Microsoft's edit · Entra changes

9595 * Customers can switch existing provisioning configurations from basic authentication to workload identity–based authentication directly through updated connectivity settings in the provisioning experience, without needing to recreate or restart their configuration.

9696 * This method removes the need to store long-lived credentials and uses a standards-based authentication method between Entra and SAP SuccessFactors through SAP Cloud Identity Services.

9797 This capability applies to the following provisioning scenarios:

98 −* [SAP SuccessFactors to Active Directory user provisioning](https://learn.microsoft.com/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial)

99 −* [SAP SuccessFactors to Microsoft Entra ID user provisioning](https://learn.microsoft.com/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial)

100 −* [SAP SuccessFactors writeback (Entra to SuccessFactors)](https://learn.microsoft.com/entra/identity/saas-apps/sap-successfactors-writeback-tutorial)

98 +* [SAP SuccessFactors to Active Directory user provisioning](../identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial.md)

99 +* [SAP SuccessFactors to Microsoft Entra ID user provisioning](../identity/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial.md)

100 +* [SAP SuccessFactors writeback (Entra to SuccessFactors)](../identity/saas-apps/sap-successfactors-writeback-tutorial.md)

101101

102102

103103 What this means for you

13411341 **Product capability:** Identity Security & Protection

13421342

13431343 Microsoft Security Copilot in Microsoft Entra now supports data exploration when prompts return datasets with more than 10 items. This feature is in preview and available for select Microsoft Entra scenarios. From the Copilot chat response, select **Open list** to access a comprehensive data grid. This allows you to explore large datasets with complete and accurate results, enabling more efficient decision-making. Each data grid displays the underlying Microsoft Graph URL, helping you verify query accuracy and build confidence in the results. For more information, see: [Microsoft Security Copilot scenarios in Microsoft Entra overview](../security-copilot/entra-security-scenarios.md).

1344 −

1345 −---

1346 −

1347 −## November 2025

1348 −

1349 −### Public Preview - Microsoft Entra ID Account Recovery

1350 −

1351 −**Type:** New feature

1352 −**Service category:** Verified ID

1353 −**Product capability:** Identity Security & Protection

1354 −

1355 −Microsoft Entra ID Account Recovery is an advanced authentication recovery mechanism that enables users to regain access to their organizational accounts when they've lost access to all registered authentication methods. Unlike traditional password reset capabilities, account recovery focuses on identity verification and trust re‑establishment prior to replacement of authentication methods rather than simple credential recovery. For more information, see: [Overview of Microsoft Entra ID Account Recovery](../identity/authentication/concept-account-recovery-overview.md).

1356 −

1357 −---

1358 −

1359 −### Public preview - Self-remediation for passwordless users

1360 −

1361 −**Type:** New feature

1362 −**Service category:** Identity Protection

1363 −**Product capability:** Identity Security & Protection

1364 −

1365 −**Self-remediation for passwordless users:** Risk-based access policies in Microsoft Entra Conditional Access now support self-remediation of risks across all authentication methods, including passwordless ones. This new control revokes compromised sessions in real-time, enables frictionless self-service, and reduces help-desk load. For more information, see: [Require risk remediation control](../id-protection/concept-identity-protection-policies.md#require-risk-remediation-control).

1366 −

1367 −---

1368 −

1369 −### General Availability - External ID regional expansion to Australia and Japan

1370 −

1371 −**Type:** New feature

1372 −**Service category:** B2C - Consumer Identity Management

1373 −**Product capability:** B2B/B2C

1374 −

1375 −We’re expanding Microsoft Entra External ID to **Australia** and **Japan** with **Go‑Local add‑on** that keeps External ID data **stored and processed in location**. This premium add‑on is selectable when you create a new External ID tenant and is designed for organizations with strict **data residency** requirements. A small set of centralized platform services remains global (e.g., some MFA/RBAC functions), with no change to security or compliance posture. **Get started:** Create a new tenant in **Australia** or **Japan** and opt in to the add‑on or contact your Microsoft representative to discuss options for your existing environment. For more information, see: [Microsoft Entra ID and data residency](data-residency.md)

1376 −

1377 −---

1378 −

1379 −### General Availability - New SCIM 2.0 SAP CIS connector available, with support for group provisioning

1380 −

1381 −**Type:** New feature

1382 −**Service category:** Enterprise Apps

1383 −**Product capability:** Outbound to SaaS Applications

1384 −

1385 −An updated SCIM 2.0 SAP Cloud Identity Services (CIS) connector was released to the Microsoft Entra app gallery on September 30, 2025. It replaces our previous SAP CIS provisioning integration and now provides support for provisioning and deprovisioning groups to SAP CIS, custom extension attributes, and the OAuth 2.0 Client Credentials grant. For more information, see: [Configure SAP Cloud Identity Services for automatic user provisioning with Microsoft Entra ID](../identity/saas-apps/sap-cloud-platform-identity-authentication-provisioning-tutorial.md).

