Microsoft Entra FAQ (admin center URLs)
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 41b0152 · +58 −99 lines · also on GitHub
⋯ 11 unchanged lines
1212
title: Frequently asked questions about Microsoft Entra ID
1313
summary: |
1414
Microsoft Entra ID is a cloud-based identity and access management solution. It's a directory and identity management service that operates in the cloud and offers authentication and authorization services to various Microsoft services, such as Microsoft 365, Dynamics 365, and Microsoft Azure.
15
−␣␣
15
+
1616
For more information, see [What is Microsoft Entra ID?](./whatis.md)
17
−
18
−
1917
2018
sections:
2119
- name: Help with accessing Microsoft Entra ID and Azure
⋯ 11 unchanged lines
3331
What's the relationship between Microsoft Entra ID, Microsoft Azure, and other Microsoft services, such as Microsoft 365?
3432
answer: |
3533
Microsoft Entra ID provides you with common identity and access capabilities to all web services. Whether you're using Microsoft services, such as Microsoft 365, Power Platform, Dynamics 365, or other Microsoft products, you're already using Microsoft Entra ID to help turn on sign-on and access management for all cloud services.
36
−␣␣␣␣␣␣␣␣␣␣
34
+
3735
All users who are set up to use Microsoft services are defined as user accounts in one or more Microsoft Entra instances, providing these accounts access to Microsoft Entra ID.
38
−␣␣␣␣␣␣␣␣␣␣
36
+
3937
For more information, see [Microsoft Entra ID Plans & Pricing](https://www.microsoft.com/security/business/microsoft-entra-pricing)
4038
41
− Microsoft Entra paid services, such as Enterprise Mobility + Security (EMS) complement other Microsoft services like Microsoft 365, with comprehensive enterprise-scale development, management and security solutions.
42
−
43
− For more information, see [The Microsoft Cloud](/microsoft-cloud).
44
−
39
+ Microsoft Entra paid services, such as Enterprise Mobility + Security (Microsoft Enterprise Mobility + Security) complement other Microsoft services like Microsoft 365, with comprehensive enterprise-scale development, management and security solutions.
4540
41
+ For more information, see The [Microsoft Cloud](/microsoft-cloud).
4642
4743
- question: |
4844
What are the differences between Owner and Global Administrator?
4945
answer: |
5046
By default, the person who signs up for a Microsoft Entra or Azure subscription is assigned the Owner role for Azure resources. An Owner can use either a Microsoft account or a work or school account from the directory that the Microsoft Entra or Azure subscription is associated with. This role is also authorized to manage services in the Azure portal.
51
−␣␣␣␣␣␣␣␣␣␣
47
+
5248
If others need to sign in and access services by using the same subscription, you can assign them the appropriate [built-in role](/azure/role-based-access-control/built-in-roles). For more information, see [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal).
5349
5450
By default, the person who signs up for a Microsoft Entra or Azure subscription is assigned the Global Administrator role for the directory. The Global Administrator has access to all Microsoft Entra directory features. Microsoft Entra ID has a different set of administrator roles to manage the directory and identity-related features. These administrators will have access to various features in the Azure portal. The administrator's role determines what they can do, like create or edit users, assign administrative roles to others, reset user passwords, manage user licenses, or manage domains.
5551
5652
For more information, see [Assign a user to administrator roles in Microsoft Entra ID](./how-subscriptions-associated-directory.yml) and [Assigning administrator roles in Microsoft Entra ID](~/identity/role-based-access-control/permissions-reference.md).
5753
58
−
59
−
6054
- question: |
6155
Is there a report that shows when my Microsoft Entra user licenses will expire?
6256
answer: |
6357
No. This isn't currently available.
64
−
65
−
66
−
58
+
6759
- question: |
6860
How can I allow Microsoft Entra admin center URLs on my firewall or proxy server?
6961
7062
answer: |
71
− To optimize connectivity between your network and the Microsoft Entra admin center and its services, you may want to add specific Microsoft Entra admin center URLs to your allowlist. Doing so can improve performance and connectivity between your local- or wide-area network. Network administrators often deploy proxy servers, firewalls, or other devices, which can help secure and give control over how users access the internet. Rules designed to protect users can sometimes block or slow down legitimate business-related internet traffic. This traffic includes communications between you and Microsoft Entra admin center over the following URLs:
72
−␣␣␣␣␣␣␣␣␣
63
+ To optimize connectivity between your network and the Microsoft Entra admin center and its services, you might want to add specific Microsoft Entra admin center URLs to your allowlist. Doing so can improve performance and connectivity between your local- or wide area network. Network administrators often deploy proxy servers, firewalls, or other devices, which can help secure and give control over how users access the internet. Rules designed to protect users can sometimes block or slow down legitimate business-related internet traffic. This traffic includes communications between you and Microsoft Entra admin center over the following URLs:
64
+
7365
* *.entra.microsoft.com
7466
* *.entra.microsoft.us
7567
* *.entra.microsoft.scloud
7668
* *.entra.microsoft.eaglex.ic.gov
77
− * *.entra.microsoftonline.cn
78
−␣␣␣␣
69
+ * *.entra.microsoftonline.cn
70
+
7971
For more information, see [Using Microsoft Entra application proxy to publish on-premises apps for remote users](~/identity/app-proxy/overview-what-is-app-proxy.md). Additional URLs that you should include are listed in the article [Allow the Azure portal URLs on your firewall or proxy server](/azure/azure-portal/azure-portal-safelist-urls).
