Archive for Microsoft Entra releases and announcements

  • Article

This article includes information about the releases and change announcements across the Microsoft Entra family of products that are older than six months (up to 18 months). If you're looking for more current information, see Microsoft Entra releases and announcements.

June 2024

Public Preview - MS Graph API support for per-user multifactor authentication

Type: New feature
Service category: MFA
Product capability: Identity Security & Protection

MS Graph API support for per-user multifactor authentication

Starting June 2024, we're releasing the capability to manage user status (Enforced, Enabled, Disabled) for per-user multifactor authentication through MS Graph API. This update replaces the legacy MSOnline PowerShell module that is being retired. The recommended approach to protect users with Microsoft Entra multifactor authentication is Conditional Access (for licensed organizations) and security defaults (for unlicensed organizations). For more information, see: Enable per-user Microsoft Entra multifactor authentication to secure sign-in events.

Public Preview - Easy authentication with Azure App Service and Microsoft Entra External ID

Type: Changed feature
Service category: B2C - Consumer Identity Management
Product capability: B2B/B2C

We improved the experience when using Microsoft Entra External ID as an identity provider for Azure App Service’s built-in authentication, simplifying the process of configuring authentication and authorization for external-facing apps. You can complete initial configuration directly from the App Service authentication setup without switching into the external tenant. For more information, see: Quickstart: Add app authentication to your web app running on Azure App Service

General Availability - Refactored account details screen in Microsoft Authenticator

Type: Plan for change
Service category: Microsoft Authenticator App
Product capability: User Authentication

In July, enhancements for the Microsoft Authenticator app UX roll-out. The account details page of a user account is reorganized to help users better understand, and interact with, the information and buttons on the screen. Key actions that a user can do today are available in the refactored page, but they're organized in three sections or categories that help better communicate to users:

  • Credentials configured in the app
  • More sign in methods they can configure
  • Account management options in the app

General Availability - SLA Attainment Report at the Tenant Level

Type: New feature
Service category: Reporting
Product capability: Monitoring & Reporting

In addition to providing global SLA performance, Microsoft Entra ID reports tenant-level SLA performance for organizations with at least 5,000 monthly active users. This feature entered general availability in May 2024. The Service Level Agreement (SLA) sets a minimum bar of 99.99% for the availability of Microsoft Entra ID user authentication, reported on a monthly basis in the Microsoft Entra admin center. For more information, see: What is Microsoft Entra Health?

Preview - QR code sign-in, a new authentication method for Frontline Workers

Type: New feature
Service category: Authentications (Logins)
Product capability: User Authentication

We're introducing a new simple way for Frontline Workers to authenticate in Microsoft Entra ID with a QR code and PIN. This capability eliminates the need for users to enter and reenter long UPNs and alphanumeric passwords.

Beginning in August 2024, all users in your tenant now see a new link Sign in with QR code when navigating to https://login.partner.microsoftonline.cn > Sign-in options > Sign in to an organization. This new link, Sign in with QR code, is visible only on mobile devices (Android/iOS/iPadOS). If you aren't participating in the preview, users from your tenant can't sign in through this method while we're still in review. They receive an error message if they try to sign-in.

The feature has a preview tag until it's generally available. Your organization needs to be enabled to test this feature. Broad testing is available in public preview, to be announced later.

While the feature is in preview, no technical support is provided. Learn more about support during previews here: Microsoft Entra ID preview program information.

May 2024

General Availability - Microsoft Azure operated by 21Vianet now supports My sign-ins and MFA/SSPR Combined Registration

Type: Changed feature
Service category: MFA
Product capability: Identity Security & Protection

Beginning end of June 2024, all organizations utilizing Microsoft Azure operated by 21Vianet now has access to My Sign-ins activity reporting. They're required to use the combined security information registration end-user experience for MFA and SSPR. As a result of this enablement, users now see a unified SSPR and MFA registration experience when prompted to register for SSPR or MFA. For more information, see: Combined security information registration for Microsoft Entra overview.