1386 −

1387 −---

1388 −

1389 −### Public Preview - Externally determine the approval requirements for an access package using custom extensions

1390 −

1391 −**Type:** New feature

1392 −**Service category:** Entitlement Management

1393 −**Product capability:** Entitlement Management

1394 −

1395 −In Entitlement Management, approvers for access package assignment requests can either be directly assigned, or determined dynamically. Entitlement management natively supports dynamically determining approvers such as the requestors manager, their second-level manager, or a sponsor from a connected organization. With the introduction of this feature you can now use custom extensions for callouts to Azure Logic Apps and dynamically determine approval requirements for each access package assignment request based on your organizations specific business logic. The access package assignment request process will pause until your business logic hosted in Azure Logic Apps returns an approval stage which will then be leveraged in the subsequent approval process via the My Access portal. For more information, see: [Externally determine the approval requirements for an access package using custom extensions](../id-governance/entitlement-management-dynamic-approval.md).

1396 −

1397 −---

1398 −

1399 −### General Availability - Support for eligible group memberships and ownerships in Entitlement Management access packages

1400 −

1401 −**Type:** New feature

1402 −**Service category:** Entitlement Management

1403 −**Product capability:** Entitlement Management

1404 −

1405 −This integration between Entitlement Management and Privileged Identity Management (PIM) for Groups adds support for assigning eligible group memberships and ownerships via access packages. You are now able to govern these just-in-time access assignments at scale by offering a self-service access request & extension process and integrate them into your organization's role model. For more information, see: [Assign eligible group membership and ownership in access packages via Privileged Identity Management for Groups](../id-governance/entitlement-management-access-package-eligible.md).

1406 −

1407 −---

1408 −

1409 −### General Availability - Reprocess failed users and workflows in Lifecycle Workflows

1410 −

1411 −**Type:** New feature

1412 −**Service category:** Lifecycle Workflows

1413 −**Product capability:** Identity Governance

1414 −

1415 −Lifecycle Workflows now supports reprocessing of your workflows to help organizations streamline the reprocessing of workflows when errors or failures are discovered. This feature includes the ability to reprocess previous runs of workflows including failed runs or just runs that you may want to process again. Customers can choose from the following options to fit their needs:

1416 −

1417 −- Select specific workflow run to be reprocessed

1418 −- Select which users from the workflow run to be reprocessed e.g. failed users or all users from the run

1419 −

1420 −For more information, see [Reprocess workflows](../id-governance/reprocess-workflow.md).

1421 −

1422 −---

1423 −

1424 −### General Availability - Groups Purview sensitivity label support in Lifecycle Workflows

1425 −

1426 −**Type:** New feature

1427 −**Service category:** Lifecycle Workflows

1428 −**Product capability:** Identity Governance

1429 −

1430 −Customers can now view Purview sensitivity labels assigned to groups and Teams in Lifecycle Workflows. When configuring workflow tasks for managing group or Teams assignments, admins will now see actively assigned sensitivity labels to support informed group selection decisions. This helps customer achieve stronger organizational compliance. For more information see [Sensitivity Labels in Lifecycle Workflows](../id-governance/workflow-sensitivity-labels.md).

1431 −

1432 −---

1433 −

1434 −### General Availability - Trigger workflows for inactive employees and guests in Lifecycle Workflows

1435 −

1436 −**Type:** New feature

1437 −**Service category:** Lifecycle Workflows

1438 −**Product capability:** Identity Governance

1439 −

1440 −Lifecycle Workflows now enables customers to configure custom workflows to proactively manage dormant user accounts by automating identity lifecycle actions based on sign‑in inactivity. By detecting inactivity, the workflow automatically executes predefined tasks—such as sending notifications, disabling accounts, or initiating offboarding—when users exceed the inactivity threshold. Admins can configure the inactivity threshold and scope, ensuring dormant accounts are handled efficiently and consistently — reducing security exposure, reducing license waste, and enforcing governance policies at scale. For more information, see: [Manage inactive users using Lifecycle Workflows](../id-governance/lifecycle-workflow-inactive-users.md).

