+> The community has developed the VS Code extension to help people implementing and maintaining Azure AD B2C solutions. The extension is not supported by Microsoft, and is made available strictly as-is.

+The Microsoft Entra provisioning service supports a [SCIM 2.0](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/provisioning-with-scim-getting-started/ba-p/880010) client that can be used to automatically provision users into cloud or on-premises applications. This article outlines how you can use the Microsoft Entra provisioning service to provision users into an on-premises application that's SCIM enabled. If you want to provision users into non-SCIM on-premises applications that use SQL as a data store, see the [Microsoft Entra ECMA Connector Host Generic SQL Connector tutorial](tutorial-ecma-sql-connector.md). If you want to provision users into cloud apps such as DropBox and Atlassian, review the app-specific [tutorials](../saas-apps/tutorial-list.md).

+1. Add the **On-premises SCIM app** from the [gallery](../manage-apps/add-application-portal.md).

+1. Add users to scope by [assigning users and groups](../manage-apps/add-application-portal-assign-users.md) to the application.

+1. Monitor using the [provisioning logs](../reports-monitoring/concept-provisioning-logs.md).

+Microsoft Entra application provisioning refers to automatically creating user identities and roles in the applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change. Common scenarios include provisioning a Microsoft Entra user into SaaS applications like [Dropbox](../saas-apps/dropboxforbusiness-provisioning-tutorial.md), [Salesforce](../saas-apps/salesforce-provisioning-tutorial.md), [ServiceNow](../saas-apps/servicenow-provisioning-tutorial.md), and many more.

+For detailed guidance on developing a SCIM endpoint to automate the provisioning and deprovisioning of users and groups to an application, see [Build a SCIM endpoint and configure user provisioning](use-scim-to-provision-users-and-groups.md). Many applications integrate directly with Microsoft Entra ID. Some examples include Slack, Azure Databricks, and Snowflake. For these apps, skip the developer documentation and use the tutorials provided in [Tutorials for integrating SaaS applications with Microsoft Entra ID](../saas-apps/tutorial-list.md).

+* **Automatic** means that a Microsoft Entra provisioning connector is available this application. Follow the setup tutorial specific to setting up provisioning for the application. Find the app tutorials at [Tutorials for integrating SaaS applications with Microsoft Entra ID](../saas-apps/tutorial-list.md).

+To configure your application with the Conditional Access Application Control, follow the instructions in [Deploy Conditional Access Application Control for Microsoft Entra apps](/defender-cloud-apps/proxy-deployment-aad).

+* [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview?context=graph/context&view=graph-rest-1.0&preserve-view=true)

+See, [Learn about sensitivity labels](/purview/sensitivity-labels?preserve-view=true&view=o365-worldwide)

+* [Restrict access to content by using sensitivity labels to apply encryption](/purview/encryption-sensitivity-labels?preserve-view=true&view=o365-worldwide)

+* [Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 Groups, and SharePoint sites](/purview/sensitivity-labels-teams-groups-sites)

+ * [Apply a sensitivity label to content automatically](/purview/apply-sensitivity-label-automatically?preserve-view=true&view=o365-worldwide)

+Learn more: [Get started with sensitivity labels](/purview/get-started-with-sensitivity-labels?preserve-view=true&view=o365-worldwide)

+You can enable Teams users from another entire external domain to find, call, chat, and set up meetings with your users with Teams Federation. [Manage external meetings and chat with people and organizations using Microsoft identities](/microsoftteams/trusted-organizations-external-meetings-chat) describes how you can allow users in your organization to chat and meet with people outside the organization who are using Microsoft as an identity provider.

+- [Identity and device access configurations](/microsoft-365/security/office-365-security/microsoft-365-policies-configurations)

+Microsoft recommends you have a good baseline and understanding of the issues in your on-premises environment that can result in synchronization issues to the cloud. Since automated tools such as [IdFix](/microsoft-365/enterprise/set-up-directory-synchronization) and [Microsoft Entra Connect Health](../hybrid/connect/whatis-azure-ad-connect.md#why-use-azure-ad-connect-health) can generate a high volume of false positives, we recommend you identify synchronization errors that have been left unaddressed for more than 100 days by cleaning up those objects in error. Long term unresolved synchronization errors can generate support incidents. [Troubleshooting errors during synchronization](../hybrid/connect/tshoot-connect-sync-errors.md) provides an overview of different types of sync errors, some of the possible scenarios that cause those errors and potential ways to fix the errors.

+- Deploy privileged access devices for privileged access to manage Microsoft 365 and Microsoft Entra ID. See [Device roles and profiles](/security/privileged-access-workstations/privileged-access-devices#device-roles-and-profiles).

+| Users, groups, and other directory objects| [directoryObject API](/graph/api/resources/directoryobject) |

+- **Avoid write functions to the directory on sign-in**: Never execute a write on sign-in without a precondition (if clause) in your custom policies. One use case that requires a write on a sign-in is [just-in-time migration of user passwords](https://github.com/azure-ad-b2c/user-migration/tree/master/seamless-account-migration). Avoid any scenario that requires a write on every sign-in. [Preconditions](/azure/active-directory-b2c/userjourneys) in a user journey will look like this:

+ - Learn more about [Azure Active Directory B2C service limits and restrictions](/azure/active-directory-b2c/service-limits?pivots=b2c-custom-policy).

+In an unlikely event, when the Azure AD B2C authentication service is unable to complete new sign-ups and sign-ins, you can still provide mitigation for users who are signed in. With [configuration](/azure/active-directory-b2c/configure-tokens), you can allow users that are already signed in to continue using the application without any perceived disruption until the user signs out from the application or the [session](/azure/active-directory-b2c/session-behavior) times out due to inactivity.

+[Windows Autopilot](/autopilot/windows-autopilot) can help you establish a streamlined onboarding and device provisioning, which can enforce these directives.

+* For Linux, you can [sign in to a Linux virtual machine (VM) by using Microsoft Entra credentials](../devices/howto-vm-sign-in-azure-ad-linux.md).

+* **Enforce strong authentication** - Strong authentication must always be used when accessing the isolated environment services and infrastructure. Whenever possible, [passwordless authentication](../authentication/concept-authentication-passwordless.md) such as [Windows for Business Hello](/windows/security/identity-protection/hello-for-business/hello-overview) or a [FIDO2 security keys](../authentication/howto-authentication-passwordless-security-key.md) should be used.

+* **Deploy secure workstations** - [Secure workstations](/security/privileged-access-workstations/privileged-access-devices) provide the mechanism to ensure that the platform and the identity that platform represents is properly attested and secured against exploitation. Two other approaches to consider are:

+Provision accounts in the isolated environment for administrative personnel and IT teams who operate the environment. This enables you to add stronger security policies such as device-based access control for [secure workstations](/security/privileged-access-workstations/privileged-access-deployment). As discussed in previous sections, nonproduction environments can potentially utilize Microsoft Entra B2B collaboration to onboard privileged accounts to the non-production tenants using the same posture and security controls designed for privileged access in their production environment.

+A [passwordless solution](../authentication/concept-authentication-passwordless.md) is the best solution for ensuring the most convenient and secure method of authentication. Passwordless credentials such as [FIDO security keys](../authentication/howto-authentication-passwordless-security-key.md) and [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/) are recommended for human identities with privileged roles.

+**Non-human identities** include any identity not associated with a human. This type of identity is an object such as an application that requires an identity to run. In this content, we refer to this type of identity as a **workload identity**. Various terms are used to describe this type of identity, including [application objects and service principals](/partner-center/marketplace/manage-aad-apps).

+* **Service principal object**. Although there are [exceptions](/partner-center/manage-aad-apps), application objects can be considered the *definition* of an application. Service principal objects can be considered an instance of an application. Service principals generally reference an application object, and one application object is referenced by multiple service principals across directories.

+ * **Microsoft Entra registered**. Devices not owned by the organization, for example, a personal device, used to access company resources. Organizations may require the device be enrolled via [Mobile Device Management (MDM)](https://www.microsoft.com/itshowcase/mobile-device-management-at-microsoft), or enforced through [Mobile Application Management (MAM)](/mem/intune/apps/apps-supported-intune-apps) without enrollment to access resources. This capability can be provided by a service such as Microsoft Intune.

+Another scenario for isolation within a single tenant could be separation between locations, subsidiary or implementation of tiered administration (according to the "[Enterprise Access Model](/security/privileged-access-workstations/privileged-access-access-model)").

+* Defender for Cloud Apps ΓÇô [Defender for Cloud Apps anomaly detection alerts investigation guide](/defender-cloud-apps/investigate-anomaly-alerts)

+* [Microsoft 365 Audit logs](/purview/audit-solutions-overview)

+* **[Microsoft Defender for Cloud Apps](/defender-cloud-apps/what-is-defender-for-cloud-apps)** ΓÇô enables you to discover and manage apps, govern across apps and resources, and check your cloud appsΓÇÖ compliance.

+* [Securing privileged access overview](/security/privileged-access-workstations/overview) ΓÇô This article provides an overview of current techniques using Zero Trust techniques to create and maintain secure privileged access.

+| Pass-the-ticket like attacks| High| | | Follow guidance in:<br>[Security principal reconnaissance (LDAP) (external ID 2038)](/defender-for-identity/reconnaissance-discovery-alerts)<br>[Tutorial: Compromised credential alerts](/defender-for-identity/credential-access-alerts)<br>[Understand and use Lateral Movement Paths with Microsoft Defender for Identity](/defender-for-identity/understand-lateral-movement-paths)<br>[Understanding entity profiles](/defender-for-identity/investigate-assets) |

+Legacy authentication is captured in the Microsoft Entra sign-in log as part of the detail of the event. You can use the Azure Monitor workbook to help with identifying legacy authentication usage. For more information, see [Sign-ins using legacy authentication](../reports-monitoring/howto-use-workbooks.md), which is part of [How to use Azure Monitor Workbooks for Microsoft Entra reports](../reports-monitoring/howto-use-workbooks.md). You can also use the Insecure protocols workbook for Microsoft Sentinel. For more information, see [Microsoft Sentinel Insecure Protocols Workbook Implementation Guide](https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-insecure-protocols-workbook-implementation-guide/ba-p/1197564). Specific activities to monitor include:

+* [Connect Microsoft Defender for Identity to Active Directory quickstart](/defender-for-identity/directory-service-accounts)

+* [What is hybrid identity with Microsoft Entra ID?](../hybrid/whatis-hybrid-identity.md) Microsoft's identity solutions span on-premises and cloud-based capabilities. Hybrid identity solutions create a common user identity for authentication and authorization to all resources, regardless of location.

+* [What is hybrid identity with Microsoft Entra ID?](../hybrid/whatis-hybrid-identity.md) Microsoft's identity solutions span on-premises and cloud-based capabilities. Hybrid identity solutions create a common user identity for authentication and authorization to all resources, regardless of location.

+A user navigates to [Security info](https://aka.ms/mysecurityinfo). After signing in, the user can update their password. For more information about different authentication methods that you can require by using Conditional Access policies, see [How to secure the registration of security info](../conditional-access/howto-conditional-access-policy-registration.md). When finished, the user has the new password updated on the Security info page.

+To get started, [download and install the Azure AD PowerShell module](/powershell/module/azuread/) and [connect it to your Microsoft Entra tenant](/powershell/module/azuread/connect-azuread#examples).

+**Phase 3** requires moving all clients that authenticate to the on-premises MFA Server (VPNs, password managers, and so on) to Microsoft Entra federation via SAML/OAUTH. If modern authentication standards aren't supported, you're required to stand up NPS server(s) with the Microsoft Entra multifactor authentication extension installed. Once dependencies are migrated, users should no longer use the User portal on the MFA Server, but rather should manage their authentication methods in Microsoft Entra ID ([aka.ms/mfasetup](https://aka.ms/mfasetup)). Once users begin managing their authentication data in Microsoft Entra ID, those methods won't be synced back to MFA Server. If you roll back to the on-premises MFA Server after users have made changes to their Authentication Methods in Microsoft Entra ID, those changes will be lost. After user migrations are complete, change the [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-1.0&preserve-view=true#federatedidpmfabehavior-values) domain federation setting. The change tells Microsoft Entra ID to no longer perform MFA on-premises and to perform _all_ MFA requests with Microsoft Entra multifactor authentication, regardless of group membership.

+To configure Microsoft Entra ID to ignore MFA requests to your on-premises federation server, install the [Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/installation?view=graph-powershell-1.0&preserve-view=true&viewFallbackFrom=graph-powershell-) and set [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-1.0&preserve-view=true#federatedidpmfabehavior-values) to `rejectMfaByFederatedIdp`, as shown in the following example.

+1. Configure Microsoft Entra ID to accept MFA requests to your on-premises federation server. Use Graph PowerShell to set [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-1.0&preserve-view=true#federatedidpmfabehavior-values) to `enforceMfaByFederatedIdp`, as shown in the following example.

+For federated domains, MFA may be enforced by Microsoft Entra Conditional Access or by the on-premises federation provider. Each federated domain has a Microsoft Graph PowerShell security setting named **federatedIdpMfaBehavior**. You can set **federatedIdpMfaBehavior** to `enforceMfaByFederatedIdp` so Microsoft Entra ID accepts MFA that's performed by the federated identity provider. If the federated identity provider didn't perform MFA, Microsoft Entra ID redirects the request to the federated identity provider to perform MFA. For more information, see [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-beta&preserve-view=true#federatedidpmfabehavior-values).

+>Set the domain setting [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-beta&preserve-view=true#federatedidpmfabehavior-values) to `enforceMfaByFederatedIdp` (recommended) or **SupportsMFA** to `$True`. The **federatedIdpMfaBehavior** setting overrides **SupportsMFA** when both are set.

+>[!NOTE]

+>A user is not reported as High Risk if they perform passwordless authentication.

+ >[!NOTE]

+ >The **Skip multi-factor authentication for requests from federated users on my intranet** option will affect the Conditional Access evaluation for locations.

+Run this PowerShell in an ISE window or save as a `.PS1` file to run locally. The operation can only be done by using the [MSOnline module](/powershell/module/msonline/#msonline).

+| I'm not seeing the methods I expected to see. | 1. Check if the user has a Microsoft Entra admin role. If yes, view the SSPR admin policy differences. <br> 2. Determine whether the user is being interrupted because of multifactor authentication registration enforcement or SSPR registration enforcement. See the [flowchart](../authentication/concept-registration-mfa-sspr-combined.md#combined-registration-modes) under "Combined registration modes" to determine which methods should be shown. <br> 3. Determine how recently the multifactor authentication or SSPR policy was changed. If the change was recent, it might take some time for the updated policy to propagate.|

+If you have general questions about Microsoft Entra ID and self-service password reset, you can ask the community for assistance on the [Microsoft Q&A question page for Microsoft Entra ID](/answers/tags/455/entra-id). Members of the community include engineers, product managers, MVPs, and fellow IT professionals.

+For Azure AD integration, we use [Microsoft Q&A](/answers/) with the community to provide support.

+<!--Image references-->

+- Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see [Connect to Exchange Online PowerShell using multifactor authentication](/powershell/exchange/connect-to-exchange-online-powershell).

+1. If you've activated the [new sign-in activity reports preview](../reports-monitoring/concept-sign-ins.md), repeat the above steps also on the **User sign-ins (non-interactive)** tab.

+- For more information about modern authentication support, see [How modern authentication works for Office client apps](/microsoft-365/enterprise/modern-auth-for-office-2013-and-2016)

+- [Enable Modern Authentication for Office 2013 on Windows devices](/microsoft-365/admin/)

+- [How to configure Exchange Server on-premises to use Hybrid Modern Authentication](/microsoft-365/enterprise/configure-exchange-server-for-hybrid-modern-authentication)

+- [How to use Modern Authentication with Skype for Business](/microsoft-365/enterprise/hybrid-modern-auth-overview)

+| Office 2016 apps, Office 2013 (with modern authentication), [OneDrive sync client](/sharepoint/enable-conditional-access) | SharePoint | Windows 8.1, Windows 7 |

+- [Require device to be marked as compliant (Microsoft Intune)](/mem/intune/protect/device-compliance-get-started)

+Organizations can require that an approved client app is used to access selected cloud apps. These approved client apps support [Intune app protection policies](/mem/intune/apps/app-protection-policy) independent of any mobile device management solution.

+- [Enabling limited access with Exchange Online](/microsoft-365/security/office-365-security/secure-email-recommended-policies?view=o365-worldwide&preserve-view=true#limit-access-to-exchange-online-from-outlook-on-the-web)

+[Device compliance policies work with Microsoft Entra ID](/mem/intune/protect/device-compliance-get-started#device-compliance-policies-work-with-azure-ad)

+If [classic policies](./policy-migration-mfa.md) exist for the selected cloud apps, an indicator is presented to you. By clicking the indicator, you're redirected to the classic policies page. On the classic policies page, you can migrate a classic policy or just disable it. You can return to your evaluation result by closing this page.

+In desktop apps, if you want the token cache to persist, you can customize the [token cache serialization](/entra/msal/dotnet/how-to/token-cache-serialization). By implementing dual token cache serialization, you can use backward-compatible and forward-compatible token caches.

+> A mobile app that uses MSAL.iOS, MSAL.Android, or MSAL.NET on Xamarin can have app protection policies applied to it. For instance, the policies might prevent a user from copying protected text. The mobile app is managed by Intune and is recognized by Intune as a managed app. For more information, see [Microsoft Intune App SDK overview](/mem/intune/developer/app-sdk).

+> The [Intune App SDK](/mem/intune/developer/app-sdk-get-started) is separate from MSAL libraries and interacts with Microsoft Entra ID on its own.

+- [Securing access to IoT apps.](/azure/architecture/reference-architectures/iot#security)

+To compute the assertion, you can use one of the many JWT libraries in the language of your choice - [MSAL supports this using `.WithCertificate()`](/entra/msal/dotnet/acquiring-tokens/msal-net-client-assertions). The information is carried by the token in its **Header**, **Claims**, and **Signature**.

+The [MSAL.NET library handles this scenario](/entra/msal/dotnet/acquiring-tokens/web-apps-apis/confidential-client-assertions) in a single line of code.

+- [Zero trust with the Microsoft identity platform](/security/zero-trust/develop/identity)

+[AAD-Dev-Guide]:./index.yml

+- Learn how to use [Azure PowerShell](howto-authenticate-service-principal-powershell.md) or [Azure CLI](/cli/azure/azure-cli-sp-tutorial-1) to create a service principal.

+.

+ apps.

+ In web apps or web APIs, keep one token cache per account. For web apps, the token cache should be keyed by the account ID. For web APIs, the account should be keyed by the hash of the token used to call the API. MSAL.NET provides custom token cache serialization in the .NET Framework and .NET Core subplatforms. For security and performance reasons, our recommendation is to serialize one cache per user. For more information, read about [token cache serialization](/entra/msal/dotnet/how-to/token-cache-serialization).

