Entra 🆔 News #60 → This week in Microsoft Entra
Entra 🆔 News #60 → This week in Microsoft Entra
Learn about Microsoft switching from SailPoint to Entra ID Governance 😎, upcoming breaking changes 🙅♂️, Kerberos SSO to on-prem AD in macOS 🍎💻, changes to the Sync account role and more!
👋 Hi, Merill and Joshua here with this week’s roundup of the latest news on Microsoft Entra from around the globe 🌍 .
A quick shoutout to everyone in Australia 🦘🇦🇺 who is celebrating Father’s day today.
Here’s a neat little tidbit: While the most popular date for Father's Day internationally is the third Sunday in June, Australia decided to move the date so that it wouldn't be celebrated during the cold of Australian winter. The first Sunday in spring was therefore chosen, giving Aussie families the opportunity to celebrate outdoors with a barbecue.
Enjoy!
⚡️ Microsoft
Microsoft Security implements Microsoft Entra ID Governance and saves over $1.5 million per year
The Digital Security and Resilience team at Microsoft switches from SailPoint IIQ to Microsoft Entra ID.
🏆 General Availability
Restricted permissions on Directory Synchronization Accounts (DSA) role in Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync - As part of ongoing security hardening, we've removed unused permissions from the privileged "Directory Synchronization Accounts" role. This role is exclusively used by Microsoft Entra Connect Sync, and Microsoft Entra Cloud Sync, to synchronize Active Directory objects with Microsoft Entra ID. There's no action required by customers to benefit from this hardening, and the revised role permissions are documented here → Directory Synchronization Accounts.
🔥 Public Preview
Provisioning UX Updates - We'll start releasing user experience updates for application provisioning, HR provisioning, and cross-tenant synchronization next month. This includes a new overview page, user experience to configure connectivity to your application, and new create provisioning experience. The new experiences include all functionality available to customers today, and no customer action is required.
SMS as MFA in Entra External ID • Microsoft Learn
🏁 Plan for change
New Certificate Authorities for login.microsoftonline.com: Action required from customers who only trust DigiCert certificates - Microsoft Entra ID is introducing new Certificate Authorities (CAs) for server certificates for the domain login.microsoftonline.com. At present, connections to login.microsoftonline.com are exclusively presented with DigiCert certificates. Starting on October 1, 2024, you may also encounter certificates issued by Microsoft Azure CAs.
This could impact customers who do not trust Microsoft Azure CAs or have pinned client-side to DigiCert certificates, as they may experience authentication failures.
To prevent potential issues, we recommend trusting all Root and Subordinate CAs listed in the Azure Certificate public documentation.
(Merill’s note: The link above opens the What’s New blade in the Entra Admin Center, unfortunately the blade doesn’t support direct links to this post so you will need to look it up in the ‘Change announcements’ tab).My Security-Info Add sign-in method picker UX update - Starting late August 2024, the "add sign-in method" dialog on the My Security-Info page will be updated with improved sign-in method descriptions, and a modern look and feel. With this change when users select "add sign-in method", they'll initially be recommended to register the strongest method available to them which is allowed by organizational authentication method policy. Users have the ability to select "show more options", and choose from all available sign-in methods allowed by their policy.
This change occurs automatically, and admins won't need to take any action.
📖 Read
Aug 2024: A look at the latest Microsoft Entra key feature releases, announcements, and updates • Adam Matthews
How to build customized Power BI dashboards with user insights data in External ID • Sharon Rutto
How Microsoft Entra ID supports US government agencies in meeting identity security requirements • Joy Chik
Enable Kerberos SSO to on-premises Active Directory and Microsoft Entra ID Kerberos resources in Platform SSO • Microsoft Learn
📺 Watch
Automate user enrollment with Dynamic Groups. (1 min) • Microsoft Mechanics
Microsoft Entra Verified ID: Seamless Remote Onboarding & Secure Access (55 min) • Jai Maharaj, Yusuke Kodama
📆 Upcoming Events
The Cloud Identity Summit is a hybrid cloud identity conference organized by the Azure Meetup Bonn team in Germany. It’s a full-day event with an awesome lineup of speakers and sessions, including folks from the Entra PM team.
The in-person tickets are sold out, but you can still register to join online if the timezone works for you (sessions will not be recorded).
Register at www.identitysummit.cloud
From the community…
🚀 Most popular posts from last week
Best practice for emergency access accounts in Microsoft Entra • Daniel Bradley
How to Use Passkey in Authenticator: A Tutorial • Simon Skotheimsvik
Mandatory MFA Enforcements! Including Service Accounts and Break Glass Accounts. Now What? • Shehan Perera
☀️ Learn
📦 Apps
Securing the Gates: Mastering Admin and User Consent in Microsoft Entra ID • Sreejith Reghunathan Pillai
Deploy a container to Azure App Services using Azure CLI and user-assigned managed identity • Tore Nestenius
🔑 Authentication
Difference between MFA and phishing-resistant MFA • Lukas Beran
Detect Impact MFA Enforcement • Morten Knudsen
Restricting FIDO2 Passkey Use to Specific Hardware Models in Microsoft Entra • James Agombar
👥 Group Management & Administrative Units
Why Entra ID can Restore Some Types of Deleted Groups and Not Others • Tony Redmond
The Problem with Scoped Audit Log Searches • Tony Redmond
🤖 DevOps & PowerShell
Automating Access Package Creation for Entra ID roles with PowerShell • Maarten Robert Rosier
Start Lifecycle Workflow in Entra ID Governance with PowerShell • Christian Frohn
Understanding and Implementing Privileged Identity Management (PIM) Using BICEP • Gregor Suttie
PnP PowerShell Changes Its Entra ID App • Tony Redmond
Microsoft.IdentityModel.Tokens Has Finally Fixed IsNullOrEmpty Foobar • Adam Storr
Remove Direct Licenses for Group-Licensed Users in Microsoft 365 • Praba
🚦 Conditional Access
Using Chrome with Intune & Conditional Access Device Signals • Gannon Novak
🖥️ Devices
How to setup MAM (Mobile Application Management) In Intune – The Series – Part 1: iOS • Joery Van den Bosch
AWS announces support for Microsoft Entra ID and Microsoft Intune on Amazon WorkSpaces Personal • What's New with AWS
🥷 Security
Microsoft Defender for Identity – Expands support to servers with Microsoft • Michael Morten Sonne
🛍️ External ID - Customers
⚒️ Toolkit
📺 Watch
What's the difference between Intune and Entra devices? (12 min) • Steve Weiner
Migrating from domain to cloud: step-by-step (26 min) • Steve Weiner
🔥 Maester
👨🏽💻 Merill’s corner
🪃 Acknowledgement of Country
Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. I pay my respect to them and their cultures and to elders both past and present.