8072
81
−
82
−
8373
- name: Help with hybrid Microsoft Entra ID
8474
questions:
8575
- question: |
8676
How do I leave a tenant when I'm added as a collaborator?
8777
answer: |
88
− You can usually leave an organization on your own without having to contact an administrator. However, in some cases this option won't be available and you'll need to contact your tenant admin, who can delete your account in the external organization.
89
−␣␣␣␣␣␣␣␣␣
78
+ You can usually leave an organization on your own without having to contact an administrator. However, in some cases this option won't be available and you'll need to contact your tenant admin, who can delete your account in the external organization.
79
+
9080
For more information, see [Leave an organization as an external user](~/external-id/leave-the-organization.md).
91
−
92
−
93
−
81
+
9482
- question: |
9583
How can I connect my on-premises directory to Microsoft Entra ID?
9684
answer: |
9785
You can connect your on-premises directory to Microsoft Entra ID by using Microsoft Entra Connect.
98
−␣␣␣␣␣␣␣␣␣␣
86
+
9987
For more information, see [Integrating your on-premises identities with Microsoft Entra ID](~/identity/hybrid/whatis-hybrid-identity.md).
100
−
101
−
102
−
88
+
10389
- question: |
10490
How do I set up SSO between my on-premises directory and my cloud applications?
10591
answer: |
10692
You only need to set up single sign-on (SSO) between your on-premises directory and Microsoft Entra ID. As long as you access your cloud applications through Microsoft Entra ID, the service automatically drives your users to correctly authenticate with their on-premises credentials.
107
−␣␣␣␣␣␣␣␣␣␣
93
+
10894
Implementing SSO from on-premises can be easily achieved with federation solutions such as Active Directory Federation Services (AD FS), or by configuring password hash sync. You can easily deploy both options by using the Microsoft Entra Connect configuration wizard.
109
−␣␣␣␣␣␣␣␣␣␣
95
+
11096
For more information, see [Integrating your on-premises identities with Microsoft Entra ID](~/identity/hybrid/whatis-hybrid-identity.md).
111
−
112
−
113
−
97
+
11498
- question: |
11599
Does Microsoft Entra ID provide a self-service portal for users in my organization?
116100
answer: |
117101
Yes, Microsoft Entra ID provides you with the [Microsoft Entra ID Access Panel](https://myapps.microsoft.com) for user self-service and application access. If you're a Microsoft 365 customer, you can find many of the same capabilities in the [Office 365 portal](https://portal.office.com).
118
−␣␣␣␣␣␣␣␣␣␣
102
+
119103
For more information, see [Introduction to the Access Panel](https://support.microsoft.com/account-billing/sign-in-and-start-apps-from-the-my-apps-portal-2f3b1bae-0e5a-4a86-a33e-876fbd2a4510).
120
−
121
−
122
−
104
+
123105
- question: |
124106
Does Microsoft Entra ID help me manage my on-premises infrastructure?
125107
answer: |
126
− Yes. The Microsoft Entra ID P1 or P2 edition provides you with Microsoft Entra Connect Health. Microsoft Entra Connect Health helps you monitor and gain insight into your on-premises identity infrastructure and the synchronization services.
127
−
128
− For more information, see [Monitor your on-premises identity infrastructure and synchronization services in the cloud](~/identity/hybrid/connect/whatis-azure-ad-connect.md).
129
−
130
−
108
+ Yes. The Microsoft Entra ID P1 or P2 edition provides you with Microsoft Entra Connect Health. Microsoft Entra Connect Health helps you monitor and gain insight into your on-premises identity infrastructure and the synchronization services.
109
+
110
+ For more information, see [Monitor your on-premises identity infrastructure and synchronization services in the cloud](~/identity/hybrid/connect/whatis-azure-ad-connect.md).