+| **Substring() - Fixed Length** | Extracts parts of a string claim type, beginning at the character at the specified position, and returns the specified number of characters.<br/>SourceClaim - The claim source of the transform that should be executed.<br/>StartIndex - The zero-based starting character position of a substring in this instance.<br/>Length - The length in characters of the substring.<br/>For example:<br/>sourceClaim - PleaseExtractThisNow<br/>StartIndex - 6<br/>Length - 11<br/>Output: ExtractThis |

+| **Substring() - EndOfString** | Extracts parts of a string claim type, beginning at the character at the specified position, and returns the rest of the claim from the specified start index. <br/>SourceClaim - The claim source of the transform.<br/>StartIndex - The zero-based starting character position of a substring in this instance.<br/>For example:<br/>sourceClaim - PleaseExtractThisNow<br/>StartIndex - 6<br/>Output: ExtractThisNow |

+| **RegexReplace()** | RegexReplace() transformation accepts as input parameters:<br/>- Parameter 1: a user attribute as regex input<br/>- An option to trust the source as multivalued<br/>- Regex pattern<br/>- Replacement pattern. The replacement pattern may contain static text format along with a reference that points to regex output groups and more input parameters. |

+Use PowerShell to [instantiate an MSAL Public Client Application](/entr) flow to obtain a delegated permission access token for Microsoft Graph. Use the access token to call Microsoft Graph and configure a custom signing key for the service principal. After you configure the custom signing key, your application code needs to [validate the token signing key](#validate-token-signing-key).

+- [Get a token from the token cache using MSAL.NET](/entra/msal/dotnet/acquiring-tokens/acquire-token-silently)

+- An Azure AD B2C authority. See [B2C specifics](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/social-identities).

+- An Active Directory Federation Services (AD FS) authority. See [AD FS support](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/adfs-support).

+ - [Logging in MSAL.NET](/entra/msal/dotnet/advanced/exceptions/msal-logging)

+Learn about [instantiating client applications by using MSAL.NET](/entr).

+- [Instantiating client applications by using MSAL.NET](/entra/msal/dotnet/getting-started/initializing-client-applications)

+- [Migrate to MSAL .NET](/entra/msal/dotnet/how-to/msal-net-migration)

+For more information and code examples, see [Choosing between an embedded web browser and a system browser on Xamarin Android](https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/MSAL.NET-uses-web-browser#choosing-between-embedded-web-browser-or-system-browser-on-xamarinandroid) and [Embedded versus system web UI](/entra/msal/dotnet/acquiring-tokens/using-web-browsers#embedded-vs-system-web-ui).

+Learn about [Considerations for using Universal Windows Platform with MSAL.NET](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/uwp).

+For more information, see [Use web browsers for MSAL.NET](/entr).

+This quickstart uses a sample JavaScript (JS) single-page app (SPA) to show you how to sign in users by using the [authorization code flow](./v2-oauth2-auth-code-flow.md) with Proof Key for Code Exchange (PKCE) and call the Microsoft Graph API. The sample uses the [Microsoft Authentication Library for JavaScript](/javascript/api/%40azure/msal-react/) to handle authentication.

+> This section gives an overview of the code required to sign in users and call the Microsoft Graph API on their behalf. This overview can be useful to understand how the code works, main arguments, and also if you want to add sign-in to an existing ASP.NET Core application and call Microsoft Graph. It uses [Microsoft.Identity.Web](/entr).

+> The line containing `.AddMicrosoftIdentityWebApp` adds the Microsoft identity platform authentication to your application. This is provided by [Microsoft.Identity.Web](/entra/msal/dotnet/microsoft-identity-web/). It's then configured to sign in using the Microsoft identity platform based on the information in the `AzureAD` section of the *appsettings.json* configuration file:

+## October 2023

+### Updated RemoteConnect UX Prompt

+**Effective date**: October 2023

+**Endpoints impacted**: v2.0 and v1.0

+**Protocol impacted**: RemoteConnect

+RemoteConnect is a cross-device flow that is used for Microsoft Authentication Broker and Microsoft Intune related scenarios involving [Primary Refresh Tokens](../devices/concept-primary-refresh-token.md). To help prevent phishing attacks, the RemoteConnect flow will be receiving updated UX language to call out that the remote device (the device which initiated the flow) will be able to access any applications used by your organization upon successful completion of the flow.

+The prompt that appears will look something like this:

+To find more information on verified domains, refer to the [custom domains documentation](../fundamentals/add-custom-domain.md).

+| **ToLowercase()** | string | output string | Converts the characters of the selected attribute into lowercase characters. |

+| **ToUppercase()** | string | output string | Converts the characters of the selected attribute into uppercase characters. |

+| **RegexReplace()** | | | RegexReplace() transformation accepts as input parameters:<br/>- Parameter 1: a user attribute as regex input<br/>- An option to trust the source as multivalued<br/>- Regex pattern<br/>- Replacement pattern. The replacement pattern may contain static text format along with a reference that points to regex output groups and more input parameters. |

+| AADSTS16000 | SelectUserAccount - This is an interrupt thrown by Microsoft Entra ID, which results in UI that allows the user to select from among multiple valid SSO sessions. This error is fairly common and might be returned to the application if `prompt=none` is specified. |

+| AADSTS500011 | InvalidResourceServicePrincipalNotFound - The resource principal named {name} was not found in the tenant named {tenant}. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant. If you expect the app to be installed, you might need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is. |

+| AADSTS50020 | UserUnauthorized - Users are unauthorized to call this endpoint. User account '{email}' from identity provider '{idp}' does not exist in tenant '{tenant}' and cannot access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. If this user should be a member of the tenant, they should be invited via the [B2B system](../external-identities/add-users-administrator.md). For additional information, visit [AADSTS50020](/troubleshoot/azure/active-directory/error-code-aadsts50020-user-account-identity-provider-does-not-exist). |

+| AADSTS50034 | UserAccountNotFound - To sign into this application, the account must be added to the directory. This error can occur because the user mis-typed their username, or isn't in the tenant. An application might have chosen the wrong tenant to sign into, and the currently logged in user was prevented from doing so since they did not exist in your tenant. If this user should be able to log in, add them as a guest. See docs here: [Add B2B users](../external-identities/add-users-administrator.md). |

+| AADSTS50055 | InvalidPasswordExpiredPassword - The password is expired. The user's password is expired, and therefore their login or session was ended. They will be offered the opportunity to reset it, or can ask an admin to reset it via [Reset a user's password using Microsoft Entra ID](../fundamentals/users-reset-password-azure-portal.md). |

+| AADSTS50058 | UserInformationNotProvided - Session information isn't sufficient for single-sign-on. This means that a user isn't signed in. This is a common error that's expected when a user is unauthenticated and has not yet signed in.</br>If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid.</br>This error might be returned to the application if prompt=none is specified. |

+| AADSTS50076 | UserStrongAuthClientAuthNRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because you moved to a new location, the user must use multifactor authentication to access the resource. Retry with a new authorize request for the resource. |

+| AADSTS50078 | UserStrongAuthExpired- Presented multifactor authentication has expired due to policies configured by your administrator, you must refresh your multifactor authentication to access '{resource}'.|

+| AADSTS50079 | UserStrongAuthEnrollmentRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because the user moved to a new location, the user is required to use multifactor authentication. Either a managed user needs to register security info to complete multifactor authentication, or a federated user needs to get the multifactor claim from the federated identity provider. |

+| AADSTS50194 | Application '{appId}'({appName}) isn't configured as a multitenant application. Usage of the /common endpoint isn't supported for such applications created after '{time}'. Use a tenant-specific endpoint or configure the application to be multitenant. |

+| AADSTS53004 | ProofUpBlockedDueToRisk - User needs to complete the multifactor authentication registration process before accessing this content. User should register for multifactor authentication. |

+| AADSTS53010 | ProofUpBlockedDueToSecurityInfoAcr - Cannot configure multifactor authentication methods because the organization requires this information to be set from specific locations or devices. |

+| AADSTS65002 | Consent between first party application '{applicationId}' and first party resource '{resourceId}' must be configured via preauthorization - applications owned and operated by Microsoft must get approval from the API owner before requesting tokens for that API. A developer in your tenant might be attempting to reuse an App ID owned by Microsoft. This error prevents them from impersonating a Microsoft application to call other APIs. They must move to another app ID they register.|

+| AADSTS65005 | MisconfiguredApplication - The app required resource access list does not contain apps discoverable by the resource or The client app has requested access to resource, which was not specified in its required resource access list or Graph service returned bad request or resource not found. If the app supports SAML, you might have configured the app with the wrong Identifier (Entity). To learn more, see the troubleshooting article for error [AADSTS650056](/troubleshoot/azure/active-directory/error-code-aadsts650056-misconfigured-app). |

+| AADSTS70000 | InvalidGrant - Authentication failed. The refresh token isn't valid. Error might be due to the following reasons:<ul><li>Token binding header is empty</li><li>Token binding hash does not match</li></ul> |

+| AADSTS90014 | MissingRequiredField - This error code might appear in various cases when an expected field isn't present in the credential. |

+| AADSTS900384 | JWT token failed signature validation. Actual message content is runtime specific, there are a variety of causes for this error. Please see the returned exception message for details.|

+> | Web application | &#8226; [Sign in users](https://github.com/Azure-Samples/ms-identity-python-django-tutorial/tree/main/1-Authentication/sign-in) <br/> &#8226; [Sign in users (B2C)](https://github.com/Azure-Samples/ms-identity-python-django-tutorial/tree/main/1-Authentication/sign-in-b2c) <br/> &#8226; [Call Microsoft Graph](https://github.com/Azure-Samples/ms-identity-python-django-tutorial/tree/main/2-Authorization-I/call-graph) <br/> &#8226; [Deploy to Azure App Service](https://github.com/Azure-Samples/ms-identity-python-django-tutorial/tree/main/3-Deployment/deploy-to-azure-app-service)| [MSAL Python](/entra/msal/python/) | Authorization code |

+> | Desktop | &#8226; [Sign in users and call ASP.NET Core web API](https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore-v2/tree/master/1.%20Desktop%20app%20calls%20Web%20API) <br/> &#8226; [Sign in users and call Microsoft Graph](https://github.com/azure-samples/active-directory-dotnet-desktop-msgraph-v2) | [MSAL.NET](/entra/msal/dotnet/) | Authorization code with PKCE |

+When you use `WithClientAssertion`, provide a signed JWT. This advanced scenario is detailed in [Client assertions](/entra/msal/dotnet/acquiring-tokens/msal-net-client-assertions).

+Again, for details, see [Client assertions](/entra/msal/dotnet/acquiring-tokens/msal-net-client-assertions).

+ - Calling [AcquireTokenForClient](/dotnet/api/microsoft.identity.client.acquiretokenforclientparameterbuilder?preserve-view=true&view=msal-dotnet-latest&viewFallbackFrom=azure-dotnet).

+For desktop applications, see [Parent window handles](./scenario-desktop-acquire-token-wam.md#parent-window-handles).

+This method enables you to specify if you want to force the usage of an embedded WebView or the system WebView (when available). For more information, see [Usage of web browsers](/entra/msal/dotnet/acquiring-tokens/using-web-browsers).

+For more information, see [UWP-specific considerations with MSAL.NET](/entra/msal/dotnet/acquiring-tokens/desktop-mobile/uwp).

+> To fully understand the code examples here, be familiar with [ASP.NET Core fundamentals](/aspnet/core/fundamentals/), and in particular with [dependency injection](/aspnet/core/fundamentals/dependency-injection) and [options](/aspnet/core/fundamentals/configuration/options).

+The use of client assertions is an advanced scenario, detailed in [Client assertions](/entra/msal/dotnet/acquiring-tokens/msal-net-client-assertions).

+> The token-cache implementation for web apps or web APIs is different from the implementation for desktop applications, which is often [file based](/entra/msal/dotnet/how-to/token-cache-serialization).

+The ASP.NET core tutorial uses dependency injection to let you decide the token cache implementation in the Startup.cs file for your application. Microsoft.Identity.Web comes with prebuilt token-cache serializers described in [Token cache serialization](/entra/msal/dotnet/how-to/token-cache-serialization). An interesting possibility is to choose ASP.NET Core [distributed memory caches](/aspnet/core/performance/caching/distributed#distributed-memory-cache):

+The ASP.NET tutorial uses dependency injection to let you decide the token cache implementation in the *Startup.Auth.cs* file for your application. *Microsoft.Identity.Web* comes with prebuilt token-cache serializers described in [Token cache serialization](/entra/msal/dotnet/how-to/token-cache-serialization). An interesting possibility is to choose ASP.NET Core [distributed memory caches](/aspnet/core/performance/caching/distributed#distributed-memory-cache):

+For details see [Token cache serialization for MSAL.NET](/entra/msal/dotnet/how-to/token-cache-serialization).

+|**Use private groups for access control**. Microsoft 365 groups are managed by the [visibility concept](/graph/api/resources/group?view=graph-rest-1.0&preserve-view=true#group-visibility-options). This property controls the join policy of the group and visibility of group resources. Security groups have join policies that either allow anyone to join or require owner approval. On-premises-synced groups can also be public or private. Users joining an on-premises-synced group can get access to cloud resource as well.|When you use a public group for access control, any member can join the group and get access to the resource. The risk of elevation of privilege exists when a public group is used to give access to an external resource.|

+These configurations and best practices will help you avoid common scenarios that block [FIDO2 passwordless authentication](../authentication/concept-authentication-passwordless.md) from being available to users of your applications.

+Don't use a domain hint to bypass [home-realm discovery](../manage-apps/configure-authentication-for-federated-users-portal.md). This feature is meant to make sign-ins more streamlined, but the federated identity provider may not support passwordless authentication.

+[Passwordless authentication options for Microsoft Entra ID](../authentication/concept-authentication-passwordless.md)

+ Ensure [multi-factor authentication](../authentication/concept-mfa-licensing.md) is enabled and **required** for the user you're signing in with and for this scenario. For example, MFA could be:

+1. Ensure [multi-factor authentication](../authentication/concept-mfa-licensing.md) is enabled and **required** for the user you're signing in with and for this scenario

+* [Visual Studio 2019](https://visualstudio.microsoft.com/vs/) with the [Universal Windows Platform development](/windows/apps/windows-app-sdk/set-up-your-development-environment) workload installed

+To customize the information returned by the identity platform during authentication and authorization, use [claims mapping](./saml-claims-customization.md) and [optional claims](./optional-claims.md) to modify security token configuration.

+> [!WARNING]

+> Never use the **tenant ID** value of the `tenant` parameter to authenticate or authorize users. The tenant ID value can be updated and sent by bad actors to impersonate a response to your app. This can cause your application to be exposed to security incidents.

+- [Migrate confidential client applications from ADAL.NET to MSAL.NET](/entra/msal/dotnet/how-to/migrate-confidential-client) - Improving clarity in the content

+- [Windows Autopilot](/autopilot/windows-autopilot)

+- [Bulk deployment](/mem/intune/enrollment/windows-bulk-enroll)

+1. Create a VM by running [az vm create](/cli/azure/vm?#az-vm-create). Use a supported distribution in a supported region.

+You can deploy the package by using a software distribution system likeΓÇ»[Microsoft Configuration Manager](/mem/configmgr/). The package supports the standard silent installation options with the quiet parameter. The current branch of Configuration Manager offers benefits over earlier versions, like the ability to track completed registrations.

+ - Devices deployed via [Windows Autopilot](/autopilot/windows-autopilot).

+ > The **Users may join devices to Microsoft Entra ID** setting is applicable only to Microsoft Entra join on Windows 10 or newer. This setting doesn't apply to Microsoft Entra hybrid joined devices, [Microsoft Entra joined VMs in Azure](./howto-vm-sign-in-azure-ad-windows.md#enable-azure-ad-login-for-a-windows-vm-in-azure), or Microsoft Entra joined devices that use [Windows Autopilot self-deployment mode](/autopilot/self-deploying) because these methods work in a userless context.

+Registered devices are often managed with [Microsoft Intune](/mem/intune/fundamentals/deployment-guide-enrollment). Devices are enrolled in Intune in several ways, depending on the operating system.

+| [Mobile Device Management (MDM)](/windows/client-management/azure-active-directory-integration-with-mdm) <br>Example: Microsoft Intune |  |  |  |

+Next, examine server-side [Microsoft Entra sign-in logs](../reports-monitoring/concept-sign-in-log-activity-details.md) based on the correlation ID collected from the client-side SSO extension logs. For more information, see [Sign-in logs in Microsoft Entra ID](../reports-monitoring/concept-sign-ins.md).

+To call **ForceDelete** in the Azure portal, you must ensure that there are fewer than 1000 references to the domain name, and any references where Exchange is the provisioning service must be updated or removed in the [Exchange Admin Center](https://outlook.office365.com/ecp/). This includes Exchange Mail-Enabled Security Groups and distributed lists. For more information, see [Removing mail-enabled security groups](/Exchange/recipients/mail-enabled-security-groups#Remove%20mail-enabled%20security%20groups). Also, the **ForceDelete** operation won't succeed if either of the following is true:

+* [Using PowerShell to manage domain names in Microsoft Entra ID](/powershell/module/azuread/?preserve-view=true#domains)

+* [Add custom domain names](../fundamentals/add-custom-domain.md?context=azure/active-directory/users-groups-roles/context/ugr-context)

+* [Remove Exchange mail-enabled security groups in Exchange Admin Center on a custom domain name in Microsoft Entra ID](/exchange/recipients/mail-enabled-security-groups?preserve-view=true#Remove%20mail-enabled%20security%20groups)

+In the Azure portal, when the parent domain is federated and the admin tries to verify a managed subdomain on the **Custom domain names** page, you'll get a 'Failed to add domain' error with the reason "One or more properties contains invalid values." If you try to add this subdomain from the Microsoft 365 admin center, you'll receive a similar error. For more information about the error, see [A child domain doesn't inherit parent domain changes in Office 365, Azure, or Intune](/microsoft-365/troubleshoot/administration/child-domain-fails-inherit-parent-domain-changes).

+- [Add custom domain names](../fundamentals/add-custom-domain.md?context=azure/active-directory/users-groups-roles/context/ugr-context)

+ profileType | a valid [profile type](/graph/api/resources/device?view=graph-rest-1.0&preserve-view=true#properties) in Microsoft Entra ID | device.profileType -eq "RegisteredDevice"

+> When using `extensionAttribute1-15` to create Dynamic Groups for devices you need to set the value for `extensionAttribute1-15` on the device. Learn more on [how to write `extensionAttributes` on a Microsoft Entra device object](/graph/api/device-update?view=graph-rest-1.0&tabs=http&preserve-view=true#example-2--write-extensionattributes-on-a-device)

+In addition to Access Panel where users can view group details including expiration date and last renewed date, expiration date of a Microsoft 365 group can be retrieved from Microsoft Graph REST API Beta. expirationDateTime as a group property has been enabled in Microsoft Graph Beta. It can be retrieved with a GET request. For more details, please refer to [this example](/graph/api/group-get?view=graph-rest-beta&preserve-view=true#example).

+New-MgGroup @param

+* Make sure you are a user of an unmanaged Microsoft Entra organization. You can't close your account if you belong to a managed organization. If you belong to a managed organization and want to close your account, you must contact your administrator. For information about how to determine whether you belong to an unmanaged organization, see [Delete the user from Unmanaged Tenant](/power-automate/privacy-dsr-delete#delete-the-user-from-unmanaged-tenant).