General Availability - $select in signIn API

Type: New feature
Service category: MS Graph
Product capability: Monitoring & Reporting

The long-awaited $select property is now implemented into the signIn API. Utilize the $select to reduce the number of attributes that are returned for each log. This update should greatly help customers who deal with throttling issues, and allow every customer to run faster, more efficient queries.

Public Preview - Bicep templates support for Microsoft Graph

Type: New feature
Service category: MS Graph
Product capability: Developer Experience

The Microsoft Graph Bicep extension brings declarative infrastructure-as-code (IaC) capabilities to Microsoft Graph resources. It allows you to author, deploy, and manage core Microsoft Entra ID resources using Bicep template files, alongside Azure resources.

  • Existing Azure customers can now use familiar tools to deploy Azure resources and the Microsoft Entra resources they depend on, such as applications and service principals, IaC and DevOps practices.
  • It also opens the door for existing Microsoft Entra customers to use Bicep templates and IaC practices to deploy and manage their tenant's Microsoft Entra resources.

For more information, see: Bicep templates for Microsoft Graph resources

Public Preview - Platform Single Sign-on for macOS with Microsoft Entra ID

Type: New feature
Service category: Authentications (Logins)
Product capability: User Authentication

Today we’re announcing that Platform SSO for macOS is available in public preview with Microsoft Entra ID. Platform SSO is an enhancement to the Microsoft Enterprise SSO plug-in for Apple Devices that makes usage and management of Mac devices more seamless and secure than ever. At the start of public preview, Platform SSO works with Microsoft Intune. Other Mobile Device Management (MDM) providers are coming soon. Contact your MDM provider for more information on support and availability. For more information, see: macOS Platform Single Sign-on overview (preview).

General Availability - LastSuccessfulSignIn

Type: Changed feature
Service category: MS Graph
Product capability: Monitoring & Reporting

Due to popular demand and increased confidence in the stability of the properties, the update adds LastSuccessfulSignIn & LastSuccessfulSigninDateTime into V1. Feel free to take dependencies on these properties in your production environments now. For more information, see: signInActivity resource type.

General Availability - Changing default accepted token version for new applications

Type: Plan for change
Service category: Other
Product capability: Developer Experience

Beginning in August 2024, new Microsoft Entra applications created using any interface (including the Microsoft Entra admin center, Azure portal, Powershell/CLI, or the Microsoft Graph application API) has the default value of the requestedAccessTokenVersion property in the app registration set to 2. This capability is a change from the previous default of null` (meaning 1). This means that new resource applications receive v2 access tokens instead of v1 by default. This update improves the security of apps. For more information on differences between token versions, see: Access tokens in the Microsoft identity platform and Access token claims reference.

General Availability - Windows Account extension is now Microsoft Single Sign On

Type: Changed feature
Service category: Authentications (Logins)
Product capability: SSO

The Windows Account extension is now the Microsoft Single Sign On extension in docs and Chrome store. The Windows Account extension is updated to represent the new macOS compatibility. This capability is now known as the Microsoft Single Sign On (SSO) extension for Chrome, offering single sign-on and device identity features with the Enterprise SSO plug-in for Apple devices. This update is only a name change for the extension, there are no software changes to the extension itself.

April 2024

General availability - PIM approvals and activations on the Azure mobile app (iOS and Android) are available now

Type: New feature
Service category: Privileged Identity Management
Product capability: Privileged Identity Management

PIM is now available on the Azure mobile app in both iOS and Android. Customers can now approve or deny incoming PIM activation requests. Customers can also activate Microsoft Entra ID and Azure resource role assignments directly from an app on their devices. For more information, see: Activate PIM roles using the Azure mobile app.

General Availability - Dynamic Groups quota increased to 15,000.

Type: Changed feature
Service category: Group Management
Product capability: Directory

Microsoft Entra organizations could previously have a maximum of 15,000 dynamic membership groups and dynamic administrative units combined.