1441 −

1442 −---

1443 −

1444 −### Public Preview - Passkey profiles in Microsoft Entra ID

1445 −

1446 −**Type:** Changed feature

1447 −**Service category:** Authentications (Logins)

1448 −**Product capability:** User Authentication

1449 −

1450 −Microsoft Entra ID now supports group‑based passkey (FIDO2) configurations, enabling separate rollouts of different types of passkeys to different sets of users. For more information, see [How to Enable Passkey (FIDO2) Profiles in Microsoft Entra ID (Preview)](../identity/authentication/how-to-authentication-passkeys-fido2.md).

1451 −

1452 −---

1453 −

1454 −### Public Preview - Soft Deletion for Cloud Security Groups

1455 −

1456 −**Type:** New feature

1457 −**Service category:** Group Management

1458 −**Product capability:** Identity Security & Protection

1459 −

1460 −Soft deletion for cloud security groups introduces a safety mechanism that allows administrators to recover deleted groups within a **30‑day retention period**. When a cloud security group is deleted, it is not immediately removed from the directory; instead, it enters a soft‑deleted state, preserving its membership and configuration. This feature helps prevent accidental data loss and supports business continuity by enabling quick restoration of groups without requiring manual recreation. Administrators can restore soft‑deleted groups through the Microsoft Entra admin center or Microsoft Graph API during the retention window.

1461 −

1462 −---

1463 −

1464 −### Public Preview - End user experience for managing agent identities

1465 −

1466 −**Type:** New feature

1467 −**Service category:** Other

1468 −**Product capability:** End User Experiences

1469 −

1470 −The Manage agents end user experiences lets you view, and control, agent identities you own or sponsor. With the manage agents feature, you can easily see which agents you’re responsible for, review their details, and take action to enable, disable, or request access for them.

1471 −

1472 −---

1473 −

1474 −### Public Preview - Conditional Access for Agents

1475 −

1476 −**Type:** New feature

1477 −**Service category:** Conditional Access

1478 −**Product capability:** Identity Security & Protection

1479 −

1480 −Conditional Access for Agent ID is a new capability in Microsoft Entra ID that brings Conditional Access evaluation and enforcement to AI agents. This capability extends the same Zero Trust controls that already protect human users and apps to your agents. Conditional Access treats agents as first‑class identities and evaluates their access requests the same way it evaluates requests for human users or workload identities, but with agent‑specific logic.

1481 −

1482 −---

1483 −

1484 −### Public Preview - Agent identity sponsor lifecycle support in Lifecycle Workflows

1485 −

1486 −**Type:** New feature

1487 −**Service category:** Lifecycle Workflows

1488 −**Product capability:** Identity Governance

1489 −

1490 −Managing agent identity sponsors is key for lifecycle governance and access control of agent identities. Sponsors oversee agent identities' lifecycles and access. Lifecycle Workflows now automates and streamlines sponsor lifecycle management by notifying managers and co‑sponsors when a sponsor changes roles or leaves the organization. Keeping sponsor information accurate and current ensures effective governance and compliance. For more information, see: [Agent identity sponsor tasks in Lifecycle Workflows (Preview)](../id-governance/agent-sponsor-tasks.md).

1491 −

1492 −---

1493 −

1494 −### Public Preview - Microsoft Entra agent registry

1495 −

1496 −**Type:** New feature

1497 −**Service category:** Other

1498 −**Product capability:** Platform

1499 −

1500 −Microsoft Entra agent registry is a centralized metadata store of all deployed agents in an organization. As AI agents increasingly handle data retrieval, orchestration, and autonomous decision‑making, enterprises face rising security, compliance, and governance risks without clear visibility or control. Microsoft Entra agent registry, part of Microsoft Entra Agent ID, solves this by providing an extensible repository that delivers a unified view of every agent across Microsoft and non‑Microsoft ecosystems — enabling consistent discovery, governance, and secure collaboration at scale. For more information, see: [What is the Microsoft Entra Agent Registry?](../agent-id/what-is-agent-registry.md).