+* Save any data you want to keep. For information about how to submit an export request, see [Accessing and exporting system-generated logs for Unmanaged Tenants](/power-platform/admin/powerapps-privacy-dsr-guide-systemlogs#accessing-and-exporting-system-generated-logs-for-unmanaged-tenants).

+You can customize this neutral branding with a custom background image or color, favicon, layout, header, and footer. You can also customize the sign-in form and add custom text to different instances or upload [custom CSS](../../fundamentals/reference-company-branding-css-template.md).

+Before you customize any settings, the neutral default branding will appear in your sign-in and sign-up pages. You can customize this default experience with a custom background image or color, favicon, layout, header, and footer. You can also upload a [custom CSS](../../fundamentals/reference-company-branding-css-template.md).

+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](../../roles/permissions-reference.md#global-administrator).

+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Global Administrator](../../roles/permissions-reference.md#global-administrator).

+For an understanding of the differences in workforce tenant branding, see the article [How to customize branding for your workforce](../../fundamentals/how-to-customize-branding.md).

+ - Initializes a [confidential client application](../../develop/msal-client-applications.md) instance by using `msalConfig` MSAL configuration object.

+Microsoft Entra ID for customers supports two types of authentication for [confidential client applications](../../develop/msal-client-applications.md); password-based authentication (such as client secret) and certificate-based authentication. For a higher level of security, we recommend using a certificate (instead of a client secret) as a credential in your confidential client applications.

+ - It initializes a [confidential client application](../../develop/msal-client-applications.md) instance by using MSAL configuration object, `msalConfig`, that you created earlier.

+This month, we renamed Microsoft Entra ID to Microsoft Entra ID. For more information about the rebranding, see the [New name for Microsoft Entra ID](../../fundamentals/new-name.md) article.

+- [About Microsoft Entra multi-tenant organizations](../multi-tenant-organizations/overview.md)

+If you create accounts for your external partners in your on-premises directory (for example, you create an account with a sign-in name of "msullivan" for an external user named Maria Sullivan in your partners.contoso.com domain), you can now sync these accounts to the cloud. Specifically, you can use [Microsoft Entra Connect](../hybrid/connect/whatis-azure-ad-connect.md) to sync the partner accounts to the cloud, which creates a user account with UserType = Guest. This enables your partner users to access cloud resources using the same credentials as their local accounts, without giving them more access than they need. For more information about converting local guest accounts see [Convert local guest accounts to Microsoft Entra B2B guest accounts](../architecture/10-secure-local-guest.md).

+Universal tenant restrictions v2 as part of [Microsoft Entra Global Secure Access](/entra/global-secure-access/overview-what-is-global-secure-access) is recommended because it provides authentication and data plane protection for all devices and platforms. This option provides more protection against sophisticated attempts to bypasses authentication. For example, attackers might try to allow anonymous access to a malicious tenantΓÇÖs apps, such as anonymous meeting join in Teams. Or, attackers might attempt to import to your organizational device an access token lifted from a device in the malicious tenant. Universal tenant restrictions v2 prevents these attacks by sending tenant restrictions v2 signals on the authentication plane (Microsoft Entra ID and Microsoft Account) and data plane (Microsoft cloud applications).

+To view guest users with PowerShell, you'll need the [`Microsoft.Graph.Users` PowerShell module](/powershell/module/microsoft.graph.users/?view=graph-powershell-1.0&viewFallbackFrom=graph-powershell-beta&preserve-view=true). Then sign in using the `Connect-MgGraph` command with an admin account to consent to the required scopes:

+- Use [Microsoft cloud settings](cross-cloud-settings.md) to establish mutual B2B collaboration between the Microsoft Azure global cloud and [Microsoft Azure Government](/azure/azure-government/) or [Microsoft Azure operated by 21Vianet](/azure/china/).

+This month, we renamed Azure Active Directory (Azure AD) to Microsoft Entra ID. For more information about the rebranding, see the [New name for Azure Active Directory](../fundamentals/new-name.md) article.

+|Provisioning: external identities| Organizations create external users manually as regular users in a dedicated external AD forest, resulting in administration overhead to manage the lifecycle of external identities (guest users)| Microsoft Entra ID provides a special class of identity to support external identities. [Microsoft Entra B2B](../external-identities/index.yml) will manage the link to the external user identity to make sure they are valid. |

+| Windows desktops|Active Directory provides the ability to domain join Windows devices to manage them using Group Policy, System Center Configuration Manager, or other third-party solutions.|Windows devices can be [joined to Microsoft Entra ID](../devices/index.yml). Conditional Access can check if a device is Microsoft Entra joined as part of the authentication process. Windows devices can also be managed with [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). In this case, Conditional Access, will consider whether a device is compliant (for example, up-to-date security patches and virus signatures) before allowing access to the apps.|

+- [Compare self-managed Active Directory Domain Services, Microsoft Entra ID, and managed Microsoft Entra Domain Services](/entra/identity/domain-services/compare-identity-solutions)

+- Organizations can use [identity secure score](../reports-monitoring/concept-identity-secure-score.md) to track their progress against other Microsoft recommendations.

+A welcome notification is sent to all users when they're added to a new Microsoft 365 group, regardless of the membership type. When an attribute of a user or device changes, all dynamic group rules in the organization are processed for potential membership changes. Users who are added then also receive the welcome notification. You can turn off this behavior in [Exchange PowerShell](/powershell/module/exchange/set-unifiedgroup).

+- [Learn about audit logs](../reports-monitoring/concept-audit-logs.md)

+With the release of the OpenID Connect (which uses public-key encryption), OpenID became a widely adopted authentication layer for OAuth. Like SAML, OpenID Connect (OIDC) is widely used for single sign-on (SSO), but OIDC uses REST/JSON instead of XML. OIDC was designed to work with both native and mobile apps by using REST/JSON protocols. The primary use case for SAML, however, is web-based apps. To learn more, read about [OpenID Connect protocol](../develop/v2-protocols.md).

+| Graph <br/><br/>&#8226; Azure Active Directory Graph <br/>&#8226; Azure AD Graph <br/>&#8226; Microsoft Graph | Azure Active Directory (Azure AD) Graph is deprecated. Going forward, further investment in Azure AD Graph won't be made, and Azure AD Graph APIs have no SLA or maintenance commitment beyond security-related fixes. Investments in new features and functionalities will only be made in Microsoft Graph.<br/><br/>[Microsoft Graph](/graph/) - Grants programmatic access to organization, user, and application data stored in Microsoft Entra ID. |

+- [Learn more about the Microsoft Entra family with content from Microsoft Learn](/entra/)

+|[Microsoft Authenticator Lite for Outlook mobile](../authentication/how-to-mfa-authenticator-lite.md)|Feature change|Jun 9, 2023|

+[What's new in Microsoft Entra ID?](../fundamentals/whats-new.md)

+Identity Protection risk detections (alerts) are now also available in Microsoft 365 Defender to provide a unified investigation experience for security professionals. For more information, see: [Investigate alerts in Microsoft 365 Defender](/microsoft-365/security/defender/investigate-alerts?view=o365-worldwide&preserve-view=true#alert-sources)

+[Lunni Ticket Service](https://ticket.lunni.io/login), [Spring Health](https://benefits.springhealth.com/care), [Sorbet](https://lite.sorbetapp.com/login), [Planview ID](../saas-apps/planview-admin-tutorial.md), [Karbonalpha](https://saas.karbonalpha.com/settings/api), [Headspace](../saas-apps/headspace-tutorial.md), [SeekOut](../saas-apps/seekout-tutorial.md), [Stackby](../saas-apps/stackby-tutorial.md), [Infrascale Cloud Backup](../saas-apps/infrascale-cloud-backup-tutorial.md), [Keystone](../saas-apps/keystone-tutorial.md), [LMS・教育管理システム Leaf](../saas-apps/lms-and-education-management-system-leaf-tutorial.md), [ZDiscovery](../saas-apps/zdiscovery-tutorial.md), [ラインズeライブラリアドバンス (Lines eLibrary Advance)](../saas-apps/lines-elibrary-advance-tutorial.md), [Rootly](../saas-apps/rootly-tutorial.md), [Articulate 360](../saas-apps/articulate360-tutorial.md), [Rise.com](../saas-apps/risecom-tutorial.md), [SevOne Network Monitoring System (NMS)](../saas-apps/sevone-network-monitoring-system-tutorial.md), [PGM](https://ups-pgm.4gfactor.com/azure/), [TouchRight Software](https://app.touchrightsoftware.com/), [Tendium](../saas-apps/tendium-tutorial.md), [Training Platform](../saas-apps/training-platform-tutorial.md), [Znapio](https://app.znapio.com/), [Preset](../saas-apps/preset-tutorial.md), [itslearning MS Teams sync](https://itslearning.com/global/), [Veza](../saas-apps/veza-tutorial.md),

+We're delighted to announce a new security protection that prevents bypassing of cloud Azure AD Multi-Factor Authentication when federated with Azure AD. When enabled for a federated domain in your Azure AD tenant, it ensures that a compromised federated account can't bypass Azure AD Multi-Factor Authentication by imitating that a multi factor authentication has already been performed by the identity provider. The protection can be enabled via new security setting, [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-beta&preserve-view=true#federatedidpmfabehavior-values).

+We're delighted to announce a new security protection that prevents bypassing of cloud Azure AD Multi-Factor Authentication when federated with Azure AD. When enabled for a federated domain in your Azure AD tenant, it ensures that a compromised federated account can't bypass Azure AD Multi-Factor Authentication by imitating that a multi factor authentication has already been performed by the identity provider. The protection can be enabled via new security setting, [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-1.0&preserve-view=true#federatedidpmfabehavior-values).

+We're delighted to announce a new security protection that prevents bypassing of cloud Azure AD Multi-Factor Authentication when federated with Azure AD. When enabled for a federated domain in your Azure AD tenant, it ensures that a compromised federated account can't bypass Azure AD Multi-Factor Authentication by imitating that a multi factor authentication has already been performed by the identity provider. The protection can be enabled via new security setting, [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-beta&preserve-view=true#federatedidpmfabehavior-values).

+Visit https://aka.ms/tenant-restrictions-enforcement for more information on tenant restriction V2 and Global Secure Access client-side tagging for TRv2 at [Universal tenant restrictions](/entra/global-secure-access/how-to-universal-tenant-restrictions).

+[Gainsight SAML](../saas-apps/gainsight-tutorial.md), [Dataddo](https://www.dataddo.com/), [Puzzel](https://www.puzzel.com/), [Worthix App](../saas-apps/worthix-app-tutorial.md), [iOps360 IdConnect](https://iops360.com/iops360-id-connect-azuread-single-sign-on/), [Airbase](../saas-apps/airbase-tutorial.md), [Couchbase Capella - SSO](../saas-apps/couchbase-capella-sso-tutorial.md), [SSO for Jama Connect®](../saas-apps/sso-for-jama-connect-tutorial.md), [mediment (メディメント)](https://mediment.jp/), [Netskope Cloud Exchange Administration Console](../saas-apps/netskope-cloud-exchange-administration-console-tutorial.md), [Uber](../saas-apps/uber-tutorial.md), [Plenda](https://app.plenda.nl/), [Deem Mobile](../saas-apps/deem-mobile-tutorial.md), [40SEAS](https://www.40seas.com/), [Vivantio](https://www.vivantio.com/), [AppTweak](https://www.apptweak.com/), [Vbrick Rev Cloud](../saas-apps/vbrick-rev-cloud-tutorial.md), [OptiTurn](../saas-apps/optiturn-tutorial.md), [Application Experience with Mist](https://www.mist.com/), [クラウド勤怠管理システムKING OF TIME](../saas-apps/cloud-attendance-management-system-king-of-time-tutorial.md), [Connect1](../saas-apps/connect1-tutorial.md), [DB Education Portal for Schools](../saas-apps/db-education-portal-for-schools-tutorial.md), [SURFconext](../saas-apps/surfconext-tutorial.md), [Chengliye Smart SMS Platform](../saas-apps/chengliye-smart-sms-platform-tutorial.md), [CivicEye SSO](../saas-apps/civic-eye-sso-tutorial.md), [Colloquial](../saas-apps/colloquial-tutorial.md), [BigPanda](../saas-apps/bigpanda-tutorial.md), [Foreman](https://foreman.mn/)

+| HR | [SuccessFactors - User Provisioning](../saas-apps/sap-successfactors-inbound-provisioning-tutorial.md) |

+| HR | [Workday - User Provisioning](../saas-apps/workday-inbound-cloud-only-tutorial.md)|

+|[LDAP directory](../app-provisioning/on-premises-ldap-connector-configure.md)| OpenLDAP<br>Microsoft Active Directory Lightweight Directory Services<br>389 Directory Server<br>Apache Directory Server<br>IBM Tivoli DS<br>Isode Directory<br>NetIQ eDirectory<br>Novell eDirectory<br>Open DJ<br>Open DS<br>Oracle (previously Sun ONE) Directory Server Enterprise Edition<br>RadiantOne Virtual Directory Server (VDS) |

+| [SQL database](../app-provisioning/tutorial-ecma-sql-connector.md)| Microsoft SQL Server and Azure SQL<br>IBM DB2 10.x<br>IBM DB2 9.x<br>Oracle 10g and 11g<br>Oracle 12c and 18c<br>MySQL 5.x|

+| Cloud platform| [AWS IAM Identity Center](../saas-apps/aws-single-sign-on-provisioning-tutorial.md) |

+| Cloud platform| [Google Cloud Platform - User Provisioning](../saas-apps/g-suite-provisioning-tutorial.md) |

+| Business applications|[SAP Cloud Identity Platform - Provisioning](../saas-apps/sap-cloud-platform-identity-authentication-provisioning-tutorial.md) |

+| CRM| [Salesforce - User Provisioning](../saas-apps/salesforce-provisioning-tutorial.md) |

+| ITSM| [ServiceNow](../saas-apps/servicenow-provisioning-tutorial.md)|

+The list below provides key integrations between Microsoft Entra ID Governance and various applications, including both provisioning and SSO integrations. For a full list of applications that Microsoft Entra ID integrates with specifically for SSO, see [here](../saas-apps/tutorial-list.md).

+| 389 directory server ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [4me](../saas-apps/4me-provisioning-tutorial.md) | ΓùÅ | ΓùÅ|

+| [8x8](../saas-apps/8x8-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [15five](../saas-apps/15five-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Acunetix 360](../saas-apps/acunetix-360-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Adobe Identity Management](../saas-apps/adobe-identity-management-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Adobe Identity Management (OIDC)](../saas-apps/adobe-identity-management-provisioning-oidc-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Airbase](../saas-apps/airbase-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Aha!](../saas-apps/aha-tutorial.md) | | ΓùÅ |

+| [Airstack](../saas-apps/airstack-provisioning-tutorial.md) | ΓùÅ | |

+| [Akamai Enterprise Application Access](../saas-apps/akamai-enterprise-application-access-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Airtable](../saas-apps/airtable-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Albert](../saas-apps/albert-provisioning-tutorial.md) | ΓùÅ | |

+| [AlertMedia](../saas-apps/alertmedia-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Alexis HR](../saas-apps/alexishr-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Alinto Protect (renamed Cleanmail)](../saas-apps/alinto-protect-provisioning-tutorial.md) | ΓùÅ | |

+| [Alvao](../saas-apps/alvao-provisioning-tutorial.md) | ΓùÅ | |

+| [Amazon Business](../saas-apps/amazon-business-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Amazon Web Services (AWS) - Role Provisioning](../saas-apps/amazon-web-service-tutorial.md) | ΓùÅ | ΓùÅ |

+| Apache Directory Server ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [Appaegis Isolation Access Cloud](../saas-apps/appaegis-isolation-access-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Apple School Manager](../saas-apps/apple-school-manager-provision-tutorial.md) | ΓùÅ | |

+| [Apple Business Manager](../saas-apps/apple-business-manager-provision-tutorial.md) | ΓùÅ | |

+| [Ardoq](../saas-apps/ardoq-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Asana](../saas-apps/asana-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [AskSpoke](../saas-apps/askspoke-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Atea](../saas-apps/atea-provisioning-tutorial.md) | ΓùÅ | |

+| [Atlassian Cloud](../saas-apps/atlassian-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Atmos](../saas-apps/atmos-provisioning-tutorial.md) | ΓùÅ | |

+| [AuditBoard](../saas-apps/auditboard-provisioning-tutorial.md) | ΓùÅ | |

+| [Autodesk SSO](../saas-apps/autodesk-sso-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [AWS IAM Identity Center](../saas-apps/aws-single-sign-on-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Axiad Cloud](../saas-apps/axiad-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BambooHR](../saas-apps/bamboo-hr-tutorial.md) | | ΓùÅ |

+| [BenQ IAM](../saas-apps/benq-iam-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Bentley - Automatic User Provisioning](../saas-apps/bentley-automatic-user-provisioning-tutorial.md) | ΓùÅ | |

+| [Better Stack](../saas-apps/better-stack-provisioning-tutorial.md) | ΓùÅ | |

+| [BIC Cloud Design](../saas-apps/bic-cloud-design-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BIS](../saas-apps/bis-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BitaBIZ](../saas-apps/bitabiz-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Bizagi Studio for Digital Process Automation](../saas-apps/bizagi-studio-for-digital-process-automation-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BLDNG APP](../saas-apps/bldng-app-provisioning-tutorial.md) | ΓùÅ | |

+| [Blink](../saas-apps/blink-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Blinq](../saas-apps/blinq-provisioning-tutorial.md) | ΓùÅ | |

+| [BlogIn](../saas-apps/blogin-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BlueJeans](../saas-apps/bluejeans-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Bonusly](../saas-apps/bonusly-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Box](../saas-apps/box-userprovisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Boxcryptor](../saas-apps/boxcryptor-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Bpanda](../saas-apps/bpanda-provisioning-tutorial.md) | ΓùÅ | |

+| [Brivo Onair Identity Connector](../saas-apps/brivo-onair-identity-connector-provisioning-tutorial.md) | ΓùÅ | |

+| [Britive](../saas-apps/britive-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BrowserStack Single Sign-on](../saas-apps/browserstack-single-sign-on-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [BullseyeTDP](../saas-apps/bullseyetdp-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Bustle B2B Transport Systems](../saas-apps/bustle-b2b-transport-systems-provisioning-tutorial.md) | ΓùÅ | |

+| [Canva](../saas-apps/canva-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cato Networks Provisioning](../saas-apps/cato-networks-provisioning-tutorial.md) | ΓùÅ | |

+| [Cerner Central](../saas-apps/cernercentral-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cerby](../saas-apps/cerby-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Chaos](../saas-apps/chaos-provisioning-tutorial.md) | ΓùÅ | |

+| [Chatwork](../saas-apps/chatwork-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [CheckProof](../saas-apps/checkproof-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cinode](../saas-apps/cinode-provisioning-tutorial.md) | ΓùÅ | |

