Entra changes
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2b2220f · +5 −25 lines · also on GitHub
⋯ 37 unchanged lines
3838
**Service category:** Authentications (Logins)
3939
**Product capability:** User Authentication
4040
41
−General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to attempt decryption with both primary and secondary Kerberos keys, improving resiliency during key rollover operations and reducing authentication disruption during rotation events.
41
+General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to attempt decryption with both primary and secondary Kerberos keys, improving resiliency during key rollover operations and reducing authentication disruption during rotation events. For more information, see: [Rotate the Kerberos server key for Microsoft Entra Kerberos](../identity/authentication/kerberos-server-key-rotation.md).
4242
4343
---
4444
⋯ 3 unchanged lines
4848
**Service category:** BYOD
4949
**Product capability:** Network Access
5050
51
−We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable **users and partners** to access corporate resources from their own devices. Administrators can assign the **Private Application** traffic profile to users with internal accounts, including **internal guest users**. This removes the previous requirement for Windows devices to be domain-joined.
51
+We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable **users and partners** to access corporate resources from their own devices. Administrators can assign the **Private Application** traffic profile to users with internal accounts, including **internal guest users**. This removes the previous requirement for Windows devices to be domain-joined. For more information, see: [Bring Your Own Device](../global-secure-access/concept-bring-your-own-device.md).
5252
5353
---
5454
⋯ 20 unchanged lines
7575
- **Require compliant devices** for agents running on managed endpoints, including **Windows 365 for Agents**, ensuring agents can only operate from devices that meet your organization's compliance requirements.
7676
- **Apply device platforms, filter for devices and compliant network conditions** to agents running on endpoints, enabling policies based on device state and trusted network locations.
7777
78
−These capabilities extend Zero Trust protections to agent's user accounts while leveraging the familiar Conditional Access policy experience.
79
−
80
−---
81
−
82
−### Private Preview - PIM Only Mode for Azure
83
−
84
−**Type:** New feature
85
−**Service category:** Privileged Identity Management
86
−**Product capability:** Privileged Identity Management
87
−
88
−**PIM only mode** is a security control that enforces **all Azure RBAC role assignment management to be performed through Microsoft Entra Privileged Identity Management (PIM)** or an approved set of applications. Any role assignment that is created or updated outside of PIM is **blocked** and **flagged as non-compliant**.
89
−
90
−The control is implemented via **Azure Policy** and can be applied at **subscription** or **management group** scope.
91
−
92
−Many security guardrails — such as **disallowing permanent eligible or permanent active assignments**, **setting expiration on eligible and active assignments**, **requiring Azure MFA on active assignment**, and **requiring justification on active assignment** — are configured in **PIM policies**. Those guardrails only apply when role assignments flow through PIM. If an admin creates a role assignment directly (for example, via the RBAC blade, Azure CLI, ARM, or scripts), the PIM assignment-settings controls are bypassed.
93
−
94
−PIM only mode closes that gap by ensuring:
95
−
96
−- All Azure RBAC role assignments — whether new or modified — must be created through PIM or an explicitly approved application.
97
−- All PIM **assignment-settings** are uniformly applied across the scope.
98
−- Out-of-band assignments are visible as non-compliant resources in Azure Policy.
78
+These capabilities extend Zero Trust protections to agent's user accounts while leveraging the familiar Conditional Access policy experience. For more information see: [Target agent identities in Conditional Access policies](../identity/conditional-access/howto-target-agent-identities.md).
9979
10080
---
10181
⋯ 13 unchanged lines
11595
**Service category:** Provisioning
11696
**Product capability:** Identity Lifecycle Management
11797
118
−SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification.
98
+SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see: [Enable the SCIM Provisioning API in Microsoft Entra ID](../identity/app-provisioning/enable-scim-api.md).
11999
120100
---
121101
⋯ 7 unchanged lines
129109
130110
At preview, Entra Backup and Recovery automatically takes daily backup of a tenant's supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for 7 days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.
131111
132
−This gives your organization a reliable, built-in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises.
112
+This gives your organization a reliable, built-in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises. For more information, see: [Microsoft Entra Backup and Recovery overview (Preview)](../backup/overview.md).
133113
134114
---
135115
⋯ 1241 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.