explains the steps taken at each point in the previous diagr | **1** | Contoso configures a **tenant restrictions v2 ** policy in their cross-tenant access settings to block all external accounts and external apps. Contoso enforces the policy using Global Secure Access universal tenant restrictions. | | **2** | A user with a Contoso-managed device tries to access a Microsoft Entra integrated app with an unsanctioned external identity. | | **3** | *Authentication plane protection:* Using Microsoft Entra ID, Contoso's policy blocks unsanctioned external accounts from accessing external tenants. | -| **4** | *Data plane protection:* If the user again tries to access an external unsanctioned application by copying an authentication response token they obtained outside of Contoso's network and pasting it into the device, they're blocked. The token mismatch triggers reauthentication and blocks access. For SharePoint Online, any attempt at anonymously accessing resources will be blocked. | +| **4** | *Data plane protection:* If the user again tries to access an external unsanctioned application by copying an authentication response token they obtained outside of Contoso's network and pasting it into the device, they're blocked. The token mismatch triggers reauthentication and blocks access. For SharePoint Online, any attempt at anonymously accessing resources will be blocked. For Teams, attempts to join meetings anonymously will be denied.| Universal tenant restrictions help to prevent data exfiltration across browsers, devices, and networks in the following ways: - It enables Microsoft Entra ID, Microsoft Accounts, and Microsoft applications to look up and enforce the associated tenant restrictions v2 policy. This lookup enables consistent policy application. - Works with all Microsoft Entra integrated third-party apps at the auth plane during sign in. -- Works with Exchange, SharePoint, and Microsoft Graph for data plane protection (Preview) +- Works with Exchange, SharePoint/OneDrive, Teams, and Microsoft Graph for data plane protection (Preview) + +## Universal Tenant Restrictions enforcement points +### Authentication Plane +Authentication plane enforcement happens at the time of Entra ID or Microsoft Account authentication. When the user is connected with the Global Secure Access client or via Remote Network connectivity, Tenant Restrictions v2 policy is checked to determine if authentication should be allowed. If the user is signing in to the tenant of their organization, tenant restrictions policy is not applied. If the user is signing in to a different tenant, policy is enforced. Any application that is integrated with Entra ID or uses Microsoft Account for authentication supports Universal Tenant Restrictions at the authentication plane. + +## Data Plane (Preview) +Data plane enforcement is done by the resource provider (a Microsoft service that supports tenant restrictions) at the time that the data is accessed. Data plane protection ensures that imported authentication artifacts (for example, an access token obtained on another device, bypassing authentication plane enforcements defined in your Tenant Restrictions v2 policy) cannot be replayed from your organization's devices to exfiltrate data. Additionally, data plane protection prevents the user of anonymous access links in SharePoint/OneDrive for Business, and prevents the users from joining Teams meetings anonymously. ## Prerequisites * Administrators who interact with **Global Secure Access** features must have one or more of the following role assignments depending on the tasks they're performing. * The [Global Secure Access Administrator role](/azure/active-directory/roles/permissions-reference) role to manage the Global Secure Access features. - * The [Conditional Access Administrator](/azure/active-directory/roles/permissions-reference#conditional-access-administrator) to create and interact with Conditional Access policies. * The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense). - -### Known limitations - -- Data plane protection