+| [Cisco Umbrella User Management](../saas-apps/cisco-umbrella-user-management-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cisco Webex](../saas-apps/cisco-webex-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Clarizen One](../saas-apps/clarizen-one-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cleanmail Swiss](../saas-apps/cleanmail-swiss-provisioning-tutorial.md) | ΓùÅ | |

+| [Clebex](../saas-apps/clebex-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cloud Academy SSO](../saas-apps/cloud-academy-sso-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Coda](../saas-apps/coda-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Code42](../saas-apps/code42-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cofense Recipient Sync](../saas-apps/cofense-provision-tutorial.md) | ΓùÅ | |

+| [Colloquial](../saas-apps/colloquial-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Comeet Recruiting Software](../saas-apps/comeet-recruiting-software-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Connecter](../saas-apps/connecter-provisioning-tutorial.md) | ΓùÅ | |

+| [Contentful](../saas-apps/contentful-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Concur](../saas-apps/concur-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cornerstone OnDemand](../saas-apps/cornerstone-ondemand-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Cybozu](../saas-apps/cybozu-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [CybSafe](../saas-apps/cybsafe-provisioning-tutorial.md) | ΓùÅ | |

+| [Dagster Cloud](../saas-apps/dagster-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Datadog](../saas-apps/datadog-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Documo](../saas-apps/documo-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [DocuSign](../saas-apps/docusign-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Dropbox Business](../saas-apps/dropboxforbusiness-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Dialpad](../saas-apps/dialpad-provisioning-tutorial.md) | ΓùÅ | |

+| [Diffchecker](../saas-apps/diffchecker-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [DigiCert](../saas-apps/digicert-tutorial.md) | | ΓùÅ |

+| [Directprint.io](../saas-apps/directprint-io-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Druva](../saas-apps/druva-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Dynamic Signal](../saas-apps/dynamic-signal-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Embed Signage](../saas-apps/embed-signage-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Envoy](../saas-apps/envoy-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Eletive](../saas-apps/eletive-provisioning-tutorial.md) | ΓùÅ | |

+| [Elium](../saas-apps/elium-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Exium](../saas-apps/exium-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Evercate](../saas-apps/evercate-provisioning-tutorial.md) | ΓùÅ | |

+| [Facebook Work Accounts](../saas-apps/facebook-work-accounts-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Federated Directory](../saas-apps/federated-directory-provisioning-tutorial.md) | ΓùÅ | |

+| [Figma](../saas-apps/figma-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Flock](../saas-apps/flock-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Foodee](../saas-apps/foodee-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Forcepoint Cloud Security Gateway - User Authentication](../saas-apps/forcepoint-cloud-security-gateway-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Fortes Change Cloud](../saas-apps/fortes-change-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Frankli.io](../saas-apps/frankli-io-provisioning-tutorial.md) | ΓùÅ | |

+| [Freshservice Provisioning](../saas-apps/freshservice-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Funnel Leasing](../saas-apps/funnel-leasing-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Fuze](../saas-apps/fuze-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [G Suite](../saas-apps/g-suite-provisioning-tutorial.md) | ΓùÅ | |

+| [Genesys Cloud for Azure](../saas-apps/purecloud-by-genesys-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [getAbstract](../saas-apps/getabstract-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [GHAE](../saas-apps/ghae-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [GitHub](../saas-apps/github-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [GitHub AE](../saas-apps/github-ae-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [GitHub Enterprise Managed User](../saas-apps/github-enterprise-managed-user-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [GitHub Enterprise Managed User (OIDC)](../saas-apps/github-enterprise-managed-user-oidc-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [GoToMeeting](../saas-apps/citrixgotomeeting-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Global Relay Identity Sync](../saas-apps/global-relay-identity-sync-provisioning-tutorial.md) | ΓùÅ | |

+| [Gong](../saas-apps/gong-provisioning-tutorial.md) | ΓùÅ | |

+| [GoLinks](../saas-apps/golinks-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Grammarly](../saas-apps/grammarly-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Group Talk](../saas-apps/grouptalk-provisioning-tutorial.md) | ΓùÅ | |

+| [Gtmhub](../saas-apps/gtmhub-provisioning-tutorial.md) | ΓùÅ | |

+| [H5mag](../saas-apps/h5mag-provisioning-tutorial.md) | ΓùÅ | |

+| [Harness](../saas-apps/harness-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Headspace](../saas-apps/headspace-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [HelloID](../saas-apps/helloid-provisioning-tutorial.md) | ΓùÅ | |

+| [Holmes Cloud](../saas-apps/holmes-cloud-provisioning-tutorial.md) | ΓùÅ | |

+| [Hootsuite](../saas-apps/hootsuite-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Hoxhunt](../saas-apps/hoxhunt-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Howspace](../saas-apps/howspace-provisioning-tutorial.md) | ΓùÅ | |

+| [Humbol](../saas-apps/humbol-provisioning-tutorial.md) | ΓùÅ | |

+| [Hypervault](../saas-apps/hypervault-provisioning-tutorial.md) | ΓùÅ | |

+| IBM DB2 ([SQL connector](../app-provisioning/tutorial-ecma-sql-connector.md) ) | ΓùÅ | |

+| IBM Tivoli Directory Server ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [Ideo](../saas-apps/ideo-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Ideagen Cloud](../saas-apps/ideagen-cloud-provisioning-tutorial.md) | ΓùÅ | |

+| [Infor CloudSuite](../saas-apps/infor-cloudsuite-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [InformaCast](../saas-apps/informacast-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [iPass SmartConnect](../saas-apps/ipass-smartconnect-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Iris Intranet](../saas-apps/iris-intranet-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Insight4GRC](../saas-apps/insight4grc-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Insite LMS](../saas-apps/insite-lms-provisioning-tutorial.md) | ΓùÅ | |

+| [introDus Pre and Onboarding Platform](../saas-apps/introdus-pre-and-onboarding-platform-provisioning-tutorial.md) | ΓùÅ | |

+| [Invision](../saas-apps/invision-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [InviteDesk](../saas-apps/invitedesk-provisioning-tutorial.md) | ΓùÅ | |

+| Isode directory server ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [Jive](../saas-apps/jive-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Jostle](../saas-apps/jostle-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Joyn FSM](../saas-apps/joyn-fsm-provisioning-tutorial.md) | ΓùÅ | |

+| [Juno Journey](../saas-apps/juno-journey-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Keeper Password Manager & Digital Vault](../saas-apps/keeper-password-manager-digitalvault-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Keepabl](../saas-apps/keepabl-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Kintone](../saas-apps/kintone-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Kisi Phsyical Security](../saas-apps/kisi-physical-security-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Klaxoon](../saas-apps/klaxoon-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Klaxoon SAML](../saas-apps/klaxoon-saml-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Kno2fy](../saas-apps/kno2fy-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [KnowBe4 Security Awareness Training](../saas-apps/knowbe4-security-awareness-training-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Kpifire](../saas-apps/kpifire-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [KPN Grip](../saas-apps/kpn-grip-provisioning-tutorial.md) | ΓùÅ | |

+| [LanSchool Air](../saas-apps/lanschool-air-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [LDAP](../app-provisioning/on-premises-ldap-connector-configure.md) | ΓùÅ | |

+| [LimbleCMMS](../saas-apps/limblecmms-provisioning-tutorial.md) | ΓùÅ | |

+| [LinkedIn Elevate](../saas-apps/linkedinelevate-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [LinkedIn Sales Navigator](../saas-apps/linkedinsalesnavigator-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Litmos](../saas-apps/litmos-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Lucid (All Products)](../saas-apps/lucid-all-products-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Lucidchart](../saas-apps/lucidchart-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [LUSID](../saas-apps/LUSID-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Leapsome](../saas-apps/leapsome-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [LogicGate](../saas-apps/logicgate-provisioning-tutorial.md) | ΓùÅ | |

+| [Looop](../saas-apps/looop-provisioning-tutorial.md) | ΓùÅ | |

+| [LogMeIn](../saas-apps/logmein-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [M-Files](../saas-apps/m-files-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Maptician](../saas-apps/maptician-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Markit Procurement Service](../saas-apps/markit-procurement-service-provisioning-tutorial.md) | ΓùÅ | |

+| [MediusFlow](../saas-apps/mediusflow-provisioning-tutorial.md) | ΓùÅ | |

+| [MerchLogix](../saas-apps/merchlogix-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Meta Networks Connector](../saas-apps/meta-networks-connector-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| MicroFocus Novell eDirectory ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| Microsoft Azure SQL ([SQL connector](../app-provisioning/tutorial-ecma-sql-connector.md) ) | ΓùÅ | |

+| Microsoft Lightweight Directory Server (ADAM) ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| Microsoft SQL Server ([SQL connector](../app-provisioning/tutorial-ecma-sql-connector.md) ) | ΓùÅ | |

+| [Mixpanel](../saas-apps/mixpanel-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Mindtickle](../saas-apps/mindtickle-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Miro](../saas-apps/miro-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Monday.com](../saas-apps/mondaycom-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [MongoDB Atlas](../saas-apps/mongodb-cloud-tutorial.md) | | ΓùÅ |

+| [Moqups](../saas-apps/moqups-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Mural Identity](../saas-apps/mural-identity-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [MX3 Diagnostics](../saas-apps/mx3-diagnostics-connector-provisioning-tutorial.md) | ΓùÅ | |

+| [myPolicies](../saas-apps/mypolicies-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| MySQL ([SQL connector](../app-provisioning/tutorial-ecma-sql-connector.md) ) | ΓùÅ | |

+| NetIQ eDirectory ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [Netpresenter Next](../saas-apps/netpresenter-provisioning-tutorial.md) | ΓùÅ | |

+| [Netskope User Authentication](../saas-apps/netskope-administrator-console-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Netsparker Enterprise](../saas-apps/netsparker-enterprise-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [New Relic by Organization](../saas-apps/new-relic-by-organization-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [NordPass](../saas-apps/nordpass-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Notion](../saas-apps/notion-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| Novell eDirectory ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [Office Space Software](../saas-apps/officespace-software-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Olfeo SAAS](../saas-apps/olfeo-saas-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Oneflow](../saas-apps/oneflow-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| Open DJ ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| Open DS ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [OpenForms](../saas-apps/openforms-provisioning-tutorial.md) | ΓùÅ | |

+| [OpenLDAP](../app-provisioning/on-premises-ldap-connector-configure.md) | ΓùÅ | |

+| [OpenText Directory Services](../saas-apps/open-text-directory-services-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Oracle Cloud Infrastructure Console](../saas-apps/oracle-cloud-infrastructure-console-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| Oracle Database ([SQL connector](../app-provisioning/tutorial-ecma-sql-connector.md) ) | ΓùÅ | |

+| [Oracle Fusion ERP](../saas-apps/oracle-fusion-erp-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [O'Reilly Learning Platform](../saas-apps/oreilly-learning-platform-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| Oracle SunONE Directory Server ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [PagerDuty](../saas-apps/pagerduty-tutorial.md) | | ΓùÅ |

+| [Palo Alto Networks Cloud Identity Engine - Cloud Authentication Service](../saas-apps/palo-alto-networks-cloud-identity-engine-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Palo Alto Networks SCIM Connector](../saas-apps/palo-alto-networks-scim-connector-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [PaperCut Cloud Print Management](../saas-apps/papercut-cloud-print-management-provisioning-tutorial.md) | ΓùÅ | |

+| [Parsable](../saas-apps/parsable-provisioning-tutorial.md) | ΓùÅ | |

+| [Peripass](../saas-apps/peripass-provisioning-tutorial.md) | ΓùÅ | |

+| [Pingboard](../saas-apps/pingboard-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Plandisc](../saas-apps/plandisc-provisioning-tutorial.md) | ΓùÅ | |

+| [Playvox](../saas-apps/playvox-provisioning-tutorial.md) | ΓùÅ | |

+| [Postman](../saas-apps/postman-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Preciate](../saas-apps/preciate-provisioning-tutorial.md) | ΓùÅ | |

+| [PrinterLogic SaaS](../saas-apps/printer-logic-saas-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Priority Matrix](../saas-apps/priority-matrix-provisioning-tutorial.md) | ΓùÅ | |

+| [ProdPad](../saas-apps/prodpad-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Promapp](../saas-apps/promapp-provisioning-tutorial.md) | ΓùÅ | |

+| [Proxyclick](../saas-apps/proxyclick-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Peakon](../saas-apps/peakon-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Proware](../saas-apps/proware-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| RadiantOne Virtual Directory Server (VDS) ([LDAP connector](../app-provisioning/on-premises-ldap-connector-configure.md) ) | ΓùÅ | |

+| [Real Links](../saas-apps/real-links-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Recnice](../saas-apps/recnice-provisioning-tutorial.md) | ΓùÅ | |

+| [Reward Gateway](../saas-apps/reward-gateway-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [RFPIO](../saas-apps/rfpio-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Rhombus Systems](../saas-apps/rhombus-systems-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Ring Central](../saas-apps/ringcentral-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Robin](../saas-apps/robin-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Rollbar](../saas-apps/rollbar-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Rouse Sales](../saas-apps/rouse-sales-provisioning-tutorial.md) | ΓùÅ | |

+| [Salesforce](../saas-apps/salesforce-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SafeGuard Cyber](../saas-apps/safeguard-cyber-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Salesforce Sandbox](../saas-apps/salesforce-sandbox-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Samanage](../saas-apps/samanage-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SAP Analytics Cloud](../saas-apps/sap-analytics-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SAP Cloud Platform](../saas-apps/sap-cloud-platform-identity-authentication-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SAP R/3 and ERP](../app-provisioning/on-premises-sap-connector-configure.md) | ΓùÅ | |

+| [SAP HANA](../saas-apps/saphana-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SAP SuccessFactors to Active Directory](../saas-apps/sap-successfactors-inbound-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SAP SuccessFactors to Microsoft Entra ID](../saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SAP SuccessFactors Writeback](../saas-apps/sap-successfactors-writeback-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SchoolStream ASA](../saas-apps/schoolstream-asa-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [ScreenSteps](../saas-apps/screensteps-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Secure Deliver](../saas-apps/secure-deliver-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SecureLogin](../saas-apps/secure-login-provisioning-tutorial.md) | ΓùÅ | |

+| [Sentry](../saas-apps/sentry-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [ServiceNow](../saas-apps/servicenow-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Segment](../saas-apps/segment-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Shopify Plus](../saas-apps/shopify-plus-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Sigma Computing](../saas-apps/sigma-computing-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Signagelive](../saas-apps/signagelive-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Slack](../saas-apps/slack-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Smartfile](../saas-apps/smartfile-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Smartsheet](../saas-apps/smartsheet-provisioning-tutorial.md) | ΓùÅ | |

+| [Smallstep SSH](../saas-apps/smallstep-ssh-provisioning-tutorial.md) | ΓùÅ | |

+| [Snowflake](../saas-apps/snowflake-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Soloinsight - CloudGate SSO](../saas-apps/soloinsight-cloudgate-sso-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SoSafe](../saas-apps/sosafe-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [SpaceIQ](../saas-apps/spaceiq-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Splashtop](../saas-apps/splashtop-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [StarLeaf](../saas-apps/starleaf-provisioning-tutorial.md) | ΓùÅ | |

+| [Storegate](../saas-apps/storegate-provisioning-tutorial.md) | ΓùÅ | |

+| [SurveyMonkey Enterprise](../saas-apps/surveymonkey-enterprise-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Swit](../saas-apps/swit-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Symantec Web Security Service (WSS)](../saas-apps/symantec-web-security-service.md) | ΓùÅ | ΓùÅ |

+| [Tableau Cloud](../saas-apps/tableau-online-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Tailscale](../saas-apps/tailscale-provisioning-tutorial.md) | ΓùÅ | |

+| [Talentech](../saas-apps/talentech-provisioning-tutorial.md) | ΓùÅ | |

+| [Tanium SSO](../saas-apps/tanium-sso-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Tap App Security](../saas-apps/tap-app-security-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Taskize Connect](../saas-apps/taskize-connect-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Teamgo](../saas-apps/teamgo-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [TeamViewer](../saas-apps/teamviewer-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [TerraTrue](../saas-apps/terratrue-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [ThousandEyes](../saas-apps/thousandeyes-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Tic-Tac Mobile](../saas-apps/tic-tac-mobile-provisioning-tutorial.md) | ΓùÅ | |

+| [TimeClock 365](../saas-apps/timeclock-365-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [TimeClock 365 SAML](../saas-apps/timeclock-365-saml-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Templafy SAML2](../saas-apps/templafy-saml-2-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Templafy OpenID Connect](../saas-apps/templafy-openid-connect-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [TheOrgWiki](../saas-apps/theorgwiki-provisioning-tutorial.md) | ΓùÅ | |

+| [Thrive LXP](../saas-apps/thrive-lxp-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Torii](../saas-apps/torii-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [TravelPerk](../saas-apps/travelperk-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Tribeloo](../saas-apps/tribeloo-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Twingate](../saas-apps/twingate-provisioning-tutorial.md) | ΓùÅ | |

+| [Uber](../saas-apps/uber-provisioning-tutorial.md) | ΓùÅ | |

+| [UNIFI](../saas-apps/unifi-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [uniFlow Online](../saas-apps/uniflow-online-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [uni-tel ) | ΓùÅ | |

+| [Vault Platform](../saas-apps/vault-platform-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Vbrick Rev Cloud](../saas-apps/vbrick-rev-cloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [V-Client](../saas-apps/v-client-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Velpic](../saas-apps/velpic-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Visibly](../saas-apps/visibly-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Visitly](../saas-apps/visitly-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [VMware](../saas-apps/vmware-identity-service-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Vonage](../saas-apps/vonage-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [WATS](../saas-apps/wats-provisioning-tutorial.md) | ΓùÅ | |

+| [Webroot Security Awareness Training](../saas-apps/webroot-security-awareness-training-provisioning-tutorial.md) | ΓùÅ | |

+| [WEDO](../saas-apps/wedo-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Whimsical](../saas-apps/whimsical-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Workday to Active Directory](../saas-apps/workday-inbound-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Workday to Microsoft Entra ID](../saas-apps/workday-inbound-cloud-only-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Workday Writeback](../saas-apps/workday-writeback-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Workteam](../saas-apps/workteam-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Workplace by Facebook](../saas-apps/workplace-by-facebook-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Workgrid](../saas-apps/workgrid-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Wrike](../saas-apps/wrike-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Xledger](../saas-apps/xledger-provisioning-tutorial.md) | ΓùÅ | |

+| [XM Fax and XM SendSecure](../saas-apps/xm-fax-and-xm-send-secure-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Yellowbox](../saas-apps/yellowbox-provisioning-tutorial.md) | ΓùÅ | |

+| [Zapier](../saas-apps/zapier-provisioning-tutorial.md) | ΓùÅ | |

+| [Zendesk](../saas-apps/zendesk-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zenya](../saas-apps/zenya-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zero](../saas-apps/zero-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zip](../saas-apps/zip-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zoho One](../saas-apps/zoho-one-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zoom](../saas-apps/zoom-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler](../saas-apps/zscaler-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler Beta](../saas-apps/zscaler-beta-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler One](../saas-apps/zscaler-one-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler Private Access](../saas-apps/zscaler-private-access-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler Two](../saas-apps/zscaler-two-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler Three](../saas-apps/zscaler-three-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+| [Zscaler ZSCloud](../saas-apps/zscaler-zscloud-provisioning-tutorial.md) | ΓùÅ | ΓùÅ |

+There is also a healthy partner ecosystem, further expanding the breadth and depth of integrations available with Microsoft Entra ID Governance. Explore the [partner integrations](../app-provisioning/partner-driven-integrations.md) available, including connectors for:

+To learn more about application provisioning, see [What is application provisioning](../app-provisioning/user-provisioning.md).