This quota is increased to 15,000. For example, you can now have 15,000 dynamic membership groups and 10,000 dynamic AUs (or any other combination that adds up to 15k). You don't need to do anything to take advantage of this change - this update is available right now. For more information, see: Microsoft Entra service limits and restrictions.

General Availability - Microsoft Graph activity logs

Type: New feature
Service category: Microsoft Graph
Product capability: Monitoring & Reporting

The Microsoft Graph activity logs is now generally available! Microsoft Graph activity logs give you visibility into HTTP requests made to the Microsoft Graph service in your tenant. With rapidly growing security threats, and an increasing number of attacks, this log data source allows you to perform security analysis, threat hunting, and monitor application activity in your tenant. For more information, see: Access Microsoft Graph activity logs.

Public Preview - Assign Microsoft Entra roles using Entitlement Management

Type: New feature
Service category: Entitlement Management
Product capability: Entitlement Management

By assigning Microsoft Entra roles to employees, and guests, using Entitlement Management, you can look at a user's entitlements to quickly determine which roles are assigned to that user. When you include a Microsoft Entra role as a resource in an access package, you can also specify whether that role assignment is eligible or active.

Assigning Microsoft Entra roles through access packages helps to efficiently manage role assignments at scale and improves the role. For more information, see: Assign Microsoft Entra roles (Preview).

General Availability - Self-service password reset Admin policy expansion to include more roles

Type: Changed feature
Service category: Self Service Password Reset
Product capability: Identity Security & Protection

Self-service password reset (SSPR) policy for Admins expands to include three extra built-in admin roles. These extra roles include:

  • Teams Administrator
  • Teams Communications Administrator
  • Teams Devices Administrator

For more information on Self-service password reset for admins, including the full list of in-scope admin roles, see Administrator reset policy differences.

March 2024

Public Preview - Convert external users to internal

Type: New feature
Service category: User Management
Product capability: User Management

External user conversion enables customers to convert external users to internal members without needing to delete and create new user objects. Maintaining the same underlying object ensures the user’s account, and access to resources, isn’t disrupted and that their history of activities remains intact as their relationship with the host organization changes.

The external to internal user conversion feature includes the ability to convert on-premises synchronized users as well. For more information, see: Convert external users to internal users (Preview).

Public Preview - Alternate Email Notifications for Lockbox Requests

Type: New feature
Service category: Other
Product capability: Access Control

Customer Lockbox for Azure is launching a new feature that enables customers to use alternate email IDs for getting lockbox notifications. This capability enables Lockbox customers to receive notifications in scenarios where their Azure account isn't email enabled, or if they have a service principal defined as the tenant admin or subscription owner.

Plan for change - Conditional Access location condition is moving up

Type: Plan for change
Service category: Conditional Access
Product capability: Identity Security & Protection

Beginning in mid-April 2024, the Conditional Access Locations condition is moving up. Locations become the Network assignment, with the new Global Secure Access assignment - All compliant network locations.

This change occurs automatically, so admins take no action. Here's more details:

  • The familiar Locations condition is unchanged, updating the policy in the Locations condition are reflected in the Network assignment, and vice versa.
  • No functionality changes, existing policies continue to work without changes.

Public Preview - Azure Lockbox Approver Role for Subscription Scoped Requests

Type: New feature
Service category: Other
Product capability: Identity Governance

Customer Lockbox for Azure is launching a new built-in Azure Role-based access control role that enables customers to use a lesser privileged role for users responsible for approving/rejecting Customer Lockbox requests. This feature is targeted to the customer admin workflow where a lockbox approver acts on the request from Microsoft Support engineer to access Azure resources in a customer subscription.

In this first phase, we're launching a new built-in Azure Role-based Access Control role. This role helps scope down the access possible for an individual with Azure Customer Lockbox approver rights on a subscription and its resources. A similar role for tenant-scoped requests is available in subsequent releases.