capabilities are in preview (authentication plane protection is generally available) -- When you use Universal Tenant Restrictions and access the Microsoft Entra admin center to manage a partner tenant allowed by the Tenant Restrictions v2 policy, you may get authorization errors. To work around this issue, you need to add `?exp.msaljsoptedoutextensions=%7B%7D` query parameter to the Microsoft Entra admin center URL (for example, `https://entra.microsoft.com/?exp.msaljsoptedoutextensions=%7B%7D`). +* [Microsoft traffic profile](concept-microsoft-traffic-profile.md) must be enabled and FQDNs/IP addresses of services that will have Universal Tenant Restrictions are set to 'Tunnel' mode. +* [Global Secure Access clients](concept-clients.md) are deployed or [Remote Network connectivity](concept-remote-network-connectivity.md) is configured. ## Configure Tenant Restrictions v2 policy @@ -50,7 +53,7 @@ Before an organization can use universal tenant restrictions, they must configur For more information to configure these policies, see the article [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2). -## Enable tagging for Tenant Restrictions v2 +## Enable Global Secure Access signaling for Tenant Restrictions Once you have created the tenant restriction v2 policies, you can utilize Global Secure Access to apply tagging for tenant restrictions v2. An administrator with both the [Global Secure Access Administrator](/azure/active-directory/roles/permissions-reference) and [Security Administrator](/azure/active-directory/roles/permissions-reference#security-administrator) roles must take the following steps to enable enforcement with Global Secure Access. @@ -97,6 +100,12 @@ Tenant restrictions are not enforced when a user (or a guest user) tries to acce 1. `Restrict-Access-Confirm: 1` 1. `x-ms-diagnostics: 2000020;reason="xms_trpid claim was not present but sec-tenant-restriction-access-policy header was in requres";error_category="insufficiant_claims"` +### Known limitations + +- Data plane protection capabilities are in preview (authentication plane protection is generally available) +- When you use Universal Tenant Restrictions and access the Microsoft Entra admin center to manage a partner tenant allowed by the Tenant Restrictions v2 policy, you may get authorization errors. To work around this issue, you need to add `?exp.msaljsoptedoutextensions=%7B%7D` query parameter to the Microsoft Entra admin center URL (for example, `https://entra.microsoft.com/?exp.msaljsoptedoutextensions=%7B%7D`). +- When the Teams service blocks anonymous meeting join due to Universal Tenant Restrictions, a generic error message is presented in the Teams client application. + ## Next steps - [Enable enhanced Global Secure Access signaling](how-to-source-ip-restoration.md#enable-global-secure-access-signaling-for-conditional-access) - [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2) From 8b174f1bee672041a08c24ecfe01ed93eda21d5a Mon Sep 17 00:00:00 2001 From: TheWriteDoc <187326664+TheWriteDoc@users.noreply.github.com> Date: Tue, 10 Dec 2024 11:11:15 -0800 Subject: [PATCH 09/11] november 2024 refresh set 23 --- docs/id-governance/apps.md | 2 +- docs/id-governance/best-practices-secure-id-governance.md | 2 +- docs/id-governance/check-status-workflow.md | 2 +- docs/id-governance/check-workflow-execution-scope.md | 2 +- docs/id-governance/complete-access-review.md | 2 +- docs/id-governance/configure-logic-app-lifecycle-workflows.md | 2 +- docs/id-governance/create-lifecycle-workflow.md | 2 +- .../custom-entitlement-report-with-adx-and-entra-id.md | 2 +- docs/id-governance/customize-workflow-email.md | 2 +- docs/id-governance/customize-workflow-schedule.md | 2 +- docs/id-governance/delete-lifecycle-workflow.md | 2 +- docs/id-governance/download-workflow-history.md | 2 +- docs/id-governance/governance-dashboard.md | 2 +- docs/id-governance/governance-service-limits.md | 2 +- docs/id-governance/identity-governance-applications-define.md | 2 +- docs/id-governance/identity-governance-organizational-roles.md | 2 +- docs/id-governance/lifecycle-workflow-audits.md | 2 +- docs/id-governance/lifecycle-workflow-extensibility.md | 2 +- docs/id-governance/lifecycle-workflow-versioning.md | 2 +- docs/id-governance/lifecycle-workflows-deployment.md | 2 +- docs/id-governance/manage-guest-access-with-access-reviews.md | 2 +- docs/id-governance/manage-user-access-with-access-reviews.md | 2 +- docs/id-governance/manage-workflow-properties.md | 2 +- docs/id-governance/my-access-portal-overview.md | 2 +- docs/id-governance/on-demand-workflow.md | 2 +- .../privileged-identity-management/pim-powershell-migration.md | 2 +- 26 files changed, 26 insertions(+), 26 deletions(-) diff --git a/docs/id-governance/apps.md b/docs/id-governance/apps.md index 46492918fa2..3741ab37919 100644 --- a/docs/id-governance/apps.md +++ b/docs/id-governance/apps.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: overview -ms.date: 08/24/2023 +ms.date: 12/10/2024 ms.author: billmath ms.reviewer: amycolannino --- diff --git a/docs/id-governance/best-practices-secure-id-governance.md b/docs/id-governance/best-practices-secure-id-governance.md index 8719d69eeb8..39f61739ce8 100644 --- a/docs/id-governance/best-practices-secure-id-governance.md +++ b/docs/id-governance/best-practices-secure-id-governance.md @@ -8,7 +8,7 @@ manager: amycolannino editor: '' ms.service: entra-id-governance ms.topic: conceptual -ms.date: 07/28/2023 +ms.date: 12/10/2024 ms.author: billmath --- diff --git a/docs/id-governance/check-status-workflow.md b/docs/id-governance/check-status-workflow.md index ff63600c44a..675f8f82af5 100644 --- a/docs/id-governance/check-status-workflow.md +++ b/docs/id-governance/check-status-workflow.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 06/22/2023 +ms.date: 12/10/2024 ms.custom: template-how-to --- diff --git a/docs/id-governance/check-workflow-execution-scope.md b/docs/id-governance/check-workflow-execution-scope.md index fc3285f74fc..51f749b69fc 100644 --- a/docs/id-governance/check-workflow-execution-scope.md +++ b/docs/id-governance/check-workflow-execution-scope.md @@ -6,7 +6,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: krbain --- diff --git a/docs/id-governance/complete-access-review.md b/docs/id-governance/complete-access-review.md index 61ed6736807..4cf93651092 100644 --- a/docs/id-governance/complete-access-review.md +++ b/docs/id-governance/complete-access-review.md @@ -7,7 +7,7 @@ editor: markwahl-msft ms.service: entra-id-governance ms.subservice: access-reviews ms.topic: how-to -ms.date: 06/28/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: mwahl --- diff --git a/docs/id-governance/configure-logic-app-lifecycle-workflows.md b/docs/id-governance/configure-logic-app-lifecycle-workflows.md index 1920234f253..030d83790ed 100644 --- a/docs/id-governance/configure-logic-app-lifecycle-workflows.md +++ b/docs/id-governance/configure-logic-app-lifecycle-workflows.md @@ -6,7 +6,7 @@ ms.author: owinfrey ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 06/22/2023 +ms.date: 12/10/2024 ms.custom: template-how-to --- diff --git a/docs/id-governance/create-lifecycle-workflow.md b/docs/id-governance/create-lifecycle-workflow.md index c460e6fb4f3..eba2c04ed9e 100644 --- a/docs/id-governance/create-lifecycle-workflow.md +++ b/docs/id-governance/create-lifecycle-workflow.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 06/22/2023 +ms.date: 12/10/2024 ms.custom: template-how-to --- diff --git a/docs/id-governance/custom-entitlement-report-with-adx-and-entra-id.md b/docs/id-governance/custom-entitlement-report-with-adx-and-entra-id.md index 12e59ba5954..6e19395b80b 100644 --- a/docs/id-governance/custom-entitlement-report-with-adx-and-entra-id.md +++ b/docs/id-governance/custom-entitlement-report-with-adx-and-entra-id.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: overview -ms.date: 01/05/2023 +ms.date: 12/10/2024 ms.author: billmath --- diff --git a/docs/id-governance/customize-workflow-email.md b/docs/id-governance/customize-workflow-email.md index 0263027ac69..a82580ab3fa 100644 --- a/docs/id-governance/customize-workflow-email.md +++ b/docs/id-governance/customize-workflow-email.