+For more advanced queries and analysis of access reviews, and to track changes and completion of reviews, export your Microsoft Entra audit logs to [Azure Log Analytics](../reports-monitoring/howto-archive-logs-to-storage-account.md) or Azure Event Hubs. When audit logs are stored in Log Analytics, you can use the [powerful analytics language](../reports-monitoring/howto-analyze-activity-logs-log-analytics.md) and build your own dashboards.

+Archiving Microsoft Entra audit logs requires you to have Azure Monitor in an Azure subscription. You can read more about the prerequisites and estimated costs of using Azure Monitor in [Microsoft Entra activity logs in Azure Monitor](../reports-monitoring/concept-log-monitoring-integration-options-considerations.md).

+1. If there isn't already a setting, select **Add diagnostic setting**. Use the instructions in [Integrate Microsoft Entra logs with Azure Monitor logs](../reports-monitoring/howto-integrate-activity-logs-with-azure-monitor-logs.md) to send the Microsoft Entra audit log to the Azure Monitor workspace.

+For more information on the columns that are stored for audit events in Azure Monitor, see [Interpret the Microsoft Entra audit logs schema in Azure Monitor](../reports-monitoring/overview-monitoring-health.md).

+If you have multiple Log Analytics workspaces in that subscription, then the cmdlet [Get-AzOperationalInsightsWorkspace](/powershell/module/az.operationalinsights/get-azoperationalinsightsworkspace) returns the list of workspaces. Then you can find the one that has the Microsoft Entra logs. The `CustomerId` field returned by this cmdlet is the same as the value of the "Workspace ID" displayed in the Microsoft Entra admin center in the Log Analytics workspace overview.

+Finally, once you have a workspace identified, you can use [Invoke-AzOperationalInsightsQuery](/powershell/module/az.operationalinsights/invoke-azoperationalinsightsquery) to send a Kusto query to that workspace. These queries are written in [Kusto query language](/azure/data-explorer/kusto/query/).

+* You can view the last 30 days of sign-ins to an application in the [sign-ins report](../reports-monitoring/concept-sign-in-log-activity-details.md) in the Microsoft Entra admin center, or via [Graph](/graph/api/signin-list?view=graph-rest-1.0&tabs=http&preserve-view=true).

+* You can also send the [sign in logs to Azure Monitor](../reports-monitoring/concept-log-monitoring-integration-options-considerations.md) to archive sign in activity for up to two years.

+|Reporting and analytics|Admins can retrieve audit logs of recent user provisioning and sign on activity. Integration with Azure Monitor and 'who has access' via access packages.|[Microsoft Entra reports](../reports-monitoring/overview-monitoring-health.md) and [monitoring](../reports-monitoring/overview-monitoring-health.md)|

+The [Understanding Lifecycle Workflows](understanding-lifecycle-workflows.md) document, uses the portal to explain the parts of a workflow. The [Developer API reference Lifecycle Workflows](/graph/api/resources/identitygovernance-workflow) document, uses a GRAPH example to explain the parts of a workflow.

+Customers who use SAP SuccessFactors can easily bring identities into [Microsoft Entra ID](../saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial.md) or [on-premises Active Directory](../saas-apps/sap-successfactors-inbound-provisioning-tutorial.md) by using native connectors. The connectors support the following scenarios:

+* **Hiring new employees**: When a new employee is added to SuccessFactors, a user account is automatically created in Microsoft Entra ID and optionally Microsoft 365 and [other software as a service (SaaS) applications that Microsoft Entra ID supports](../app-provisioning/user-provisioning.md). This process includes write-back of the email address to SuccessFactors.

+* Use the enterprise application in Microsoft Entra ID to configure both single sign-on (SSO) and provisioning to SAP applications such as [SAP Analytics Cloud](../saas-apps/sap-analytics-cloud-provisioning-tutorial.md). With this option, you can apply a consistent set of governance processes across all your applications.

+* Use the [SAP Identity Authentication Service (IAS)](../saas-apps/sap-cloud-platform-identity-authentication-provisioning-tutorial.md) enterprise application in Microsoft Entra ID to provision identities into SAP IAS. After you bring all the identities into SAP IAS, you can use SAP IPS to provision the accounts from there into your applications when required.

+* Use the lightweight Microsoft Entra provisioning agent and [web services connector](../app-provisioning/on-premises-web-services-connector.md) to [provision users into apps such as SAP ECC](../app-provisioning/on-premises-sap-connector-configure.md).

+* [Bring identities from SAP SuccessFactors into Microsoft Entra ID](../saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial.md)

+* [Provision accounts in SAP IAS](../saas-apps/sap-cloud-platform-identity-authentication-provisioning-tutorial.md)

+There are some additional steps that you should be aware of when testing either the [On-boarding users to your organization using Lifecycle workflows with the Microsoft Entra Admin Center](tutorial-onboard-custom-workflow-portal.md) tutorial or the [On-boarding users to your organization using Lifecycle workflows with Microsoft Graph](/graph/tutorial-lifecycle-workflows-onboard-custom-workflow) tutorial.

+For more information about updating manager information for a user in Graph API, see [assign manager](/graph/api/user-post-manager?view=graph-rest-1.0&tabs=http&preserve-view=true) documentation. You can also set this attribute in the Azure Admin center. For more information, see [add or change profile information](../fundamentals/how-to-manage-user-profile-info.md?context=azure/active-directory/users-groups-roles/context/ugr-context).

+- [On-boarding users to your organization using Lifecycle workflows with Microsoft Graph](/graph/tutorial-lifecycle-workflows-onboard-custom-workflow)

+- [Tutorial: Off-boarding users from your organization using Lifecycle workflows with Microsoft Graph](/graph/tutorial-lifecycle-workflows-offboard-custom-workflow)

+For delegated scenarios, the admin needs one of the following [Microsoft Entra roles](../roles/permissions-reference.md):

+Microsoft Entra ID also supports provisioning users into applications hosted on-premises or in a virtual machine, without having to open up any firewalls. If your application supports [SCIM](https://aka.ms/scimoverview), or you've built a SCIM gateway to connect to your legacy application, you can use the Microsoft Entra provisioning agent to [directly connect](../app-provisioning/on-premises-scim-provisioning.md) with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an [LDAP](../app-provisioning/on-premises-ldap-connector-configure.md) user store or a [SQL](../app-provisioning/on-premises-sql-connector-configure.md) database, or that have a [SOAP or REST API](../app-provisioning/on-premises-web-services-connector.md), Microsoft Entra ID can support those as well.

+For information on new attributes that are added and updated in Microsoft Entra ID see the [user resource type](/graph/api/resources/user?view=graph-rest-1.0&preserve-view=true#properties) and consider subscribing to [change notifications](/graph/webhooks).

+For more information about using password writeback with Microsoft Entra Cloud Sync, see [Tutorial: Enable cloud sync self-service password reset writeback to an on-premises environment (preview)](../../authentication/tutorial-enable-cloud-sync-sspr-writeback.md).

+|Is Windows Hello for Business supported?|[Key trust model](/windows/security/identity-protection/hello-for-business/hello-identity-verification)<br><br>[Hybrid Cloud Trust](/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust)|[Key trust model](/windows/security/identity-protection/hello-for-business/hello-identity-verification)<br><br>[Hybrid Cloud Trust](/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust)<br><br>*Both require Windows Server 2016 Domain functional level*|[Key trust model](/windows/security/identity-protection/hello-for-business/hello-identity-verification)<br><br>[Hybrid Cloud Trust](/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust)<br><br>[Certificate trust model](/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs)|

+|What are the multifactor authentication options?|[Microsoft Entra multifactor authentication](/azure/multi-factor-authentication/)<br><br>[Custom Controls with Conditional Access*](../../conditional-access/controls.md)|[Microsoft Entra multifactor authentication](../../authentication/index.yml)<br><br>[Custom Controls with Conditional Access*](../../conditional-access/controls.md)|[Microsoft Entra multifactor authentication](../../authentication/index.yml)<br><br>[Third-party MFA](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs)<br><br>[Custom Controls with Conditional Access*](../../conditional-access/controls.md)|

+Organizations that don't have a SIEM solution can use [Azure Monitor workbooks for Microsoft Entra ID](../../reports-monitoring/howto-use-workbooks.md). The integration contains pre-built workbooks and templates to help you understand how your users adopt and use Microsoft Entra features, which allows you to gain insights into all the activities within your directory. You can also create your own workbooks and share with your leadership team to report on day-to-day activities. Workbooks are a great way to monitor your business and see all of your most important metrics at a glance.

+- We recommend hardening the Microsoft Entra Connect server as a Control Plane (formerly Tier 0) asset by following the guidance provided in [Secure Privileged Access](/security/privileged-access-workstations/overview) and [Active Directory administrative tier model](/security/privileged-access-workstations/privileged-access-access-model).

+ * In an elevated PowerShell command window, use the command `Set-Item.WSMan:\localhost\Client\TrustedHosts ΓÇôValue "<DMZServerFQDN>" -Force ΓÇôConcatenate`.

+- It's supported on web browser-based clients and Office clients that support [modern authentication](/microsoft-365/enterprise/modern-auth-for-office-2013-and-2016) on platforms and browsers capable of Kerberos authentication:

+To find your current federation settings, run [Get-MgDomainFederationConfiguration](/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdomainfederationconfiguration?view=graph-powershell-1.0&viewFallbackFrom=graph-powershell-beta&preserve-view=true).

+- [Azure Bastion service](/azure/bastion/bastion-overview): Connect to VMs in a VNet, from any location

+You can create a backup of the entire system disk using [Azure snapshots](/azure/virtual-machines/snapshot-copy-managed-disk). This tool provides contingency for testing between TMOS versions, or rolling back to a fresh system.

+Microsoft recommends that you [restrict user consent](../manage-apps/configure-user-consent.md) to allow users to consent only for apps from verified publishers, and only for permissions that you select. For apps that don't meet these criteria, the decision-making process is centralized with your organization's security and identity administrator team.

+Manage the [Home Realm Discovery policy](/graph/api/resources/homerealmdiscoverypolicy) using [Microsoft Graph](https://developer.microsoft.com/graph/graph-explorer).

+- [List user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azcli#list-user-assigned-managed-identities)

+- [Delete user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azcli#delete-a-user-assigned-managed-identity)

+| Azure Machine Learning Services | [Use Managed identities with Azure Machine Learning](/azure/machine-learning/how-to-identity-based-service-authentication?tabs=python) |

+| Microsoft Purview | [Credentials for source authentication in Microsoft Purview](/purview/manage-credentials) |

+| Azure Synapse | [Azure Synapse workspace managed identity](/azure/data-factory/data-factory-service-identity) |

+- **User-assigned**. You may also create a managed identity as a standalone Azure resource. You can [create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azp) and assign it to one or more Azure Resources. When you enable a user-assigned managed identity:

+- You can [create, read, update, and delete](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azp) the identities.

+4. Create a user-assigned managed identity using the instructions found here: [Create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-rest#create-a-user-assigned-managed-identity).

+2. Create a user-assigned managed identity using the instructions found here, [Create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-rest#create-a-user-assigned-managed-identity).

+- [Create, list, or delete a user-assigned managed identities using REST API calls](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-rest)

+4. Create a user-assigned managed identity using the instructions found here: [Create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-rest#create-a-user-assigned-managed-identity).

+2. Create a user-assigned managed identity using the instructions found here, [Create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-rest#create-a-user-assigned-managed-identity).

+- [Create, list, or delete a user-assigned managed identity using REST API calls](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-rest)

+> To create a user-assigned managed identity using an Azure Resource Manager Template, see [Create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-arm#create-a-user-assigned-managed-identity).

+> To create a user-assigned managed identity using an Azure Resource Manager Template, see [Create a user-assigned managed identity](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-arm#create-a-user-assigned-managed-identity).

+>[Create, list or delete a user-assigned managed identity using Azure PowerShell](./how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-powershell)

+To complete these steps, you will need an SSH client. If you are using Windows, you can use the SSH client in the [Windows Subsystem for Linux](/windows/wsl/install). If you need assistance configuring your SSH client's keys, see [How to Use SSH keys with Windows on Azure](/azure/virtual-machines/linux/ssh-from-windows), or [How to create and use an SSH public and private key pair for Linux VMs in Azure](/azure/virtual-machines/linux/mac-create-ssh-keys).

+These parameters are included in the POST body of the request for the SAS credential. For more information on the parameters for creating a SAS credential, see the [List Service SAS REST reference](/rest/api/storagerp/storage-accounts/list-service-sas).

+Microsoft Entra role-assignable group feature is not part of Microsoft Entra Privileged Identity Management (Microsoft Entra PIM). For more information on licensing, see [Microsoft Entra ID Governance licensing fundamentals](../governance/licensing-fundamentals.md) .

+In Microsoft Entra ID, formerly known as Azure Active Directory, you can use Privileged Identity Management (PIM) to manage just-in-time membership in the group or just-in-time ownership of the group.

+>Every user who is eligible for membership in or ownership of a PIM for Groups must have a Microsoft Entra Premium P2 or Microsoft Entra ID Governance license. For more information, see [License requirements to use Privileged Identity Management](../governance/licensing-fundamentals.md).

+- [PIM Alerts for Microsoft Entra roles API reference](/graph/api/resources/privilegedidentitymanagementv3-overview?view=graph-rest-beta&preserve-view=true#building-blocks-of-the-pim-alerts-apis)

+- [License requirements to use Privileged Identity Management](../governance/licensing-fundamentals.md)

+For more information about licenses for PIM, refer to [License requirements to use Privileged Identity Management](../governance/licensing-fundamentals.md).

+For more information, see [License requirements to use Privileged Identity Management](../governance/licensing-fundamentals.md).

+Privileged Identity Management supports Azure Resource Manager (ARM) API commands to manage Azure resource roles, as documented in the [PIM ARM API reference](/rest/api/authorization/role-eligibility-schedule-requests). For the permissions required to use the PIM API, see [Understand the Privileged Identity Management APIs](pim-apis.md).

+- [License requirements to use Privileged Identity Management](../governance/licensing-fundamentals.md)

+The `SignInLogs` send the interactive sign-in logs, which are logs generated by your users signing in. Sign-in logs are generated by users providing their username and password on a Microsoft Entra sign-in screen or passing an MFA challenge. For more information, see [Interactive user sign-ins](./concept-sign-ins.md#interactive-user-sign-ins).

+The `NonInteractiveUserSIgnInLogs` are sign-ins done on behalf of a user, such as by a client app. The device or client uses a token or code to authenticate or access a resource on behalf of a user. For more information, see [Non-interactive user sign-ins](./concept-sign-ins.md#non-interactive-user-sign-ins).

+If you need to review sign-in activity for apps or service principals, the `ServicePrincipalSignInLogs` may be a good option. In these scenarios, certificates or client secrets are used for authentication. For more information, see [Service principal sign-ins](./concept-sign-ins.md#service-principal-sign-ins).

+The `ManagedIdentitySignInLogs` provide similar insights as the service principal sign-in logs, but for managed identities, where Azure manages the secrets. For more information, see [Managed identity sign-ins](./concept-sign-ins.md#managed-identity-sign-ins).

+- [Learn about the sign-in logs](./concept-sign-ins.md)

+To enable a log integration, follow the steps in the [Integrate activity logs with Azure Monitor logs](./howto-integrate-activity-logs-with-azure-monitor-logs.md) article. If possible, create a new resource group for the logs and endpoint you want to try out. Having a devoted resource group makes it easy to view the cost analysis and then delete it when you're done.

+* [Archive activity logs to a storage account](./howto-archive-logs-to-storage-account.md)

+* [Route activity logs to an event hub](./howto-stream-logs-to-event-hub.md)

+* [Integrate activity logs with Azure Monitor](./howto-integrate-activity-logs-with-azure-monitor-logs.md)

+Reviewing sign-in errors and patterns provides valuable insight into how your users access applications and services. The sign-in logs provided by Microsoft Entra ID are a powerful type of [activity log](./overview-monitoring-health.md) that you can analyze. This article explains how to access and utilize the sign-in logs.

+You can view Microsoft 365 activity logs from the [Microsoft 365 admin center](/microsoft-365/admin/admin-overview/admin-center-overview). Microsoft 365 activity and Microsoft Entra activity logs share a significant number of directory resources. Only the Microsoft 365 admin center provides a full view of the Microsoft 365 activity logs.

+- [Basic info in the Microsoft Entra sign-in logs](./concept-sign-in-log-activity-details.md)

+ - [Learn more about streaming activity logs to an event hub](./howto-stream-logs-to-event-hub.md)

+ - [Integrate Microsoft Entra logs with Azure Monitor logs](./howto-integrate-activity-logs-with-azure-monitor-logs.md)

+ - [Learn how to filter activity logs](./howto-customize-filter-logs.md)

+ - [Learn about basic info in the Microsoft Entra sign-in logs](./concept-sign-in-log-activity-details.md)

+[Azure Storage](/azure/storage/common/storage-introduction) is the right solution if you aren't planning on querying your data often. For more information, see [Archive directory logs to a storage account](./howto-archive-logs-to-storage-account.md).

+If you plan to query the logs often to run reports or perform analysis on the stored logs, you should [integrate your data with Azure Monitor logs](./howto-integrate-activity-logs-with-azure-monitor-logs.md).

+- [Stream logs to an event hub](./howto-stream-logs-to-event-hub.md)

+- [Archive logs to a storage account](./howto-archive-logs-to-storage-account.md)

+- [Integrate logs with Azure Monitor logs](./howto-integrate-activity-logs-with-azure-monitor-logs.md)

+After you [integrate Microsoft Entra activity logs with Azure Monitor logs](./howto-integrate-activity-logs-with-azure-monitor-logs.md), you can use the power of Log Analytics and Azure Monitor logs to gain insights into your environment.

+To view the Microsoft Entra ID Log Analytics, you must already be sending your activity logs from Microsoft Entra ID to a Log Analytics workspace. This process is covered in the [How to integrate activity logs with Azure Monitor](./howto-integrate-activity-logs-with-azure-monitor-logs.md) article.

+If your tenant has enabled the [sign-in logs preview](./concept-sign-ins.md), more options are available after selecting **Download**. The sign-in logs preview include interactive and non-interactive user sign-ins, service principal sign-ins, and managed identity sign-ins.