General Availability - TLS 1.3 support for Microsoft Entra

Type: New feature
Service category: Other
Product capability: Platform

We're excited to announce that Microsoft Entra, is rolling out support for Transport Layer Security (TLS) 1.3 for its endpoints to align with security best practices (NIST - SP 800-52 Rev. 2). With this change, the Microsoft Entra ID related endpoints support both TLS 1.2 and TLS 1.3 protocols. For more information, see: TLS 1.3 support for Microsoft Entra services.

General Availability - Changing Passwords in My Security Info

Type: New feature
Service category: My Security Info
Product capability: End User Experiences

Now Generally Available, My Sign Ins (My sign-ins (microsoft.com)) supports end users changing their passwords inline. When a user authenticates with a password and an MFA credential, they're able to are able to change their password without entering their existing password. Beginning April 1, through a phased rollout, traffic from the Change password (azure.cn) portal will redirect to the new My Sign Ins change experience. The Change password (azure.cn) will no longer be available after June 2024, but will continue to redirect to the new experience.

For more information, see:

February 2024

Public Preview - Expansion of the Conditional Access reauthentication policy for additional scenarios

Type: Changed feature
Service category: Conditional Access
Product capability: Identity Security & Protection

Reauthentication policy lets you require users to interactively provide their credentials again, typically before accessing critical applications and taking sensitive actions. Combined with Conditional Access session control of Sign-in frequency, you can require reauthentication for users and sign-ins with risk, or for Intune enrollment. With this public preview, you can now require reauthentication on any resource protected by Conditional Access. For more information, see: Require reauthentication every time.

General Availability - Granular filtering of Conditional Access policy list

Type: New feature
Service category: Conditional Access
Product capability: Access Control

Conditional access policies can now be filtered on actor, target resources, conditions, grant control, and session control. The granular filtering experience can help admins quickly discover policies containing specific configurations. For more information, see: What is Conditional Access?.

End of support - Azure Active Directory Connector for Forefront Identity Manager (FIM WAAD Connector)

Type: Deprecated
Service category: Microsoft Identity Manager
Product capability: Inbound to Microsoft Entra ID

The Azure Active Directory Connector for Forefront Identity Manager (FIM WAAD Connector) from 2014 was deprecated in 2021. The standard support for this connector ended in April 2024. Customers must remove this connector from their MIM sync deployment, and instead use an alternative provisioning mechanism. For more information, see: Migrate a Microsoft Entra provisioning scenario from the FIM Connector for Microsoft Entra ID.

January 2024

Generally Availability - New Microsoft Entra Home page

Type: Changed feature
Service category: N/A
Product capability: Directory

We redesigned the Microsoft Entra admin center's homepage to help you do the following tasks:

  • Learn about the product suite
  • Identify opportunities to maximize feature value
  • Stay up to date with recent announcements, new features, and more!

See the new experience here: https://entra.microsoftonline.cn/

Generally Availability - Conditional Access filters for apps

Type: New feature
Service category: Conditional Access
Product capability: Identity Security & Protection

Filters for apps in Conditional Access simplify policy management by allowing admins to tag applications with custom security, and target them in Conditional Access policies, instead of using direct assignments. With this feature, customers can scale up their policies, and protect any number of apps. For more information, see: Conditional Access: Filter for applications

December 2023

Public Preview - Configurable redemption order for B2B collaboration

Type: New feature
Service category: B2B
Product capability: B2B/B2C

With configurable redemption, you can customize the order of identity providers that your guest users can sign in with when they accept your invitation. This option lets your override the default configuration order set by Microsoft and use your own. This option can be used to help with scenarios like prioritizing a SAML/WS-fed federation above a Microsoft Entra ID verified domain. This option disables certain identity providers during redemption, or even only using something like email one-time pass-code as a redemption option. For more information, see: Configurable redemption (Preview).

General Availability - Edits to Dynamic Group Rule Builder

Type: Changed feature
Service category: Group Management
Product capability: Directory

The dynamic group rule builder is updated to no longer include the 'contains' and 'notContains' operators, as they're less performant. If needed, you can still create rules for dynamic membership groups with those operators by typing directly into the text box. For more information, see: Rule builder in the Azure portal.