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 06/22/2023 +ms.date: 12/10/2024 ms.custom: template-how-to --- diff --git a/docs/id-governance/customize-workflow-schedule.md b/docs/id-governance/customize-workflow-schedule.md index e015cea3d65..1782fe18a49 100644 --- a/docs/id-governance/customize-workflow-schedule.md +++ b/docs/id-governance/customize-workflow-schedule.md @@ -6,7 +6,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: krbain --- diff --git a/docs/id-governance/delete-lifecycle-workflow.md b/docs/id-governance/delete-lifecycle-workflow.md index 7e75970d26d..7eb2bf68a12 100644 --- a/docs/id-governance/delete-lifecycle-workflow.md +++ b/docs/id-governance/delete-lifecycle-workflow.md @@ -6,7 +6,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: krbain --- diff --git a/docs/id-governance/download-workflow-history.md b/docs/id-governance/download-workflow-history.md index 3080b410bfb..e07e2ee6b9c 100644 --- a/docs/id-governance/download-workflow-history.md +++ b/docs/id-governance/download-workflow-history.md @@ -6,7 +6,7 @@ ms.author: owinfrey ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 11/17/2023 +ms.date: 12/10/2024 #CustomerIntent: As an admin, I want to download history reports as a CSV. --- diff --git a/docs/id-governance/governance-dashboard.md b/docs/id-governance/governance-dashboard.md index 49351f82c86..d5206760c5f 100644 --- a/docs/id-governance/governance-dashboard.md +++ b/docs/id-governance/governance-dashboard.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: how-to -ms.date: 06/20/2023 +ms.date: 12/10/2024 ms.author: billmath ms.custom: --- diff --git a/docs/id-governance/governance-service-limits.md b/docs/id-governance/governance-service-limits.md index 2b2439933b5..afb969c901c 100644 --- a/docs/id-governance/governance-service-limits.md +++ b/docs/id-governance/governance-service-limits.md @@ -6,7 +6,7 @@ ms.author: owinfrey manager: amycolannino ms.service: entra-id-governance ms.topic: concept-article -ms.date: 10/30/2023 +ms.date: 12/10/2024 #CustomerIntent: As a customer, I want to become informed on service limits for offerings within Microsoft Entra ID Governance so that restraints are understood and can be accounted for. --- diff --git a/docs/id-governance/identity-governance-applications-define.md b/docs/id-governance/identity-governance-applications-define.md index 9b823630ee5..00471ccc2f4 100644 --- a/docs/id-governance/identity-governance-applications-define.md +++ b/docs/id-governance/identity-governance-applications-define.md @@ -6,7 +6,7 @@ manager: amycolannino editor: markwahl-msft ms.service: entra-id-governance ms.topic: conceptual -ms.date: 06/28/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: markwahl-msft --- diff --git a/docs/id-governance/identity-governance-organizational-roles.md b/docs/id-governance/identity-governance-organizational-roles.md index 846d84ce7f8..f2fb9c18957 100644 --- a/docs/id-governance/identity-governance-organizational-roles.md +++ b/docs/id-governance/identity-governance-organizational-roles.md @@ -6,7 +6,7 @@ manager: amycolannino editor: markwahl-msft ms.service: entra-id-governance ms.topic: conceptual -ms.date: 05/26/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: markwahl-msft --- diff --git a/docs/id-governance/lifecycle-workflow-audits.md b/docs/id-governance/lifecycle-workflow-audits.md index f2c06c327ad..70d24175aee 100644 --- a/docs/id-governance/lifecycle-workflow-audits.md +++ b/docs/id-governance/lifecycle-workflow-audits.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: conceptual -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.custom: template-concept --- diff --git a/docs/id-governance/lifecycle-workflow-extensibility.md b/docs/id-governance/lifecycle-workflow-extensibility.md index 3c28b084c3f..270df07b229 100644 --- a/docs/id-governance/lifecycle-workflow-extensibility.md +++ b/docs/id-governance/lifecycle-workflow-extensibility.