+- [Integrate Microsoft Entra logs with Azure Monitor](./howto-integrate-activity-logs-with-azure-monitor-logs.md)

+- To generate a `lastSignInDateTime` timestamp, you must attempt a sign-in. Either a failed or successful sign-in attempt, as long as it's recorded in the [Microsoft Entra sign-in logs](./concept-sign-ins.md), generates a `lastSignInDateTime` timestamp. The value of the `lastSignInDateTime` property may be blank if:

+- [Learn about Service Health notifications](/azure/service-health/service-health-portal-update)

+- [**Sign-in logs**](./concept-sign-ins.md) capture the sign-in attempts of your users and client applications.

+- [Integrate logs with Azure Monitor logs.](./howto-integrate-activity-logs-with-azure-monitor-logs.md)

+- Learn [how to use Azure Workbooks for Microsoft Entra ID](./howto-use-workbooks.md)

+- [Microsoft Entra reports overview](./overview-monitoring-health.md).

+| Microsoft Entra ID Free| The first time you open [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) or use the [reporting APIs](./overview-monitoring-health.md) |

+You can retain the audit and sign-in activity data for longer than the default retention period outlined in the previous table by routing it to an Azure storage account using Azure Monitor. For more information, see [Archive Microsoft Entra logs to an Azure storage account](./howto-archive-logs-to-storage-account.md).

+- [Stream logs to an event hub](./howto-stream-logs-to-event-hub.md)

+- For more information about Microsoft Entra workbooks, see [How to use Microsoft Entra workbooks](./howto-use-workbooks.md).

+- For more information about Microsoft Entra workbooks, see [How to use Microsoft Entra workbooks](./howto-use-workbooks.md).

+- For default user permissions, see a [comparison of default guest and member user permissions](../fundamentals/users-default-permissions.md?context=azure/active-directory/roles/context/ugr-context).

+> | Admin roles in Office 365 and Microsoft 365 business plans | [Microsoft 365 admin roles](/microsoft-365/admin/add-users/about-admin-roles) | Not available |

+> | Exchange Online| [Exchange role-based access control](/exchange/understanding-role-based-access-control-exchange-2013-help) | [PowerShell for Exchange](/powershell/module/exchange/add-managementroleentry)<br>[Fetch role assignments](/powershell/module/exchange/get-rolegroup) |

+Secure your privileged access in a way that is managed and reported in the Microsoft services you care about. If you have on-premises administrator accounts, see the guidance for on-premises and hybrid privileged access in Active Directory at [Securing Privileged Access](/security/privileged-access-workstations/overview).

+* Beyond the roles defined in Microsoft Entra ID, Microsoft 365 comes with a set of administrator roles that you can assign to users in your organization. Each administrator role maps to common business functions, and gives people in your organization permissions to do specific tasks in the [Microsoft 365 admin center](https://admin.microsoft.com). Use the Microsoft 365 admin center to find out which users in your organization have administrator access to Microsoft 365, including via roles not managed in Microsoft Entra ID. For more information, see [About Microsoft 365 administrator roles](https://support.office.com/article/About-Office-365-admin-roles-da585eea-f576-4f55-a1e0-87090b6aaa9d) and [Security practices for Office 365](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance).

+ | SessionDuration | user.sessionduration | `https://aws.amazon.com/SAML/Attributes` |

+|AC.L2-3.1.12<br><br>**Practice statement:** Monitor and control remote access sessions.<br><br>**Objectives:**<br>Determine if:<br>[a.] remote access sessions are permitted;<br>[b.] the types of permitted remote access are identified;<br>[c.] remote access sessions are controlled; and<br>[d.] remote access sessions are monitored. | In todayΓÇÖs world, users access cloud-based applications almost exclusively remotely from unknown or untrusted networks. It's critical to securing this pattern of access to adopt zero trust principals. To meet these controls requirements in a modern cloud world we must verify each access request explicitly, implement least privilege and assume breach.<br><br>Configure named locations to delineate internal vs external networks. Configure Conditional Access app control to route access via Microsoft Defender for Cloud Apps. Configure Defender for Cloud Apps to control and monitor all sessions.<br>[Zero Trust Deployment Guide for Microsoft Entra ID](https://www.microsoft.com/security/blog/2020/04/30/zero-trust-deployment-guide-azure-active-directory/)<br>[Location condition in Microsoft Entra Conditional Access](../conditional-access/location-condition.md)<br>[Deploy Cloud App Security Conditional Access App Control for Microsoft Entra apps](/defender-cloud-apps/proxy-deployment-aad)<br>[What is Microsoft Defender for Cloud Apps?](/defender-cloud-apps/what-is-defender-for-cloud-apps)<br>[Monitor alerts raised in Microsoft Defender for Cloud Apps](/microsoft-365/security/defender/investigate-alerts) |

+| AC.L2-3.1.14<br><br>**Practice statement:** Route remote access via managed access control points.<br><br>**Objectives:**<br>Determine if:<br>[a.] managed access control points are identified and implemented; and<br>[b.] remote access is routed through managed network access control points. | Configure named locations to delineate internal vs external networks. Configure Conditional Access app control to route access via Microsoft Defender for Cloud Apps. Configure Defender for Cloud Apps to control and monitor all sessions. Secure devices used by privileged accounts as part of the privileged access story.<br>[Location condition in Microsoft Entra Conditional Access](../conditional-access/location-condition.md)<br>[Session controls in Conditional Access policy](../conditional-access/concept-conditional-access-session.md)<br>[Securing privileged access overview](/security/privileged-access-workstations/overview) |

+| SC.L2-3.13.3<br><br>**Practice statement:** Separate user functionality form system management functionality. <br><br>**Objectives:**<br>Determine if:<br>[a.] user functionality is identified;<br>[b.] system management functionality is identified; and<br>[c.] user functionality is separated from system management functionality. | Maintain separate user accounts in Microsoft Entra ID for everyday productivity use and administrative or system/privileged management. Privileged accounts should be cloud-only or managed accounts and not synchronized from on-premises to protect the cloud environment from on-premises compromise. System/privileged access should only be permitted from a security hardened privileged access workstation (PAW). Configure Conditional Access device filters to restrict access to administrative applications from PAWs that are enabled using Azure Virtual Desktops.<br>[Why are privileged access devices important](/security/compass/privileged-access-devices)<br>[Device Roles and Profiles](/security/privileged-access-workstations/privileged-access-devices)<br>[Filter for devices as a condition in Conditional Access policy](../conditional-access/concept-condition-filters-for-devices.md)<br>[Azure Virtual Desktop](https://azure.microsoft.com/products/virtual-desktop/) |

+| **AC-10 Concurrent Session Control**<br>The information system limits the number of concurrent sessions for each [*Assignment: organization-defined account and/or account type*] to [*FedRAMP Assignment: three (3) sessions for privileged access and two (2) sessions for non-privileged access*].|**Limit concurrent sessions to three sessions for privileged access and two for nonprivileged access.** <p>Currently, users connect from multiple devices, sometimes simultaneously. Limiting concurrent sessions leads to a degraded user experience and provides limited security value. A better approach to address the intent behind this control is to adopt a zero-trust security posture. Conditions are explicitly validated before a session is created and continually validated throughout the life of a session. <p>In addition, use the following compensating controls. <p>Use Conditional Access policies to restrict access to compliant devices. Configure policy settings on the device to enforce user sign-in restrictions at the OS level with MDM solutions such as Intune. Endpoint Manager or group policy objects can also be considered in hybrid deployments.<p> Use Privileged Identity Management to further restrict and control privileged accounts. <p> Configure smart account lockout for invalid sign-in attempts.<p>**Implementation guidance** <p>Zero trust<br><li> [Securing identity with Zero Trust](/security/zero-trust/deploy/identity)<br><li>[Continuous access evaluation in Microsoft Entra ID](../conditional-access/concept-continuous-access-evaluation.md)<p>Conditional Access<br><li>[What is Conditional Access in Microsoft Entra ID?](../conditional-access/overview.md)<br><li>[Require device to be marked as compliant](../conditional-access/concept-conditional-access-grant.md)<br><li>[User sign-in frequency](../conditional-access/howto-conditional-access-session-lifetime.md)<p>Device policies<br><li>[Other smart card Group Policy settings and registry keys](/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings)<br><li>[Microsoft Endpoint Manager overview](/mem/endpoint-manager-overview)<p>Resources<br><li>[What is Microsoft Entra Privileged Identity Management?](../privileged-identity-management/pim-configure.md)<br><li>[Protect user accounts from attacks with Microsoft Entra smart lockout](../authentication/howto-password-smart-lockout.md)<p>See AC-12 for more session reevaluation and risk mitigation guidance. |

+| Scan environment for ePHI data | [Microsoft Purview](/purview/governance-solutions-overview) can be enabled in audit mode to scan what ePHI is sitting in the data estate, and the resources that are being used to store that data. This information helps in establishing data classification and labeling the sensitivity of the data.</br>In addition, using [Content Explorer](/purview/data-classification-content-explorer) provides visibility into where the sensitive data is located. This information helps start the labeling journey from manually applying labeling or labeling recommendations on the client-side to service-side autolabeling. |

+ * See, [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)

+While NIST doesn't require verifier impersonation (credential phishing) resistance until AAL3, we advise you to address this threat at all levels. You can select authenticators that provide verifier impersonation resistance, such as requiring devices are joined to Microsoft Entra ID or hybrid Microsoft Entra ID. If you're using Office 365, you can use Office 365 Advanced Threat Protection, and its [anti-phishing policies](/microsoft-365/security/office-365-security/anti-phishing-policies-about).

+* You run [Windows in a FIPS-140 approved mode](/windows/security/security-foundations/certification/fips-140-validation)

+|**8.3.4** Invalid authentication attempts are limited by: </br> Locking out the user ID after not more than 10 attempts. </br> Setting the lockout duration to a minimum of 30 minutes or until the userΓÇÖs identity is confirmed.|Deploy Windows Hello for Business for Windows devices that support hardware Trusted Platform Modules (TPM) 2.0 or higher. </br> For Windows Hello for Business, lockout relates to the device. The gesture, PIN, or biometric, unlocks access to the local TPM. Administrators configure the lockout behavior with GPO or Intune policies. [TPM Group Policy settings](/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings) </br> [Manage Windows Hello for Business on devices at the time devices enroll with Intune](/mem/intune/protect/windows-hello) </br> [TPM fundamentals](/windows/security/hardware-security/tpm/tpm-fundamentals) </br> Windows Hello for Business works for on-premises authentication to Active Directory and cloud resources on Microsoft Entra ID. </br> For FIDO2 security keys, brute-force protection is related to the key. The gesture, PIN or biometric, unlocks access to the local key storage. Administrators configure Microsoft Entra ID to allow registration of FIDO2 security keys from manufacturers that align to PCI requirements. [Enable passwordless security key sign-in](../authentication/howto-authentication-passwordless-security-key.md) </br></br> **Microsoft Authenticator App** </br> To mitigate brute force attacks using Microsoft Authenticator app passwordless sign in, enable number matching and more context. </br> Microsoft Entra ID generates a random number in the authentication flow. The user types it in the authenticator app. The mobile app authentication prompt shows the location, the request IP address, and the request application. [How to use number matching in MFA notifications](../authentication/how-to-mfa-number-match.md) </br> [How to use additional context in Microsoft Authenticator notifications](../authentication/how-to-mfa-additional-context.md)|

+The app registration needs to have the API Permission for `Verifiable Credentials Service Admin` and then when acquiring the access token the app should use scope `6a8b4b39-c021-437c-b060-5a14a3fd65f3/full_access`. The access token must be for a user with the [global administrator](../roles/permissions-reference.md#global-administrator) or the [authentication policy administrator](../roles/permissions-reference.md#authentication-policy-administrator) role. A user with role [global reader](../roles/permissions-reference.md#global-reader) can perform read-only API calls.

+The app registration needs to have the API Permission for `Verifiable Credentials Service Admin` and permissions required from the above table. When acquiring the access token, via the [client credentials flow](../develop/v2-oauth2-client-creds-grant-flow.md), the app should use scope `6a8b4b39-c021-437c-b060-5a14a3fd65f3/.default`.

+Use the [OAuth 2.0 client credentials grant flow](../develop/v2-oauth2-client-creds-grant-flow.md) to acquire the access token by using the Microsoft identity platform. Use a trusted library for this purpose. In this tutorial, we use the Microsoft Authentication Library [MSAL](../develop/msal-overview.md). MSAL simplifies adding authentication and authorization to an app that can call a secure web API.

+- Ensure that you have the [global administrator](../roles/permissions-reference.md#global-administrator) or the [authentication policy administrator](../roles/permissions-reference.md#authentication-policy-administrator) permission for the directory you want to configure. If you're not the global administrator, you need the [application administrator](../roles/permissions-reference.md#application-administrator) permission to complete the app registration including granting admin consent.

+- Ensure that you have the [global administrator](../roles/permissions-reference.md#global-administrator) or the [authentication policy administrator](../roles/permissions-reference.md#authentication-policy-administrator) permission for the directory you want to configure. If you're not the global administrator, you need the [application administrator](../roles/permissions-reference.md#application-administrator) permission to complete the app registration including granting admin consent.

+- Java - [Deploy to App Service](/azure/app-service/quickstart-java?tabs=javase&pivots=platform-linux-development-environment-maven#4deploy-the-app). You need to add the maven plugin for Azure App Service to the sample.

+- *Public preview* - Entitlement Management customers can now create access packages that leverage Microsoft Entra Verified ID [learn more](../governance/entitlement-management-verified-id-settings.md)

+- Microsoft Entra Verified ID now reports events in the [audit log](../reports-monitoring/concept-audit-logs.md). Only management changes made via the Admin API are currently logged. Issuance or presentations of verifiable credentials aren't reported in the audit log. The log entries have a service name of `Verified ID` and the activity will be `Create authority`, `Update contract`, etc.

+- For information about the required format of JWTs created by external identity providers, read about the [assertion format](../develop/certificate-credentials.md#assertion-format).

+* Local files uploaded using the Azure OpenAI Studio

+Storage accounts in virtual networks, firewalls, and private endpoints are supported by Azure OpenAI on your data. To use a storage account in a private network:

+1. Ensure you have the system assigned managed identity principal enabled for your Azure OpenAI and Azure Cognitive Search resources.

+ 1. Using the Azure portal, navigate to your resource, and select **Identity** from the navigation menu on the left side of the screen.

+ 1. Set **Status** to **On**.

+ 1. Perform these steps for both of your Azure OpenAI and Azure Cognitive Search resources.

+ :::image type="content" source="../media/use-your-data/managed-identity.png" alt-text="A screenshot showing managed identity settings in the Azure portal." lightbox="../media/use-your-data/managed-identity.png":::

+1. Navigate back to your storage account. Select **Access Control (IAM)** for your resource. Select **Add**, then **Add role assignment**. In the window that appears, add the **Storage Data Contributor** role to the storage resource for your Azure OpenAI and search resource's managed identity.

+ 1. Assign access to **Managed Identity**.

+ 1. If you have multiple search resources, Perform this step for each search resource.

+ :::image type="content" source="../media/use-your-data/add-role-assignment.png" alt-text="A screenshot showing the role assignment option in the Azure portal." lightbox="../media/use-your-data/add-role-assignment.png":::

+1. If your storage account hasn't already been network restricted, go to networking tab and select **Enabled from selected virtual networks and IP addresses**.

+ :::image type="content" source="../media/use-your-data/enable-virtual-network.png" alt-text="A screenshot showing the option for enabling virtual networks in the Azure portal." lightbox="../media/use-your-data/enable-virtual-network.png":::

+[Reference](https://platform.openai.com/docs/api-reference?lang=python) | [Source code](https://github.com/openai/openai-python) | [Package (pypi)](https://pypi.org/project/openai/) | [Samples](https://github.com/openai/openai-cookbook/)

+The links above reference the OpenAI API for Python. There is no Azure-specific OpenAI Python SDK. [Learn how to switch between the OpenAI services and Azure OpenAI services](/azure/ai-services/openai/how-to/switching-endpoints).

+[Reference](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go) | [Source code](https://github.com/Azure/azure-sdk-for-go) | [Package (Go)](https://pkg.go.dev/github.com/azure/azure-dev) | [Samples](https://github.com/azure-samples/azure-sdk-for-go-samples)

+- Be sure that you are assigned at least the [Cognitive Services Contributor](./how-to/role-based-access-control.md#cognitive-services-contributor) role for the Azure OpenAI resource.

+### Customize the load balancer health probe

+| Annotation | Value | Description |

+| - | -- | -- |

+| `service.beta.kubernetes.io/azure-load-balancer-health-probe-interval` | Health probe interval | |

+| `service.beta.kubernetes.io/azure-load-balancer-health-probe-num-of-probe` | The minimum number of unhealthy responses of health probe | |

+| `service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path` | Request path of the health probe | |

+| `service.beta.kubernetes.io/port_{port}_no_lb_rule` | true/false | {port} is the port number in the service. When it is set to true, no lb rule and health probe rule for this port will be generated. health check service should not be exposed to the public internet(e.g. istio/envoy health check service)|

+| `service.beta.kubernetes.io/port_{port}_no_probe_rule` | true/false | {port} is the port number in the service. When it is set to true, no health probe rule for this port will be generated. |

+| `service.beta.kubernetes.io/port_{port}_health-probe_protocol` | Health probe protocol | {port} is the port number in the service. Explicit protocol for the health probe for the service port {port}, overriding port.appProtocol if set.|

+| `service.beta.kubernetes.io/port_{port}_health-probe_port` | port number or port name in service manifest | {port} is the port number in the service. Explicit port for the health probe for the service port {port}, overriding the default value. |

+| `service.beta.kubernetes.io/port_{port}_health-probe_interval` | Health probe interval | {port} is port number of service. |

+| `service.beta.kubernetes.io/port_{port}_health-probe_num-of-probe` | The minimum number of unhealthy responses of health probe | {port} is port number of service. |

+| `service.beta.kubernetes.io/port_{port}_health-probe_request-path` | Request path of the health probe | {port} is port number of service. |

+As documented [here](../load-balancer/load-balancer-custom-probe-overview.md), Tcp, Http and Https are three protocols supported by load balancer service.

+Currently, the default protocol of the health probe varies among services with different transport protocols, app protocols, annotations and external traffic policies.

+1. for local services, HTTP and /healthz would be used. The health probe will query NodeHealthPort rather than actual backend service

+1. for cluster TCP services, TCP would be used.

+1. for cluster UDP services, no health probes.

+> [!NOTE]

+> For local services with PLS integration and PLS proxy protocol enabled, the default HTTP+/healthz health probe does not work. Thus health probe can be customized the same way as cluster services to support this scenario.

+Since v1.20, service annotation `service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path` is introduced to determine the health probe behavior.

+* For clusters <=1.23, `spec.ports.appProtocol` would only be used as probe protocol when `service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path` is also set.

+* For clusters >1.24, `spec.ports.appProtocol` would be used as probe protocol and `/` would be used as default probe request path (`service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path` could be used to change to a different request path).