November 2023

General Availability - Guest Governance: Inactive Guest Insights

Type: New feature
Service category: Reporting
Product capability: Identity Governance

Monitor guest accounts at scale with intelligent insights into inactive guest users in your organization. Customize the inactivity threshold depending on your organization’s needs, narrow down the scope of guest users you want to monitor, and identify the guest users that might be inactive. For more information, see: Monitor and clean up stale guest accounts using access reviews.

Public Preview - lastSuccessfulSignIn property in signInActivity API

Type: New feature
Service category: MS Graph
Product capability: End User Experiences

An extra property is added to signInActivity API to display the last successful sign in time for a specific user, regardless if the sign in was interactive or non-interactive. The data won't be backfilled for this property, so you should expect to be returned only successful sign in data starting on December 8, 2023.

General Availability - Autorollout of Conditional Access policies

Type: New feature
Service category: Conditional Access
Product capability: Access Control

Starting in November 2023, Microsoft begins automatically protecting customers with Microsoft managed Conditional Access policies. Microsoft creates and enables these policies in external tenants. The following policies are rolled out to all eligible tenants, who are notified before policy creation:

  1. Multifactor authentication for admin portals: This policy covers privileged admin roles and requires multifactor authentication when an admin signs into a Microsoft admin portal.
  2. Multifactor authentication for per-user multifactor authentication users: This policy covers users with per-user multifactor authentication and requires multifactor authentication for all resources.
  3. Multifactor authentication for high-risk sign-ins: This policy covers all users and requires multifactor authentication and reauthentication for high-risk sign-ins.

For more information, see:

General Availability - Custom security attributes in Microsoft Entra ID

Type: New feature
Service category: Directory Management
Product capability: Directory

Custom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources. Custom security attributes can be used with Azure attribute-based access control (Azure ABAC). For more information, see: What are custom security attributes in Microsoft Entra ID?.

Changes were made to custom security attribute audit logs for general availability that might affect your daily operations. If you have been using custom security attribute audit logs during the preview, there are the actions you must take before February 2024 to ensure your audit log operations aren't disrupted. For more information, see: Custom security attribute audit logs.

October 2023

Public Preview - Managing and Changing Passwords in My Security Info

Type: New feature
Service category: My Profile/Account
Product capability: End User Experiences

My Sign Ins (My Sign-Ins (microsoft.com)) now supports end users managing and changing their passwords. Users are able to manage passwords in My Security Info and change their password inline. If a user authenticates with a password and an MFA credential, they're able to are able to change their password without entering their existing password.

For more information, see: Combined security information registration for Microsoft Entra overview.

General Availability - Enhanced Devices List Management Experience

Type: Changed feature
Service category: Device Access Management
Product capability: End User Experiences

Several changes were made to the All Devices list since announcing public preview, including:

  • Prioritized consistency and accessibility across the different components
  • Modernized the list and addressed top customer feedback
    • Added infinite scrolling, column reordering, and the ability to select all devices
    • Added filters for OS Version and Autopilot devices
  • Created more connections between Microsoft Entra and Intune
    • Added links to Intune in Compliant and MDM columns
    • Added Security Settings Management column

For more information, see: View and filter your devices.

General Availability - Windows MAM

Type: New feature
Service category: Conditional Access
Product capability: Access Control

Windows MAM is the first step toward Microsoft management capabilities for unmanaged Windows devices. This functionality comes at a critical time when we need to ensure the Windows platform is on par with the simplicity and privacy promise we offer end users today on the mobile platforms. End users can access company resources without needing the whole device to be MDM managed.

For more information, see: Require an app protection policy on Windows devices.

General Availability - Microsoft Security email update and Resources for Azure Active Directory rename to Microsoft Entra ID

Type: Plan for change
Service category: Other
Product capability: End User Experiences

Microsoft Entra ID is the new name for Azure Active Directory (Azure AD). The rename and new product icon are now being deployed across experiences from Microsoft. Most updates are complete by mid-November of this year. As previously announced, it's a new name change, with no effect on deployments or daily work. There are no changes to capabilities, licensing, terms of service, or support.