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: conceptual -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.custom: template-concept --- diff --git a/docs/id-governance/lifecycle-workflow-versioning.md b/docs/id-governance/lifecycle-workflow-versioning.md index 6bc1163bca2..c8ad37274f0 100644 --- a/docs/id-governance/lifecycle-workflow-versioning.md +++ b/docs/id-governance/lifecycle-workflow-versioning.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: conceptual -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.custom: template-concept --- diff --git a/docs/id-governance/lifecycle-workflows-deployment.md b/docs/id-governance/lifecycle-workflows-deployment.md index ac2404b1f70..09d41c6e5b7 100644 --- a/docs/id-governance/lifecycle-workflows-deployment.md +++ b/docs/id-governance/lifecycle-workflows-deployment.md @@ -6,7 +6,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 10/12/2023 +ms.date: 12/10/2024 ms.author: owinfrey --- diff --git a/docs/id-governance/manage-guest-access-with-access-reviews.md b/docs/id-governance/manage-guest-access-with-access-reviews.md index 2262ce20994..661a7353cd4 100644 --- a/docs/id-governance/manage-guest-access-with-access-reviews.md +++ b/docs/id-governance/manage-guest-access-with-access-reviews.md @@ -7,7 +7,7 @@ editor: markwahl-msft ms.service: entra-id-governance ms.subservice: access-reviews ms.topic: conceptual -ms.date: 11/25/2024 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: mwahl --- diff --git a/docs/id-governance/manage-user-access-with-access-reviews.md b/docs/id-governance/manage-user-access-with-access-reviews.md index 621ecb65918..b524f050162 100644 --- a/docs/id-governance/manage-user-access-with-access-reviews.md +++ b/docs/id-governance/manage-user-access-with-access-reviews.md @@ -7,7 +7,7 @@ editor: markwahl-msft ms.service: entra-id-governance ms.subservice: access-reviews ms.topic: conceptual -ms.date: 06/28/2023 +ms.date: 12/10/2024 ms.author: owinfrey ms.reviewer: mwahl --- diff --git a/docs/id-governance/manage-workflow-properties.md b/docs/id-governance/manage-workflow-properties.md index 1cc896d3062..d116bcea8d3 100644 --- a/docs/id-governance/manage-workflow-properties.md +++ b/docs/id-governance/manage-workflow-properties.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.custom: template-how-to --- diff --git a/docs/id-governance/my-access-portal-overview.md b/docs/id-governance/my-access-portal-overview.md index 4dc2bb36cbb..6110dd915d3 100644 --- a/docs/id-governance/my-access-portal-overview.md +++ b/docs/id-governance/my-access-portal-overview.md @@ -5,7 +5,7 @@ author: owinfreyATL ms.author: owinfrey ms.service: entra-id-governance ms.topic: overview -ms.date: 10/23/2023 +ms.date: 12/10/2024 --- diff --git a/docs/id-governance/on-demand-workflow.md b/docs/id-governance/on-demand-workflow.md index a2c9d0afbb0..da7886f63a0 100644 --- a/docs/id-governance/on-demand-workflow.md +++ b/docs/id-governance/on-demand-workflow.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: how-to -ms.date: 05/31/2023 +ms.date: 12/10/2024 ms.custom: template-how-to --- diff --git a/docs/id-governance/privileged-identity-management/pim-powershell-migration.md b/docs/id-governance/privileged-identity-management/pim-powershell-migration.md index 982d6f7cfef..27ca90ea489 100644 --- a/docs/id-governance/privileged-identity-management/pim-powershell-migration.md +++ b/docs/id-governance/privileged-identity-management/pim-powershell-migration.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: privileged-identity-management ms.topic: how-to -ms.date: 07/11/2023 +ms.date: 12/10/2024 ms.author: billmath ms.reviewer: shaunliu ms.custom: pim, devx-track-azurepowershell From b3494dfa7f1c6ebfabe7f0fb8a7695bde23779c2 Mon Sep 17 00:00:00 2001 From: mattfield-microsoft <102323802+mattfield-microsoft@users.noreply.github.com> Date: Tue, 10 Dec 2024 14:16:04 -0500 Subject: [PATCH 10/11] Updating Global Reader Microsoft 365 Defender limitation --- .../identity/role-based-access-control/permissions-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/identity/role-based-access-control/permissions-reference.md