+Note that the request path would be ignored when using TCP or the `spec.ports.appProtocol` is empty. More specifically:

+| loadbalancer sku | `externalTrafficPolicy` | spec.ports.Protocol | spec.ports.AppProtocol | `service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path` | LB Probe Protocol | LB Probe Request Path |

+| - | -- | - | - | -- | | |

+| standard | local | any | any | any | http | `/healthz` |

+| standard | cluster | udp | any | any | null | null |

+| standard | cluster | tcp | | (ignored) | tcp | null |

+| standard | cluster | tcp | tcp | (ignored) | tcp | null |

+| standard | cluster | tcp | http/https | | TCP(<=1.23) or http/https(>=1.24) | null(<=1.23) or `/`(>=1.24) |

+| standard | cluster | tcp | http/https | `/custom-path` | http/https | `/custom-path` |

+| standard | cluster | tcp | unsupported protocol | `/custom-path` | tcp | null |

+| basic | local | any | any | any | http | `/healthz` |

+| basic | cluster | tcp | | (ignored) | tcp | null |

+| basic | cluster | tcp | tcp | (ignored) | tcp | null |

+| basic | cluster | tcp | http | | TCP(<=1.23) or http/https(>=1.24) | null(<=1.23) or `/`(>=1.24) |

+| basic | cluster | tcp | http | `/custom-path` | http | `/custom-path` |

+| basic | cluster | tcp | unsupported protocol | `/custom-path` | tcp | null |

+Since v1.21, two service annotations `service.beta.kubernetes.io/azure-load-balancer-health-probe-interval` and `load-balancer-health-probe-num-of-probe` are introduced, which customize the configuration of health probe. If `service.beta.kubernetes.io/azure-load-balancer-health-probe-interval` is not set, Default value of 5 is applied. If `load-balancer-health-probe-num-of-probe` is not set, Default value of 2 is applied. And total probe should be less than 120 seconds.

+### Custom Load Balancer health probe for port

+Different ports in a service may require different health probe configurations. This could be because of service design (such as a single health endpoint controlling multiple ports), or Kubernetes features like the [MixedProtocolLBService](https://kubernetes.io/docs/concepts/services-networking/service/#load-balancers-with-mixed-protocol-types).

+The following annotations can be used to customize probe configuration per service port.

+| port specific annotation | global probe annotation | Usage |

+| - | | - |

+| service.beta.kubernetes.io/port_{port}_no_lb_rule | N/A (no equivalent globally) | if set true, no lb rules and probe rules will be generated |

+| service.beta.kubernetes.io/port_{port}_no_probe_rule | N/A (no equivalent globally) | if set true, no probe rules will be generated |

+| service.beta.kubernetes.io/port_{port}_health-probe_protocol | N/A (no equivalent globally) | Set the health probe protocol for this service port (e.g. Http, Https, Tcp) |

+| service.beta.kubernetes.io/port_{port}_health-probe_port | N/A (no equivalent globally) | Sets the health probe port for this service port (e.g. 15021) |

+| service.beta.kubernetes.io/port_{port}_health-probe_request-path | service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path | For Http or Https, sets the health probe request path. Defaults to / |

+| service.beta.kubernetes.io/port_{port}_health-probe_num-of-probe | service.beta.kubernetes.io/azure-load-balancer-health-probe-num-of-probe | Number of consecutive probe failures before the port is considered unhealthy |

+| service.beta.kubernetes.io/port_{port}_health-probe_interval | service.beta.kubernetes.io/azure-load-balancer-health-probe-interval | The amount of time between probe attempts |

+For following manifest, probe rule for port httpsserver is different from the one for httpserver because annoations for port httpsserver are specified.

+```yaml

+apiVersion: v1

+kind: Service

+metadata:

+ name: appservice

+ annotations:

+ service.beta.kubernetes.io/azure-load-balancer-health-probe-num-of-probe: "5"

+ service.beta.kubernetes.io/port_443_health-probe_num-of-probe: "4"

+spec:

+ type: LoadBalancer

+ selector:

+ app: server

+ ports:

+ - name: httpserver

+ protocol: TCP

+ port: 80

+ targetPort: 30102

+ - name: httpsserver

+ protocol: TCP

+ appProtocol: HTTPS

+ port: 443

+ targetPort: 30104

+```

+In this manifest, the https ports use a different node port, an HTTP readiness check at port 10256 on /healthz(healthz endpoint of kube-proxy).

+```yaml

+apiVersion: v1

+kind: Service

+metadata:

+ name: istio

+ annotations:

+ service.beta.kubernetes.io/azure-load-balancer-internal: "true"

+ service.beta.kubernetes.io/port_443_health-probe_protocol: "http"

+ service.beta.kubernetes.io/port_443_health-probe_port: "10256"

+ service.beta.kubernetes.io/port_443_health-probe_request-path: "/healthz"

+spec:

+ ports:

+ - name: https

+ protocol: TCP

+ port: 443

+ targetPort: 8443

+ nodePort: 30104

+ appProtocol: https

+ selector:

+ app: istio-ingressgateway

+ gateway: istio-ingressgateway

+ istio: ingressgateway

+ type: LoadBalancer

+ sessionAffinity: None

+ externalTrafficPolicy: Local

+ ipFamilies:

+ - IPv4

+ ipFamilyPolicy: SingleStack

+ allocateLoadBalancerNodePorts: true

+ internalTrafficPolicy: Cluster

+```

+In this manifest, the https ports use a different health probe endpoint, an HTTP readiness check at port 30000 on /healthz/ready.

+```yaml

+apiVersion: v1

+kind: Service

+metadata:

+ name: istio

+ annotations:

+ service.beta.kubernetes.io/azure-load-balancer-internal: "true"

+ service.beta.kubernetes.io/port_443_health-probe_protocol: "http"

+ service.beta.kubernetes.io/port_443_health-probe_port: "30000"

+ service.beta.kubernetes.io/port_443_health-probe_request-path: "/healthz/ready"

+spec:

+ ports:

+ - name: https

+ protocol: TCP

+ port: 443

+ targetPort: 8443

+ appProtocol: https

+ selector:

+ app: istio-ingressgateway

+ gateway: istio-ingressgateway

+ istio: ingressgateway

+ type: LoadBalancer

+ sessionAffinity: None

+ externalTrafficPolicy: Local

+ ipFamilies:

+ - IPv4

+ ipFamilyPolicy: SingleStack

+ allocateLoadBalancerNodePorts: true

+ internalTrafficPolicy: Cluster

+```

+[Scheduled events][scheduled-events] can occur on the underlying VMs in any of your node pools. For [spot node pools][spot-node-pools], scheduled events may cause a *preempt* node event for the node. Certain node events, such as *preempt*, cause AKS node auto-drain to attempt a cordon and drain of the affected node. This process enables rescheduling for any affected workloads on that node. You might notice the node receives a taint with `"remediator.kubernetes.azure.com/unschedulable"`, because of `"kubernetes.azure.com/scalesetpriority: spot"`.

+² Connectivity to the self-hosted gateway v2 [configuration endpoint](self-hosted-gateway-overview.md#fqdn-dependencies) requires DNS resolution of the endpoint hostname.<br/>

+## Related content

+* **Azure CLI** - Run `az version` to check your version. If you're running version 2.42.0 or later, no action is required. Use the `az upgrade` command to upgrade the Azure CLI if necessary. For more information, see [How to update the Azure CLI](/cli/azure/update-azure-cli).

+> [!NOTE]

+> Due to a known issue with HTTP proxies using basic authentication, using certificate revocation list (CRL) validation is not supported. Learn more in our [Self-Hosted Gateway settings reference](self-hosted-gateway-settings-reference.md) how to configure it appropriately.

+| security.certificate-revocation.validation.enabled | Provides capability to turn certificate revocation list validation on/off | No | `false` | v2.3.6+ |

+### Q: Is a Premium v2 tier planned?

+A: Yes, a Premium v2 preview is planned and will be announced separately.

+* Learn more about the API Management [tiers](api-management-features.md).

+| * / 443 | Inbound | TCP | AzureTrafficManager / VirtualNetwork | **Azure Traffic Manager** routing for multi-region deployment | External |

+| * / 443 | Inbound | TCP | AzureTrafficManager / VirtualNetwork | **Azure Traffic Manager** routing for multi-region deployment | External only |

+| US DoD East | ✅ | | ✅ |

+Attestation policy is used to process the attestation evidence and determines whether Azure Attestation issues an attestation token. Attestation token generation can be controlled with custom policies. Here are some examples of an attestation token.

+Some of the claims used here are considered deprecated but are fully supported. It is recommended that all future code and tooling use the non-deprecated claim names. For more information, see [claims issued by Azure Attestation](claim-sets.md).

+The below claims appear only in the attestation token generated for Intel® Xeon® Scalable processor-based server platforms. The claims do not appear if the SGX enclave is not configured with [Key Separation and Sharing Support](https://github.com/openenclave/openenclave/issues/3054)

+## Sample JWT generated for TDX attestation

+The definitions of below claims are available in [Azure Attestation TDX EAT profile](trust-domain-extensions-eat-profile.md)

+```

+{

+ "attester_tcb_status": "UpToDate",

+ "dbgstat": "disabled",

+ "eat_profile": "https://aka.ms/maa-eat-profile-tdxvm",

+ "exp": 1697706287,

+ "iat": 1697677487,

+ "intuse": "generic",

+ "iss": "https://maasand001.eus.attest.azure.net",

+ "jti": "5f65006d573bc1c04f67820348c20f5d8da72ddbbd4d6c03da8de9f11b5cf29b",

+ "nbf": 1697677487,

+ "tdx_mrconfigid": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_mrowner": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_mrownerconfig": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_mrseam": "2fd279c16164a93dd5bf373d834328d46008c2b693af9ebb865b08b2ced320c9a89b4869a9fab60fbe9d0c5a5363c656",

+ "tdx_mrsignerseam": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_mrtd": "5be56d418d33661a6c21da77c9503a07e430b35eb92a0bd042a6b3c4e79b3c82bb1c594e770d0d129a0724669f1e953f",

+ "tdx_report_data": "93c6db49f2318387bcebdad0275e206725d948f9000d900344aa44abaef145960000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_rtmr0": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_rtmr1": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_rtmr2": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_rtmr3": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+ "tdx_seam_attributes": "0000000000000000",

+ "tdx_seamsvn": 3,

+ "tdx_td_attributes": "0000000000000000",

+ "tdx_td_attributes_debug": false,

+ "tdx_td_attributes_key_locker": false,

+ "tdx_td_attributes_perfmon": false,

+ "tdx_td_attributes_protection_keys": false,

+ "tdx_td_attributes_septve_disable": false,

+ "tdx_tee_tcb_svn": "03000600000000000000000000000000",

+ "tdx_xfam": "e718060000000000",

+ "x-ms-attestation-type": "tdxvm",

+ "x-ms-compliance-status": "azure-compliant-cvm",

+ "x-ms-policy-hash": "B56nbp5slhw66peoRYkpdq1WykMkEworvdol08hnMXE",

+ "x-ms-runtime": {

+ "test-claim-name": "test-claim-value"

+ },

+ "x-ms-ver": "1.0"

+}

+```

+ Title: Azure Attestation EAT profile for TDX

+description: Azure Attestation EAT profile for TDX

+# Azure Attestation EAT profile for Intel® Trust Domain Extensions (TDX)

+This profile outlines claims for an [Intel® Trust Domain Extensions (TDX)](https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/overview.html) attestation result generated as an Entity Attestation Token (EAT) by Azure Attestation.

+The profile includes claims from the IETF [JWT](https://datatracker.ietf.org/doc/html/rfc7519) specification, the [EAT](https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat-21)) specification, Intel's TDX specification and Microsoft specific claims.

+## JWT claims

+The complete definitions of the following claims are available in the JWT specification.

+**iat** - The "iat" (issued at) claim identifies the time at which the JWT was issued.

+**exp** - The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing.

+**iss** - The "iss" (issuer) claim identifies the principal that issued the JWT.

+**jti** - The "jti" (JWT ID) claim provides a unique identifier for the JWT.

+**nbf** - The "nbf" (not before) claim identifies the time before which the JWT MUST NOT be accepted for processing.

+## EAT claims

+The complete definitions of the following claims are available in the EAT specification.

+**eat_profile** - The "eat_profile" claim identifies an EAT profile by either a URL or an OID.

+**dbgstat** - The "dbgstat" claim applies to entity-wide or submodule-wide debug facilities of the entity like [JTAG] and diagnostic hardware built into chips.

+**intuse** - The "intuse" claim provides an indication to an EAT consumer about the intended usage of the token.

+## TDX claims

+The complete definitions of the claims are available in the section A.3.2 TD Quote Body of [Intel® TDX DCAP Quoting Library API](https://download.01.org/intel-sgx/latest/dcap-latest/linux/docs/Intel_TDX_DCAP_Quoting_Library_API.pdf) specification.

+**tdx_mrsignerseam** - A 96-character hexadecimal string that represents a byte array of length 48 containing the measurement of the TDX module signer.

+**tdx_mrseam** - A 96-character hexadecimal string that represents a byte array of length 48 containing the measurement of the Intel TDX module.

+**tdx_mrtd** - A 96-character hexadecimal string that represents a byte array of length 48 containing the measurement of the initial contents of the TDX.

+**tdx_rtmr0** - A 96-character hexadecimal string that represents a byte array of length 48 containing the runtime extendable measurement register.

+**tdx_rtmr1** - A 96-character hexadecimal string that represents a byte array of length 48 containing the runtime extendable measurement register.

+**tdx_rtmr2** - A 96-character hexadecimal string that represents a byte array of length 48 containing the runtime extendable measurement register.

+**tdx_rtmr3** - A 96-character hexadecimal string that represents a byte array of length 48 containing the runtime extendable measurement register.

+**tdx_mrconfigid** - A 96-character hexadecimal string that represents a byte array of length 48 containing the software-defined ID for non-owner-defined configuration of the TDX, e.g., runtime or Operating System (OS) configuration.

+**tdx_mrowner** - A 96-character hexadecimal string that represents a byte array of length 48 containing the software-defined ID for the TDX's owner.

+**tdx_mrownerconfig** - A 96-character hexadecimal string that represents a byte array of length 48 containing the software-defined ID for owner-defined configuration of the TDX, e.g., specific to the workload rather than the runtime or OS.

+**tdx_report_data** - A 128-character hexadecimal string that represents a byte array of length 64. In this context, the TDX has the flexibility to include 64 bytes of custom data in a TDX Report. For instance, this space can be used to hold a nonce, a public key, or a hash of a larger block of data.

+**tdx_seam_attributes** - A 16 character hexadecimal string that represents a byte array of length 8 containing additional configuration of the TDX module.

+**tdx_tee_tcb_svn** - A 32 character hexadecimal string that represents a byte array of length 16 describing the Trusted Computing Base (TCB) Security Version Numbers (SVNs) of TDX.

+**tdx_xfam** - A 16 character hexadecimal string that represents a byte array of length 8 containing a mask of CPU extended features that the TDX is allowed to use.

+**tdx_seamsvn** - A number that represents the Intel TDX module SVN. The complete definition of the claim is available in section 3.1 SEAM_SIGSTRUCT: INTEL® TDX MODULE SIGNATURE STRUCTURE of [Intel® TDX Loader Interface Specification](https://cdrdv2.intel.com/v1/dl/getContent/733584)

+**tdx_td_attributes** - A 16 character hexadecimal string that represents a byte array of length 8. These are the attributes associated with the Trust Domain (TD). The complete definitions of the claims mentioned below are available in the section A.3.4. TD Attributes of [Intel® TDX DCAP Quoting Library API](https://download.01.org/intel-sgx/latest/dcap-latest/linux/docs/Intel_TDX_DCAP_Quoting_Library_API.pdf) specification.

+**tdx_td_attributes_debug** - A boolean value that indicates whether the TD runs in TD debug mode (set to 1) or not (set to 0). In TD debug mode, the CPU state and private memory are accessible by the host VMM.

+**tdx_td_attributes_key_locker** - A boolean value that indicates whether the TD is allowed to use Key Locker.

+**tdx_td_attributes_perfmon** - A boolean value that indicates whether the TD is allowed to use Perfmon and PERF_METRICS capabilities.

+**tdx_td_attributes_protection_keys** - A boolean value that indicates whether the TD is allowed to use Supervisor Protection Keys.

+**tdx_td_attributes_septve_disable** - A boolean value that determines whether to disable EPT violation conversion to #VE on TD access of PENDING pages.

+## Attester claims

+**attester_tcb_status** - A string value that represents the TCB level status of the platform being evaluated. See tcbStatus in [Intel® Trusted Services API Management Developer Portal](https://api.portal.trustedservices.intel.com/documentation).

+## Microsoft specific claims

+**x-ms-attestation-type** - A string value that represents the attestation type.

+**x-ms-policy-hash** - Hash of Azure Attestation evaluation policy computed as BASE64URL(SHA256(UTF8(BASE64URL(UTF8(policy text))))).

+**x-ms-runtime** - JSON object containing "claims" that are defined and generated within the attested environment. This is a specialization of the ΓÇ£enclave held dataΓÇ¥ concept, where the ΓÇ£enclave held dataΓÇ¥ is specifically formatted as a UTF-8 encoding of well formed JSON.

+**x-ms-ver** - JWT schema version (expected to be "1.0")

+}

+async def main(client: str):

+ durable_client = df.DurableOrchestrationClient(client)

+ await durable_client.raise_event(instance_id, "ApprovalEvent", is_approved)

+| **`rawBody`** | `string` | The body as a string. Despite the name, this property doesn't return a Buffer. |

+7. Click **Next** once you have completed providing the necessary configuration settings.

+ <!-- convertborder later -->

+ :::image type="content" source="media/agent-windows/log-analytics-mma-setup-laworkspace.png" lightbox="media/agent-windows/log-analytics-mma-setup-laworkspace.png" alt-text="paste Workspace ID and Primary Key" border="false":::<br><br>

+From the computer in **Control Panel**, find the item **Microsoft Monitoring Agent**. Select it, and on the **Azure Log Analytics** tab, the agent should display a message stating *The Microsoft Monitoring Agent has successfully connected to the Microsoft Operations Management Suite service.*

+<!-- convertborder later -->

+<!-- convertborder later -->

+<!-- convertborder later -->

+<!-- convertborder later -->

+<!-- convertborder later -->

+This article provides instructions and guidance for using the client installer for Azure Monitor Agent. It also explains how to use Data Collection Rules on Windows client devices.

+> This article provides specific guidance for installing the Azure Monitor agent on Windows client devices, subject to the [limitations](#limitations). For standard installation and management guidance for the agent, refer [the agent extension management guidance here](./azure-monitor-agent-manage.md)

+| Feature support | All features documented [here](./azure-monitor-agent-overview.md) | Features dependent on AMA agent extension that don't require more extensions. This includes support for Sentinel Windows Event filtering |

+1. The Windows client installer supports latest Windows machines only that are **Microsoft Entra joined** or Microsoft Entra hybrid joined. For more information, see the [prerequisites](#prerequisites).