111
+
131112
- name: Help with password management
132113
questions:
133114
- question: |
134
− Can I use Microsoft Entra password write-back without password sync?
115
+ Can I use Microsoft Entra password write-back without password sync?
135116
answer: |
136117
(For example, is it possible to use Microsoft Entra self-service password reset (SSPR) with password write-back and not store passwords in the cloud?)
137
−
138
− This example scenario doesn't require the on-premises password to be tracked in Microsoft Entra. This is because you don't need to synchronize your Active Directory passwords to Microsoft Entra ID to enable write-back. In a federated environment, Microsoft Entra single sign-on (SSO) relies on the on-premises directory to authenticate the user.
139
−
140
−
141
−
118
+
119
+ This example scenario doesn't require the on-premises password to be tracked in Microsoft Entra. This is because you don't need to synchronize your Active Directory passwords to Microsoft Entra ID to enable write-back. In a federated environment, Microsoft Entra single sign-on (SSO) relies on the on-premises directory to authenticate the user.
120
+
142121
- question: |
143122
How long does it take for a password to be written back to Active Directory on-premises?
144123
answer: |
145124
Password write-back operates in real time.
146
−␣␣␣␣␣␣␣␣␣␣
125
+
147126
For more information, see [Getting started with password management](~/identity/authentication/tutorial-enable-sspr.md).
148
−
149
−
150
−
127
+
151128
- question: |
152129
Can I use password write-back with passwords that are managed by an admin?
153130
answer: |
154
− Yes, if you have password write-back enabled, the password operations performed by an admin are written back to your on-premises environment.
155
−␣␣␣␣␣␣␣␣␣␣
131
+ Yes, if you have password write-back enabled, the password operations performed by an admin are written back to your on-premises environment.
132
+
156133
For more answers to password-related questions, see [Password management frequently asked questions](~/identity/authentication/passwords-faq.yml).
157
−
158
−
159
−
134
+
160135
- question: |
161136
What can I do if I can't remember my existing Microsoft 365 / Microsoft Entra password while trying to change my password?
162137
answer: |
163138
For the above scenario, there are a couple of options. You can use the self-service password reset (SSPR) if it's available. Whether SSPR works depends on how it's configured. For more information about resetting Microsoft Entra passwords, see [How does the password reset portal work](~/identity/authentication/howto-sspr-deployment.md).
164
−␣␣␣␣␣␣␣␣␣␣
139
+
165140
For Microsoft 365 users, your admin can reset the password by using the steps outlined in [Reset user passwords](https://support.office.com/article/Admins-Reset-user-passwords-7A5D073B-7FAE-4AA5-8F96-9ECD041ABA9C?ui=en-US&rs=en-US&ad=US).
166
−␣␣␣␣␣␣␣␣␣␣
141
+
167142
For Microsoft Entra accounts, admins can reset passwords by using one of the following:
168143
169144
- [Reset a user's password using Microsoft Entra ID](./users-reset-password-azure-portal.yml)
170145
- [Reset a password using PowerShell](/powershell/module/microsoft.graph.users.actions/reset-mguserauthenticationmethodpassword)
171
−
172
−
173
−
146
+
174147
- name: Help with security
175148
questions:
176149
- question: |
⋯ 17 unchanged lines
194167
Where can I find a list of applications that are pre-integrated with Microsoft Entra ID and their capabilities?
195168
answer: |
196169
Microsoft Entra ID has more than 2,600 pre-integrated applications from Microsoft, application service providers, and partners. All pre-integrated applications support single sign-on (SSO). SSO lets you use your organizational credentials to access your apps. Some of the applications also support automated provisioning and de-provisioning.
197
−␣␣␣␣␣␣␣␣␣␣
170
+
198171
For a complete list of the pre-integrated applications, see the [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/Microsoft.AzureActiveDirectory).
199
−
200
−
201
−
172
+
202173
- question: |
203174
What if the application I need is not in the Microsoft Entra marketplace?
204175
answer: |
205
− With Microsoft Entra ID P1 or P2, you can add and configure any application that you want. Depending on your application's capabilities and your preferences, you can configure SSO and automated provisioning.
206
−␣␣␣␣␣␣␣␣␣␣
176
+ With Microsoft Entra ID P1 or P2, you can add and configure any application that you want. Depending on your application's capabilities and your preferences, you can configure SSO and automated provisioning.
177
+
207178
For more information, see [Single sign-on SAML protocol](~/identity-platform/single-sign-on-saml-protocol.md) and [Develop and plan provisioning for a SCIM endpoint](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md).
208
−
209
−
210
−
179
+
211180
- question: |
212181
How do users sign in to applications using Microsoft Entra ID?