b/docs/identity/role-based-access-control/permissions-reference.md index 27d57f45879..1c886910d64 100644 --- a/docs/identity/role-based-access-control/permissions-reference.md +++ b/docs/identity/role-based-access-control/permissions-reference.md @@ -1283,7 +1283,7 @@ Users with this role **cannot** do the following: > Global Reader role has the following limitations: > >- OneDrive admin center - OneDrive admin center does not support the Global Reader role ->- [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal) - Global Reader can't read SCC audit logs, do content search, or see Secure Score. +>- [Microsoft 365 Defender portal](/microsoft-365/security/defender/microsoft-365-defender-portal) - Global Reader can't do content search or see Secure Score. >- [Teams admin center](/microsoftteams/manage-teams-in-modern-portal) - Global Reader cannot read **Teams lifecycle**, **Analytics & reports**, **IP phone device management**, and **App catalog**. For more information, see [Use Microsoft Teams administrator roles to manage Teams](/microsoftteams/using-admin-roles). >- [Privileged Access Management](/microsoft-365/compliance/privileged-access-management) doesn't support the Global Reader role. >- [Azure Information Protection](/azure/information-protection/what-is-information-protection) - Global Reader is supported [for central reporting](/azure/information-protection/reports-aip) only, and when your Microsoft Entra organization isn't on the [unified labeling platform](/azure/information-protection/faqs#how-can-i-determine-if-my-tenant-is-on-the-unified-labeling-platform). From e1bbd9f68034f52f504d14dedf76c2dbcf1cc8e5 Mon Sep 17 00:00:00 2001 From: TheWriteDoc <187326664+TheWriteDoc@users.noreply.github.com> Date: Tue, 10 Dec 2024 13:43:43 -0800 Subject: [PATCH 11/11] november 2024 refresh set 24 --- docs/id-governance/scenarios/govern-the-employee-lifecycle.md | 4 ++-- docs/id-governance/scenarios/least-privileged.md | 2 +- .../provision-active-directory-to-entra-cloud-sync.md | 2 +- .../provision-active-directory-to-entra-connect-sync.md | 2 +- .../scenarios/provision-entra-to-active-directory-groups.md | 2 +- .../scenarios/provision-workday-to-active-directory.md | 2 +- docs/id-governance/scenarios/provision-workday-to-entra.md | 2 +- docs/id-governance/trigger-custom-task.md | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/id-governance/scenarios/govern-the-employee-lifecycle.md b/docs/id-governance/scenarios/govern-the-employee-lifecycle.md index f65573b024b..8e419bdfca3 100644 --- a/docs/id-governance/scenarios/govern-the-employee-lifecycle.md +++ b/docs/id-governance/scenarios/govern-the-employee-lifecycle.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: overview -ms.date: 12/20/2023 +ms.date: 12/10/2024 ms.author: billmath --- @@ -47,7 +47,7 @@ When planning identity lifecycle management for employees, or other individuals - Move - when an individual moves between boundaries that require additional access authorizations to be added or removed to their digital identity - Leave - when an individual leaves the scope of needing access, access may need to be removed, and subsequently the identity may no longer be required by applications other than for audit or forensics purposes -So for example, if a new employee joins your organization and that employee has never been affiliated with your organization before, that employee will require a new digital identity, represented as a user account in Microsoft Entra ID. The creation of this account would fall into a "Joiner" process, which could be automated if there was a system of record such as Workday that could indicate when the new employee starts work. Later, if your organization has an employee move from say, Sales to Marketing, they would fall into a "Mover" process. This move would require removing the access rights they had in the Sales organization, which they no longer require, and granting them rights in the Marketing organization that they new require. +So for example, if a new employee joins your organization and