From October 15 to November 15, Azure AD emails previously sent from azure-noreply@microsoft.com will start being sent from MSSecurity-noreply@microsoft.com. You might need to update your Outlook rules to match this change.

Additionally, we update email content to remove all references of Azure AD where relevant, and include an informational banner that announces this change.

Here are some resources to guide you rename your own product experiences or content where necessary:

General Availability - Restrict Microsoft Entra ID Tenant Creation To Only Paid Subscription

Type: Changed feature
Service category: Managed identities for Azure resources
Product capability: End User Experiences

The ability to create new tenants from the Microsoft Entra admin center allows users in your organization to create test and demo tenants from your Microsoft Entra ID tenant, Learn more about creating tenants. When used incorrectly this feature can allow the creation of tenants that aren't managed or viewable by your organization. We recommend that you restrict this capability so that only trusted admins can use this feature, Learn more about restricting member users' default permissions. We also recommend you use the Microsoft Entra audit log to monitor for the Directory Management: Create Company event that signals a new tenant created by a user in your organization.

To further protect your organization, Microsoft is now limiting this functionality to only paid customers. Customers on trial subscriptions are unable to create more tenants from the Microsoft Entra admin center. Customers in this situation who need a new trial tenant can sign up for a Free Azure Account.

General Availability - Users can't modify GPS location when using location based access control

Type: Plan for change
Service category: Conditional Access
Product capability: User Authentication

In an ever-evolving security landscape, the Microsoft Authenticator is updating its security baseline for Location Based Access Control (LBAC) conditional access policies. Microsoft does this to disallow authentications where the user might be using a different location than the actual GPS location of the mobile device. Today, it's possible for users to modify the location reported by the device on iOS and Android devices. The Authenticator app starts to deny LBAC authentications where we detect that the user isn't using the actual location of the mobile device where the Authenticator is installed.

In the November 2023 release of the Authenticator app, users who are modifying the location of their device sees a denial message in the app when doing an LBAC authentication. Microsoft ensures that users aren’t using older app versions to continue authenticating with a modified location. Beginning January 2024, any users that are on Android Authenticator 6.2309.6329 version or prior and iOS Authenticator version 6.7.16 or prior are blocked from using LBAC. To determine which users are using older versions of the Authenticator app, you can use our MSGraph APIs.

Public Preview - Overview page in My Access portal

Type: New feature
Service category: Entitlement Management
Product capability: Identity Governance

Today, when users navigate to myaccess.microsoftonline.cn, they land on a list of available access packages in their organization. The new Overview page provides a more relevant place for users to land. The Overview page points them to the tasks they need to complete and helps familiarize users with how to complete tasks in My Access.

Admins can enable/disable the Overview page preview by signing into the Microsoft Entra admin center and navigating to Entitlement management > Settings > Opt-in Preview Features and locating My Access overview page in the table.

For more information, see: My Access Overview page.

Public Preview - Microsoft Graph Activity Logs

Type: New feature
Service category: Microsoft Graph
Product capability: Monitoring & Reporting

The MicrosoftGraphActivityLogs provides administrators full visibility into all HTTP requests accessing your tenant’s resources through the Microsoft Graph API. These logs can be used to find activity from compromised accounts, identify anomalous behavior, or investigate application activity. For more information, see: Access Microsoft Graph activity logs (preview).

September 2023

General Availability - Recovery of deleted application and service principals is now available

Type: New feature
Service category: Enterprise Apps
Product capability: Identity Lifecycle Management

With this release, you can now recover applications along with their original service principals, eliminating the need for extensive reconfiguration and code changes (Learn more). It significantly improves the application recovery story and addresses a long-standing customer need. This change is beneficial to you on:

  • Faster Recovery: You can now recover their systems in a fraction of the time it used to take, reducing downtime and minimizing disruptions.
  • Cost Savings: With quicker recovery, you can save on operational costs associated with extended outages and labor-intensive recovery efforts.
  • Preserved Data: Previously lost data, such as SMAL configurations, is now retained, ensuring a smoother transition back to normal operations.
  • Improved User Experience: Faster recovery times translate to improved user experience and customer satisfaction, as applications are backed up and running swiftly.