1501 −

1502 −---

1503 −

1504 −### Public Preview - User centric access reviews including disconnected applications

1505 −

1506 −**Type:** New feature

1507 −**Service category:** Access Reviews

1508 −**Product capability:** Identity Governance

1509 −

1510 −This capability enables organizations to manage access reviews for applications that are not yet integrated with Microsoft Entra ID. For more information, see: [Include custom data provided resource in the catalog for catalog user Access Reviews (Preview)](../id-governance/custom-data-resource-access-reviews.md).

1511 −

1512 −---

1513 −

1514 −### Public Preview - User centric access reviews

1515 −

1516 −**Type:** New feature

1517 −**Service category:** Access Reviews

1518 −**Product capability:** Identity Governance

1519 −

1520 −User centric access reviews (UAR) provide a user‑centric review model that lets reviewers view a user’s access across multiple resources in a catalog in one unified view, streamlining the process of ensuring the right access at the right time. Resources include Entra groups, and both connected and disconnected (BYOD) applications, providing customers with a consolidated, holistic review experience. For more information, see: [Catalog Access Reviews (Preview)](../id-governance/catalog-access-reviews.md).

1521 −

1522 −---

1523 −

1524 −### Public Preview - New experience for Entra account registration page on Windows

1525 −

1526 −**Type:** New feature

1527 −**Service category:** Device Registration and Management

1528 −**Product capability:** User Authentication

1529 −

1530 −We are introducing a new modernized user experience for the Entra account registration flow on Windows. The new user experience is updated to be consistent with Microsoft design patterns and splits the experience into two separate pages for registration and enrollment.

1531 −

1532 −We are also introducing a new admin property in public preview to control the MDM enrollment option in the account registration flow. This is targeted at customers who want to enable Windows MAM for their work or school accounts. The new setting controls the user experience screen for end users to MDM enroll in this flow. For more information, see: [Set up automatic enrollment for Windows devices](/intune/intune-service/enrollment/windows-enroll).

1533 −

1534 −---

1535 −

1536 −### Public preview - Microsoft Entra ID with Entra Kerberos has added support for cloud‑only identities

1537 −

1538 −**Type:** New feature

1539 −**Service category:** Authentications (Logins)

1540 −**Product capability:** User Authentication

1541 −

1542 −Microsoft Entra ID with Entra Kerberos has added support for cloud-only identities which allows Entra-joined session hosts to authenticate and access cloud resources like Azure file shares and Azure virtual desktop without relying on traditional Active Directory infrastructure. This capability is essential for organizations adopting a cloud-only strategy, as it removes the need for domain controllers while preserving enterprise-grade security, access control, and encryption. For more information, see: [Cloud only identity (Preview)](../identity/authentication/kerberos.md#cloud-only-identity-preview).

1543 −

1544 −---

1545 −

1546 −### Public preview - Microsoft Entra ID Protection for Agents

1547 −

1548 −**Type:** New feature

1549 −**Service category:** Identity Protection

1550 −**Product capability:** Identity Security & Protection

1551 −

1552 −As organizations adopt, build, and deploy autonomous AI agents, the need to monitor and protect those agents becomes critical. Microsoft Entra ID Protection helps protect your organization by automatically detecting and responding to identity‑based risks on agents that use the [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md) platform.

1553 −

1554 −---

1555 −

1556 −### Public Preview - Synced passkeys in Microsoft Entra ID

1557 −

1558 −**Type:** New feature

1559 −**Service category:** Authentications (Logins)

1560 −**Product capability:** User Authentication

1561 −

1562 −Microsoft Entra ID now supports synced passkeys stored in native and third‑party passkey providers. With this change, the passkey (FIDO2) authentication methods policy has been expanded to support group‑based configurations enabling separate rollouts of different types of passkeys. For more information on how to use this feature, see [How to Enable Synced Passkeys (FIDO2) in Microsoft Entra ID (Preview)](../identity/authentication/how-to-authentication-passkeys-fido2.md)

1563 −

1564 −---

1565 −

1566 −### Public Preview - Unified Entra App Gallery

1567 −

1568 −**Type:** New feature

1569 −**Service category:** Authentications (Login)

1570 −**Product capability:** User Authentication

1571 −

1572 −CA Scoping allows admins to bind specific CAs to defined user groups. This ensures that users can only authenticate using certificates from trusted sources scoped to them. This enhances compliance, and reduces exposure to mis-issued or rogue certificates. For more information, see: [Certificate Authority (CA) Scoping (Preview)](../identity/authentication/concept-certificate-based-authentication-technical-deep-dive.md#certificate-authority-ca-scoping).