that employee has never been affiliated with your organization before, that employee requires a new digital identity, represented as a user account in Microsoft Entra ID. The creation of this account would fall into a "Joiner" process, which could be automated if there was a system of record such as Workday that could indicate when the new employee starts work. Later, if your organization has an employee move from say, Sales to Marketing, they would fall into a "Mover" process. This move would require removing the access rights they had in the Sales organization, which they no longer require, and granting them rights in the Marketing organization that they new require. ## Identity lifecycle management for guests diff --git a/docs/id-governance/scenarios/least-privileged.md b/docs/id-governance/scenarios/least-privileged.md index 7f62fc717e8..1a5c1b1a84c 100644 --- a/docs/id-governance/scenarios/least-privileged.md +++ b/docs/id-governance/scenarios/least-privileged.md @@ -9,7 +9,7 @@ manager: amycolannino ms.topic: conceptual -ms.date: 07/28/2023 +ms.date: 12/10/2024 ms.author: billmath --- diff --git a/docs/id-governance/scenarios/provision-active-directory-to-entra-cloud-sync.md b/docs/id-governance/scenarios/provision-active-directory-to-entra-cloud-sync.md index 49aa0efe689..7f226229aad 100644 --- a/docs/id-governance/scenarios/provision-active-directory-to-entra-cloud-sync.md +++ b/docs/id-governance/scenarios/provision-active-directory-to-entra-cloud-sync.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: conceptual -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: ms.author: billmath --- diff --git a/docs/id-governance/scenarios/provision-active-directory-to-entra-connect-sync.md b/docs/id-governance/scenarios/provision-active-directory-to-entra-connect-sync.md index b1540765f29..db1e0dcf06e 100644 --- a/docs/id-governance/scenarios/provision-active-directory-to-entra-connect-sync.md +++ b/docs/id-governance/scenarios/provision-active-directory-to-entra-connect-sync.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: conceptual -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: ms.author: billmath --- diff --git a/docs/id-governance/scenarios/provision-entra-to-active-directory-groups.md b/docs/id-governance/scenarios/provision-entra-to-active-directory-groups.md index 358141f715c..420f64b6ff4 100644 --- a/docs/id-governance/scenarios/provision-entra-to-active-directory-groups.md +++ b/docs/id-governance/scenarios/provision-entra-to-active-directory-groups.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: conceptual -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: ms.author: billmath --- diff --git a/docs/id-governance/scenarios/provision-workday-to-active-directory.md b/docs/id-governance/scenarios/provision-workday-to-active-directory.md index 1cd0e8ecfb1..0d196d75c56 100644 --- a/docs/id-governance/scenarios/provision-workday-to-active-directory.md +++ b/docs/id-governance/scenarios/provision-workday-to-active-directory.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: conceptual -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: ms.author: billmath --- diff --git a/docs/id-governance/scenarios/provision-workday-to-entra.md b/docs/id-governance/scenarios/provision-workday-to-entra.md index 55f29667d38..0739d7dee34 100644 --- a/docs/id-governance/scenarios/provision-workday-to-entra.md +++ b/docs/id-governance/scenarios/provision-workday-to-entra.md @@ -5,7 +5,7 @@ author: billmath manager: amycolannino ms.service: entra-id-governance ms.topic: conceptual -ms.date: 11/06/2023 +ms.date: 12/10/2024 ms.subservice: ms.author: billmath --- diff --git a/docs/id-governance/trigger-custom-task.md b/docs/id-governance/trigger-custom-task.md index 651473a6a67..82f69d2663e 100644 --- a/docs/id-governance/trigger-custom-task.md +++ b/docs/id-governance/trigger-custom-task.md @@ -7,7 +7,7 @@ manager: amycolannino ms.service: entra-id-governance ms.subservice: lifecycle-workflows ms.topic: conceptual -ms.date: 06/22/2023 +ms.date: 12/10/2024 ms.custom: template-howto ---