General Availability - Web Sign-In for Windows

Type: Changed feature
Service category: Authentications (Logins)
Product capability: User Authentication

We're thrilled to announce that as part of the Windows 11 September moment, we're releasing a new Web Sign-In experience that will expand the number of supported scenarios and greatly improve security, reliability, performance, and overall end-to-end experience for our users.

Web Sign-In (WSI) is a credential provider on the Windows lock/sign-in screen for AADJ joined devices that provide a web experience used for authentication and returns an auth token back to the operating system to allow the user to unlock/sign-in to the machine.

Web Sign-In was initially intended to be used for a wide range of auth credential scenarios; however, it was only previously released for limited scenarios such as: Simplified EDU Web Sign-In and recovery flows via Temporary Access Password (TAP).

The underlying provider for Web Sign-In is rewritten from the ground up with security and improved performance in mind. This release moves the Web Sign-in infrastructure from the Cloud Host Experience (CHX) WebApp to a newly written sign in Web Host (LWH) for the September moment. This release provides better security and reliability to support previous EDU & TAP experiences and new workflows enabling using various Auth Methods to unlock/sig in to the desktop.

General Availability - Support for Microsoft admin portals in Conditional Access

Type: New feature
Service category: Conditional Access
Product capability: Identity Security & Protection

When a Conditional Access policy targets the Microsoft Admin Portals cloud app, the policy is enforced for tokens issued to application IDs of the following Microsoft administrative portals:

  • Azure portal
  • Exchange admin center
  • Microsoft 365 admin center
  • Microsoft 365 Defender portal
  • Microsoft Entra admin center
  • Microsoft Intune admin center
  • Microsoft Purview compliance portal

For more information, see: Microsoft Admin Portals.

August 2023

General Availability - Tenant Restrictions V2

Type: New feature
Service category: Authentications (Logins)
Product capability: Identity Security & Protection

Tenant Restrictions V2 (TRv2) is now generally available for authentication plane via proxy.

TRv2 allows organizations to enable safe and productive cross-company collaboration while containing data exfiltration risk. With TRv2, you can control what external tenants your users can access from your devices or network using externally issued identities and provide granular access control on a per org, user, group, and application basis.

TRv2 uses the cross-tenant access policy, and offers both authentication and data plane protection. It enforces policies during user authentication, and on data plane access with Exchange Online, SharePoint Online, Teams, and MSGraph. While the data plane support with Windows GPO and Global Secure Access is still in public preview, authentication plane support with proxy is now generally available.

Visit Set up tenant restrictions v2 for more information on tenant restriction V2.

Public Preview - Cross-tenant access settings supports custom Role-Based Access Controls roles and protected actions

Type: New feature
Service category: B2B
Product capability: B2B/B2C

Cross-tenant access settings can be managed with custom roles defined by your organization. This capability enables you to define your own finely scoped roles to manage cross-tenant access settings instead of using one of the built-in roles for management. Learn more about creating your own custom roles.

You can also now protect privileged actions inside of cross-tenant access settings using Conditional Access. For example, you can require MFA before allowing changes to default settings for B2B collaboration. Learn more about Protected actions.

General Availability - Additional settings in Entitlement Management autoassignment policy

Type: Changed feature
Service category: Entitlement Management
Product capability: Entitlement Management

In the Microsoft Entra ID Governance entitlement management autoassignment policy, there are three new settings. This capability allows a customer to select to not have the policy create assignments, not remove assignments, and to delay assignment removal.

Public Preview - Setting for guest losing access

Type: Changed feature
Service category: Entitlement Management
Product capability: Entitlement Management

An administrator can configure that when a guest brought in through entitlement management has lost their last access package assignment, they're deleted after a specified number of days. For more information, see: Govern access for external users in entitlement management.