1573 −

1574 −**Service category:** Enterprise Apps

1575 −**Product capability:** Access Control

1576 −

1577 −Microsoft is enhancing Global Secure Access (GSA) with Integrated App Risk Insights, now in Preview.

1578 −

1579 −This new capability unifies Global Secure Access and the Microsoft Entra App Gallery—which now includes applications and risk scores from Microsoft Defender for Cloud Apps—into one unified, risk-aware experience. It allows organizations to discover, assess, and protect all their applications directly within the Microsoft Entra Admin Center.

1580 −

1581 −With this integration, organizations can evaluate app risk in real time and enforce access policies based on that risk. Admins can view each app’s risk score, compliance data, and configuration (SSO and provisioning) in the Entra App Gallery, while GSA applies Conditional Access and session controls based on the app’s risk level.

1582 −

1583 −What Customers Can Do:

1584 −

1585 −- Discover applications across their environment through Global Secure Access telemetry, including unmanaged or shadow IT.

1586 −- Assess risk and compliance data in the Microsoft Entra app gallery.

1587 −- Enforce Conditional Access and session policies in GSA, using real-time risk signals.

1588 −

1589 −This integration unifies app discovery, risk intelligence, and policy enforcement across the Microsoft Entra ecosystem — reducing blind spots, simplifying governance, and strengthening protection for every cloud app in use.

1590 −

1591 −The experience is now available in Preview within the Microsoft Entra Admin Center. To access this capability, you will need one of the following licenses:

1592 −

1593 −- Microsoft Entra Suite License

1594 −- Microsoft Entra Internet Access License

1595 −

1596 −

1597 −To learn more, see:

1598 −- [Microsoft Entra documentation](/entra/)

1599 −

1600 −- [Microsoft Entra Global Secure Access](/entra/global-secure-access/)

1601 −

1602 −- [Microsoft Defender for Cloud Apps overview](/defender-cloud-apps/)

1603 −

1604 −---

1605 −

1606 −### General Availability - Protect enterprise GenAI applications with Prompt Injection Protection

1607 −

1608 −**Type:** New feature

1609 −**Service category:** Internet Access

1610 −**Product capability:** Network Access

1611 −

1612 −AI Gateway, part of Microsoft's Security Service Edge (SSE) solution, safeguards generative AI applications, agents, and language models. The Prompt Injection Protection capability provides real-time protection against malicious prompt injection attacks to enterprise GenAI apps, a top risk for LLMs. By enforcing guardrails at the network level, Prompt Injection Protection ensures consistent security across all generative AI applications without the need for code changes. For more information, see: [Protect enterprise generative AI applications with prompt injection protection](../global-secure-access/how-to-ai-prompt-injection-protection.md).

1613 −

1614 −---

1615 −

1616 −### Public Preview - GSA Cloud Firewall for Remote Networks for Internet Traffic

1617 −

1618 −**Type:** New feature

1619 −**Service category:** Internet Access

1620 −**Product capability:** Network Access

1621 −

1622 −Cloud Firewall (CFW), also known as Next Gen Firewall as a Service (FWaaS), can protect GSA customers from unauthorized egress access (like connections to the Internet networks) by monitoring and applying policies on the network traffic, providing centralized management, visibility, and consistent policies for branches. For more information, see: [Configure Global Secure Access cloud firewall (preview)](../global-secure-access/how-to-configure-cloud-firewall.md).

1623 −

1624 −---

1625 −

1626 −### Public Preview - Secure Web and AI Gateway for Microsoft Copilot Studio Agents

1627 −

1628 −**Type:** New feature

1629 −**Service category:** Internet Access

1630 −**Product capability:** Network Access

1631 −

1632 −As organizations adopt autonomous and interactive AI agents to perform tasks previously handled by humans, administrators need visibility and control over agent network activity. Global Secure Access for agents provides network security controls for Microsoft Copilot Studio agents, enabling you to apply the same security policies to agents that you use for users.

1633 −

1634 −With Global Secure Access for agents, you can regulate how agents use knowledge, tools, and actions to access external resources. You can apply network security policies including web content filtering, threat intelligence filtering, and network file filtering to agent traffic. For more information, see: [Learn about Secure Web And AI Gateway for Microsoft Copilot Studio agents (preview)](../global-secure-access/concept-secure-web-ai-gateway-agents.md).