213182
answer: |
214183
Microsoft Entra ID provides several ways for users to view and access their applications, such as:
215
−␣␣␣␣␣␣␣␣␣␣
184
+
216185
* The [Microsoft Entra access panel](https://entra.microsoft.com/#home)
217186
* The Microsoft 365 application launcher
218187
* Direct sign-in to federated apps
219188
* Deep links to federated, password-based, or existing apps
220
−␣␣␣␣␣␣␣␣␣␣
189
+
221190
For more information, see [End user experiences for applications](~/identity/enterprise-apps/end-user-experiences.md).
222
−
223
−
224
−
191
+
225192
- question: |
226193
What are the different ways Microsoft Entra ID enables authentication and single sign-on to applications?
227194
answer: |
228
− Microsoft Entra ID supports many standardized protocols for authentication and authorization, such as SAML 2.0, OpenID Connect, OAuth 2.0, and WS-Federation. Microsoft Entra ID also supports password vaulting and automated sign-in capabilities for apps that only support forms-based authentication.
229
−␣␣␣␣␣␣␣␣␣␣
195
+ Microsoft Entra ID supports many standardized protocols for authentication and authorization, such as SAML 2.0, OpenID Connect, OAuth 2.0, and WS-Federation. Microsoft Entra ID also supports password vaulting and automated sign-in capabilities for apps that only support forms-based authentication.
196
+
230197
For more information, see [Identity fundamentals](~/fundamentals/identity-fundamental-concepts.md) and [Single sign-on for applications in Microsoft Entra ID](~/identity/enterprise-apps/what-is-single-sign-on.md).
231
−
232
−
233
−
198
+
234199
- question: |
235200
Can I add applications that I'm running on-premises?
236201
answer: |
237
− [Microsoft Entra application proxy](/entra/identity/app-proxy) provides you with easy and secure access to on-premises web applications that you choose. You can access these applications in the same way that you access your software as a service (SaaS) apps in Microsoft Entra ID. There's no need for a VPN or to change your network infrastructure.
238
−␣␣␣␣␣␣␣␣␣␣
202
+ [Microsoft Entra application proxy](/entra/identity/app-proxy) provides you with easy and secure access to on-premises web applications that you choose. You can access these applications in the same way that you access your software as a service (SaaS) apps in Microsoft Entra ID. There's no need for a VPN or to change your network infrastructure.
203
+
239204
For more information, see [How to provide secure remote access to on-premises applications](/entra/identity/app-proxy).
240
−
241
−
242
−
205
+
243206
- question: |
244207
How do I require multifactor authentication for users who access a particular application?
245208
answer: |
246
− With [Microsoft Entra Conditional Access](~/identity/conditional-access/overview.md), you can assign a unique access policy for each application. In your policy, you can require multifactor authentication always, or when users aren't connected to the local network.
247
−␣␣␣␣␣␣␣␣␣␣
209
+ With [Microsoft Entra Conditional Access](~/identity/conditional-access/overview.md), you can assign a unique access policy for each application. In your policy, you can require multifactor authentication always, or when users aren't connected to the local network.
210
+
248211
For more information, see [Securing access to Microsoft 365 and other apps connected to Microsoft Entra ID](~/identity/conditional-access/overview.md).
249
−
250
−
251
−
212
+
252213
- question: |
253214
What is automated user provisioning for SaaS apps?
254215
answer: |
255216
Use Microsoft Entra ID to automate the creation, maintenance, and removal of user identities in many popular cloud SaaS apps.
256
−␣␣␣␣␣␣␣␣␣␣
217
+
257218
For more information, see [What is app provisioning in Microsoft Entra ID?](~/identity/app-provisioning/user-provisioning.md).
258
−
259
−
260
−
219
+
261220
- question: |
262221
Can I set up a secure LDAP connection with Microsoft Entra ID?
263222
answer: |
264
− No. Microsoft Entra ID doesn't support the Lightweight Directory Access Protocol (LDAP) protocol or Secure LDAP directly. However, it's possible to enable Microsoft Entra Domain Services instance on your Microsoft Entra tenant with properly configured network security groups through Azure Networking to achieve LDAP connectivity.
265
−␣␣␣␣␣␣␣␣␣␣␣
223
+ No. Microsoft Entra ID doesn't support the Lightweight Directory Access Protocol (LDAP) protocol or Secure LDAP directly. However, it's possible to enable Microsoft Entra Domain Services instance on your Microsoft Entra tenant with properly configured network security groups through Azure Networking to achieve LDAP connectivity.
224
+
266225
For more information, see [Configure secure LDAP for a Microsoft Entra Domain Services managed domain](/entra/identity/domain-services/tutorial-configure-ldaps).
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:03 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.