+2. The Data Collection rules can only target the Microsoft Entra tenant scope. That is, all DCRs associated to the tenant (via Monitored Object) will apply to all Windows client machines within that tenant with the agent installed using this client installer. **Granular targeting using DCRs is not supported** for Windows client devices yet

+1. Download the Windows MSI installer for the agent using [this link](https://go.microsoft.com/fwlink/?linkid=2192409). You can also download it from **Monitor** > **Data Collection Rules** > **Create** experience on Azure portal (shown in the following screenshot):

+ <!-- convertborder later -->

+ :::image type="content" source="media/azure-monitor-agent-windows-client/azure-monitor-agent-client-installer-portal.png" lightbox="media/azure-monitor-agent-windows-client/azure-monitor-agent-client-installer-portal.png" alt-text="Diagram shows download agent link on Azure portal." border="false":::

+4. To install with custom file paths, [network proxy settings](./azure-monitor-agent-overview.md#proxy-configuration), or on a Non-Public Cloud use the following command with the values from the following table:

+The following image demonstrates how this works:

+<!-- convertborder later -->

+Then, proceed with the following instructions to create and associate them to a Monitored Object, using REST APIs or PowerShell commands.

+Since MO is a tenant level resource, the scope of the permission would be higher than a subscription scope. Therefore, an Azure tenant admin may be needed to perform this step. [Follow these steps to elevate Microsoft Entra tenant admin as Azure Tenant Admin](../../role-based-access-control/elevate-access-global-admin.md). It gives the Microsoft Entra admin 'owner' permissions at the root scope. This is needed for all methods described in the following section.

+This step creates the Monitored Object for the Microsoft Entra tenant scope. It's used to represent client devices that are signed with that Microsoft Entra tenant identity.

+| `AADTenantId` | path | string | ID of the Microsoft Entra tenant that the device(s) belong to. The MO is created with the same ID |

+| `location` | The Azure region where the MO object would be stored. It should be the **same region** where you created the Data Collection Rule. This region is the location where agent communications would happen. |

+The `SourceComputerId`, `Computer`, `ComputerIP` columns should all reflect the client device information respectively, and the `Category` column should say 'Azure Monitor Agent'. See the following example:

+<!-- convertborder later -->

+If you face issues during 'Uninstall', refer to the [troubleshooting guidance](#troubleshoot).

+* Export collected data to [Power BI](../logs/log-powerbi.md) for more visualizations and analysis.

+ > * For limits on the actions that can be performed, see [Azure subscription service limits](../../azure-resource-manager/management/azure-subscription-service-limits.md).

+ > * Search results were included in the payload of the triggered alert and its associated notifications. **Notice that**: The **email** included only **10 rows** from the unfiltered results while the **webhook payload** contained **1,000 unfiltered results**.

+## Troubleshooting

+If you have registered your cluster and/or configured HCI Insights before November, 2023, features that use the AMA agent on HCI, such as Arc for Servers Insights, VM Insights, Container Insights, Defender for Cloud or Sentinel may not be collecting logs and event data properly. See [Repair AMA agent for HCI](/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later) for steps to reconfigure the AMA agent and HCI Insights.

+> The **\_TimeReceived** column is calculate each time it is used. This process is resource intensive. Refrain from using it to filter large number of records. Using this function recurrently can lead to increased query execution duration.

+For Azure resources, the value of **__SubscriptionId** is the subscription part of the [Azure resource ID URL](../../azure-resource-manager/templates/template-functions-resource.md). The column is limited to Azure resources, including [Azure Arc](../../azure-arc/overview.md) resources, or to custom logs that indicated the Subscription ID during ingestion.

+In this article, you'll learn the steps to move a Log Analytics workspace to another resource group or subscription in the same region. To move a workspace across regions, see [Move a Log Analytics workspace to another region](./move-workspace-region.md).

+* Central US

+* Norway West

+The parameter value is validated based on the discriminated property value. In the preceeding example, if the *serviceConfig* parameter value is of type *foo*, it undergoes validation using the *FooConfig*type. Likewise, if the parameter value is of type *bar*, validation is performed using the *BarConfig* type, and this pattern continues for other types as well.

+- Any case where there is a need to minimize downtime

+| **SQL Server standalone instance** | Low | Migration is done using VMware vMotion, the database is available during migration time, but it isn't recommended to commit any critical data during it. |

+| **SQL Server Always On Availability Group** | Low | The primary replica will always be available during the migration of the first secondary replica and the secondary replica will become the primary after the initial failover to Azure. |

+| **SQL Server Always On Failover Customer Instance** | High | All nodes of the cluster are shutdown and migrated using VMware HCX Cold Migration. Downtime duration depends upon database size and private network speed to Azure cloud. |

+- Any case where there is a need to minimize downtime

+| **SQL Server standalone instance** | Low | Migration is done using VMware vMotion, the database is available during migration time, but it isn't recommended to commit any critical data during it. |

+| **SQL Server Always On Availability Group** | Low | The primary replica will always be available during the migration of the first secondary replica and the secondary replica will become the primary after the initial failover to Azure. |

+| **SQL Server Always On Failover Customer Instance** | High | All nodes of the cluster are shutdown and migrated using VMware HCX Cold Migration. Downtime duration depends upon database size and private network speed to Azure cloud. |

+- Any case where there is a need to minimize downtime

+| **SQL Server standalone instance** | Low | Migration is done using VMware vMotion, the database is available during migration time, but it isn't recommended to commit any critical data during it. |

+| **SQL Server Always On Availability Group** | Low | The primary replica will always be available during the migration of the first secondary replica and the secondary replica will become the primary after the initial failover to Azure. |

+| **SQL Server Always On Failover Customer Instance** | High | All nodes of the cluster are shutdown and migrated using VMware HCX Cold Migration. Downtime duration depends upon database size and private network speed to Azure cloud. |

+> There is no extra network resource (load balancer, network security group) created for simplified node communication pools without public IP addresses. Since the compute nodes in the pool are not bound to any load balancer, Azure may provide [Default Outbound Access](../virtual-network/ip-services/default-outbound-access.md). However, Default Outbound Access is not suitable for production workloads, and will be retired on September 30, 2025 (see the [official announcement](https://azure.microsoft.com/updates/default-outbound-access-for-vms-in-azure-will-be-retired-transition-to-a-new-method-of-internet-access/)). So if your workloads do require internet outbound access, or your pool doesn't use private endpoint to access Batch node management endpoint, you must provide your own solution to enable internet outbound access.

+|Get read receipts (20 participant limit**) |per User per chat thread|5|-|

+|Get read receipts (20 participant limit**) |per Chat thread|100|-|

+> ** Read receipts and typing indicators are not supported on chat threads with more than 20 participants.

+Azure Container Apps allows you to use Service Connector to connect to cloud services in just a few steps. Service Connector manages the configuration of the network settings and connection information between different services. To view all supported services, [learn more about Service Connector](../service-connector/overview.md#what-services-are-supported-by-service-connector).

+1. Navigate to your Azure Cosmos DB account and open the **Azure Synapse Link** under Integrations in the left pane.

+> Now you can enable Synapse Link on your existing MongoDB API collections, using Azure CLI or PowerShell.

+* [Create or update an Azure Cosmos DB MongoDB collection](/cli/azure/cosmosdb/mongodb/collection#az-cosmosdb-mongodb-collection-create-examples)

+* [Create or update an Azure Cosmos DB MongoDB collection](/powershell/module/az.cosmosdb/new-azcosmosdbmongodbcollection#description)

+Continuous backup mode supports two ways to restore deleted containers and databases. They can be restored into a [new account](restore-account-continuous-backup.md) as documented here or can be restored into an existing account as described [here](restore-account-continuous-backup.md). The choice between these two depends on the scenarios and impact. In most cases it is preferred to restore deleted containers and databases into an existing account to prevent the cost of data transfer which is required in the case they are restored to a new account. For scenarios where you have modified the data accidentally restore into new account could be the preferred option.

+* Currently Azure Synapse Link can be enabled, in preview, in continuous backup database accounts. The opposite situation isn't supported yet, it is not possible to turn on continuous backup in Synapse Link enabled database accounts. And analytical store isn't included in backups. For more information about backup and analytical store, see [analytical store backup](analytical-store-introduction.md#backup).

+* The capability to turn on Synapse Link in database accounts with continuous backup enabled is in preview now. The opposite situation, to turn on continuous backup in Synapse Link enabled database accounts, is still not supported yet.

+- [.NET RAG Pattern retail reference solution](https://github.com/Azure/Vector-Search-AI-Assistant-MongoDBvCore)

+- [.NET samples - Hackathon project](https://github.com/Azure/Build-Modern-AI-Apps-Hackathon)

+- [.NET RAG Pattern retail reference solution](https://github.com/Azure/Vector-Search-AI-Assistant-MongoDBvCore)

+Users with a Microsoft Customer Agreement must always [submit a request to set up pay by wire transfer](#submit-a-request-to-set-up-pay-by-wire-transfer) to Azure support to enable pay by wire transfer.

+Customers who have a Microsoft Online Services Program (pay-as-you-go) account can use the Azure portal to [request to pay by wire transfer](#request-to-pay-by-wire-transfer).

+> Currently only customers in the United States can get automatically approved to change their payment method to wire transfer. Support for other regions is being evaluated. If you are not in the United States, you must [submit a request to set up pay by wire transfer](#submit-a-request-to-set-up-pay-by-wire-transfer) to change your payment method.

+ - If the request couldn't be processed or if you're not approved, you need to follow the steps in the next section [Submit a request to set up pay by wire transfer](#submit-a-request-to-set-up-pay-by-wire-transfer).

+Use the following steps to switch a billing profile to wire transfer. Only the person who signed up for Azure can change the default payment method of a billing profile.

+**Include system columns:** If true, ```id```, ```_ts```, and other system columns are included in your data flow metadata from Azure Cosmos DB. When updating collections, it's important to include this so that you can grab the existing row ID.

+**Change feed:** If true, you'll get data from [Azure Cosmos DB change feed](../cosmos-db/change-feed.md), which is a persistent record of changes to a container in the order they occur from last run automatically. When you set it true, don't set both **Infer drifted column types** and **Allow schema drift** as true at the same time. For more information, see [Azure Cosmos DB change feed](#azure-cosmos-db-change-feed).

+**Start from beginning:** If true, you'll get initial load of full snapshot data in the first run, followed by capturing changed data in next runs. If false, the initial load will be skipped in the first run, followed by capturing changed data in next runs. The setting is aligned with the same setting name in [Azure Cosmos DB reference](https://github.com/Azure/azure-cosmosdb-spark/wiki/Configuration-references#reading-cosmosdb-collection-change-feed). For more information, see [Azure Cosmos DB change feed](#azure-cosmos-db-change-feed).

+* None: No action is done to the collection.

+* Recreate: The collection gets dropped and recreated

+- Azure Cosmos DB limits single request's size to 2 MB. The formula is "Request Size = Single Document Size * Batch Size". If you hit error saying "Request size is too large", reduce the batch size value.

+Azure Data Factory can get data from [Azure Cosmos DB change feed](../cosmos-db/change-feed.md) by enabling it in the mapping data flow source transformation. With this connector option, you can read change feeds and apply transformations before loading transformed data into destination datasets of your choice. You don't have to use Azure functions to read the change feed and then write custom transformations. You can use this option to move data from one container to another, prepare change feed driven material views for fit purpose or automate container backup or recovery based on change feed, and enable many more such use cases using visual drag and drop capability of Azure Data Factory.

+When you debug the pipeline, this feature works the same. The checkpoint will be reset when you refresh your browser during the debug run. After you're satisfied with the pipeline result from debug run, you can go ahead to publish and trigger the pipeline. At the moment when you first time trigger your published pipeline, it automatically restarts from the beginning or gets changes from now on.

+In the monitoring section, you always have the chance to rerun a pipeline. When you're doing so, the changed data is always captured from the previous checkpoint of your selected pipeline run.

+Using [PolyBase](/sql/relational-databases/polybase/polybase-guide) is an efficient way to load a large amount of data into Azure Synapse Analytics with high throughput. You'll see a large gain in the throughput by using PolyBase instead of the default BULKINSERT mechanism.

+This article outlines how to copy data to and from file system. To learn more, read the introductory article for [Azure Data Factory](introduction.md) or [Azure Synapse Analytics](../synapse-analytics/overview-what-is.md).

+1. Browse to the Manage tab in your Azure Data Factory or Synapse workspace and select Linked Services, then select New:

+| folderPath | The path to folder. If you want to use wildcard to filter folder, skip this setting and specify in activity source settings. You need to set up the file share location in your Windows or Linux environment to expose the folder for sharing. | No |

+| OPTION 3: client side filter<br>- wildcardFolderPath | The folder path with wildcard characters to filter source folders. Such filter happens within the service, which enumerates the folders/files under the given path then apply the wildcard filter.<br>Allowed wildcards are: `*` (matches zero or more characters) and `?` (matches zero or single character); use `^` to escape if your actual folder name has wildcard or this escape char inside. <br>See more examples in [Folder and file filter examples](#folder-and-file-filter-examples). | No |

+| OPTION 3: a list of files<br>- fileListPath | Indicates to copy a given file set. Point to a text file that includes a list of files you want to copy, one file per line, which is the relative path to the path configured in the dataset.<br/>When using this option, don't specify file name in dataset. See more examples in [File list examples](#file-list-examples). |No |

+| recursive | Indicates whether the data is read recursively from the subfolders or only from the specified folder. When recursive is set to true and the sink is a file-based store, an empty folder or subfolder isn't copied or created at the sink. <br>Allowed values are **true** (default) and **false**.<br>This property doesn't apply when you configure `fileListPath`. |No |

+| deleteFilesAfterCompletion | Indicates whether the binary files will be deleted from source store after successfully moving to the destination store. The file deletion is per file, so when copy activity fails, you'll see some files have already been copied to the destination and deleted from source, while others are still remaining on source store. <br/>This property is only valid in binary files copy scenario. The default value: false. |No |

+| modifiedDatetimeStart | Files filter based on the attribute: Last Modified. <br>The files are selected if their last modified time is greater than or equal to `modifiedDatetimeStart` and less than `modifiedDatetimeEnd`. The time is applied to UTC time zone in the format of "2018-12-01T05:00:00Z". <br> The properties can be NULL, which means no file attribute filter is applied to the dataset. When `modifiedDatetimeStart` has datetime value but `modifiedDatetimeEnd` is NULL, it means the files whose last modified attribute is greater than or equal with the datetime value are selected. When `modifiedDatetimeEnd` has datetime value but `modifiedDatetimeStart` is NULL, it means the files whose last modified attribute is less than the datetime value are selected.<br/>This property doesn't apply when you configure `fileListPath`. | No |

+| enablePartitionDiscovery | For files that are partitioned, specify whether to parse the partitions from the file path and add them as extra source columns.<br/>Allowed values are **false** (default) and **true**. | No |

+| partitionRootPath | When partition discovery is enabled, specify the absolute root path in order to read partitioned folders as data columns.<br/><br/>If it isn't specified, by default,<br/>- When you use file path in dataset or list of files on source, partition root path is the path configured in dataset.<br/>- When you use wildcard folder filter, partition root path is the subpath before the first wildcard.<br/><br/>For example, assuming you configure the path in dataset as "root/folder/year=2020/month=08/day=27":<br/>- If you specify partition root path as "root/folder/year=2020", copy activity generates two more columns `month` and `day` with value "08" and "27" respectively, in addition to the columns inside the files.<br/>- If partition root path isn't specified, no extra column is generated. | No |

+| false |preserveHierarchy | Folder1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File2<br/>&nbsp;&nbsp;&nbsp;&nbsp;Subfolder1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;File3<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;File4<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;File5 | The target folder Folder1 is created with the following structure<br/><br/>Folder1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File2<br/><br/>Subfolder1 with File3, File4, and File5 aren't picked up. |

+| false |mergeFiles | Folder1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File2<br/>&nbsp;&nbsp;&nbsp;&nbsp;Subfolder1<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;File3<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;File4<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;File5 | The target folder Folder1 is created with the following structure<br/><br/>Folder1<br/>&nbsp;&nbsp;&nbsp;&nbsp;File1 + File2 contents are merged into one file with autogenerated file name. autogenerated name for File1<br/><br/>Subfolder1 with File3, File4, and File5 aren't picked up. |

+To learn details about the properties, check [GetMetadata activity.](control-flow-get-metadata-activity.md)

+To learn details about the properties, check [Delete activity.](delete-activity.md)

+| fileName | **Name or wildcard filter** for the files under the specified "folderPath". If you don't specify a value for this property, the dataset points to all files in the folder. <br/><br/>For filter, allowed wildcards are: `*` (matches zero or more characters) and `?` (matches zero or single character).<br/>- Example 1: `"fileName": "*.csv"`<br/>- Example 2: `"fileName": "???20180427.txt"`<br/>Use `^` to escape if your actual file name has wildcard or this escape char inside.<br/><br/>When fileName isn't specified for an output dataset and **preserveHierarchy** isn't specified in the activity sink, the copy activity automatically generates the file name with the following pattern: "*Data.[activity run ID GUID].[GUID if FlattenHierarchy].[format if configured].[compression if configured]*", for example "Data.0a405f8a-93ff-4c6f-b3be-f69616f1df7a.txt.gz"; if you copy from tabular source using table name instead of query, the name pattern is "*[table name].[format].[compression if configured]*", for example "MyTable.csv". |No |

+| modifiedDatetimeStart | Files filter based on the attribute: Last Modified. The files are selected if their last modified time is greater than or equal to `modifiedDatetimeStart` and less than `modifiedDatetimeEnd`. The time is applied to UTC time zone in the format of "2018-12-01T05:00:00Z". <br/><br/> Be aware the overall performance of data movement are impacted by enabling this setting when you want to do file filter from huge amounts of files. <br/><br/> The properties can be NULL, which means no file attribute filter is applied to the dataset. When `modifiedDatetimeStart` has datetime value but `modifiedDatetimeEnd` is NULL, it means the files whose last modified attribute is greater than or equal with the datetime value are selected. When `modifiedDatetimeEnd` has datetime value but `modifiedDatetimeStart` is NULL, it means the files whose last modified attribute is less than the datetime value will be selected.| No |

+| modifiedDatetimeEnd | Files filter based on the attribute: Last Modified. The files are selected if their last modified time is greater than or equal to `modifiedDatetimeStart` and less than `modifiedDatetimeEnd`. The time is applied to UTC time zone in the format of "2018-12-01T05:00:00Z". <br/><br/> Be aware the overall performance of data movement are impacted by enabling this setting when you want to do file filter from huge amounts of files. <br/><br/> The properties can be NULL, which means no file attribute filter is applied to the dataset. When `modifiedDatetimeStart` has datetime value but `modifiedDatetimeEnd` is NULL, it means the files whose last modified attribute is greater than or equal with the datetime value are selected. When `modifiedDatetimeEnd` has datetime value but `modifiedDatetimeStart` is NULL, it means the files whose last modified attribute is less than the datetime value are selected.| No |

+| recursive | Indicates whether the data is read recursively from the subfolders or only from the specified folder. Note when recursive is set to true and sink is file-based store, empty folder/sub-folder won't be copied/created at sink.<br/>Allowed values are: **true** (default), **false** | No |

+You've reached the integration runtime's capacity limit. You might be running a large amount of data flow by using the same integration runtime at the same time. See [Azure subscription and service limits, quotas, and constraints](../azure-resource-manager/management/azure-subscription-service-limits.md#azure-data-factory-limits) for details.