1635 −

1636 −---

1637 −

1638 −### Public preview - Internet traffic support over GSA remote network connectivity

1639 −

1640 −**Type:** New feature

1641 −**Service category:** Internet Access

1642 −**Product capability:** Network Access

1643 −

1644 −Remote Network Connectivity enables secure, _clientless_ access to Microsoft 365 and internet resources from branch offices via IPsec tunnels. While Microsoft 365 traffic support is generally available, full internet access has now gone to public preview. Supporting full internet traffic was the top requests from remote network connectivity customers, including our own MSIT. For more information, see: [How to create a remote network with Global Secure Access](../global-secure-access/how-to-create-remote-networks.md).

1645 −

1646 −---

1647 −

1648 −### General Availability - GSA + Netskope ATP & DLP integration

1649 −

1650 −**Type:** New feature

1651 −**Service category:** Internet Access

1652 −**Product capability:** Network Access

1653 −

1654 −In today's evolving threat landscape, organizations face challenges protecting sensitive data and systems from cyber attacks. Global Secure Access combines Entra Internet Access protections with Netskope's Advanced Threat Protection (ATP) and Data Loss Prevention (DLP) capabilities to deliver real-time protection against malware, zero-day vulnerabilities, and data leaks, and simplifies management through a unified platform. Microsoft’s SSE solution adopts an open platform approach, enabling integration with third-party companies, with Netskope being the first. For more information, see: [Global Secure Access integration with Netskope's Advanced Threat Protection and Data Loss Prevention](../global-secure-access/concept-netskope-integration.md).

1655 −

1656 −---

1657 −

1658 −### Public Preview - Entitlement Management Introduces Additional Approval Flows for Risky Users’ Access Package Requests Based on IRM and IDP Risk Signals

1659 −

1660 −**Type:** Changed feature

1661 −**Service category:** Entitlement Management

1662 −**Product capability:** Entitlement Management

1663 −

1664 −Entitlement Management now supports risk-based approval escalation. When a user requesting an access package is flagged by Insider Risk Management or Identity Protection as requiring additional scrutiny, the request is automatically routed to designated security approvers for an extra approval step before access is granted. For more information see:

1665 −

1666 −IDP- [Configure ID Protection-based approvals for access package requests in Entitlement Management (Preview)](../id-governance/entitlement-management-configure-id-protection-approvals.md)

1667 −

1668 −IRM- [Configure Insider risk management-based approvals for access package requests in Entitlement Management (Preview)](../id-governance/entitlement-management-configure-insider-risk-management-approvals.md)

1669 −

1670 −---

1671 −

1672 −### General Availability - Microsoft Entra Internet Access TLS Inspection

1673 −

1674 −**Type:** Changed feature

1675 −**Service category:** Internet Access

1676 −**Product capability:** Network Access

1677 −

1678 −Transport Layer Security (TLS) Inspection for Microsoft Entra Internet Access is now generally available, delivering deep visibility into encrypted traffic and advanced security controls.

1679 −

1680 −TLS Inspection provides the foundation for user-friendly block messages, full URL filtering, file policy enforcement, and prompt inspection with AI Gateway.

1681 −

1682 −Organizations can define flexible TLS inspection policies to specify which traffic to inspect, and which users or devices policies apply to. Custom rules offer granular control to intercept or bypass traffic based on destination FQDNs or web categories, while traffic logs provide detailed insights into matched policies and rules. Learn more from [What is Transport Layer Security Inspection?](../global-secure-access/concept-transport-layer-security.md).

1683 −

1684 −---

1685 −

1686 −### Public Preview - URL Filtering

1687 −

1688 −**Type:** New feature

1689 −**Service category:** Internet Access

1690 −**Product capability:** Network Access

1691 −

1692 −This public preview allows you to configure URL filtering rules to granularly deny or allow access to full URLs (including hostname and full path). These rules are part of the existing web content filtering policy schema that allows security policies to become context-aware by linking a policy to a security profile to a conditional access policy. For more information, see: [How to configure Global Secure Access web content filtering](../global-secure-access/how-to-configure-web-content-filtering.md).

16931344

16941345 ---

Entra changes

Microsoft's edit · 15 Jun 20:44 UTC