You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For more information about how to better secure your organization by using automated user account provisioning, see [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md).
Azure AD Connect Cloud Provisioning public preview refresh features two major enhancements developed from customer feedback:
4656
-
4657
-
- Attribute Mapping Experience through Azure portal
4658
-
4659
-
With this feature, IT Admins can map user, group, or contact attributes from AD to Azure AD using various mapping types present today. Attribute mapping is a feature used for standardizing the values of the attributes that flow from Active Directory to Azure Active Directory. One can determine whether to directly map the attribute value as it is from AD to Azure AD or use expressions to transform the attribute values when provisioning users. [Learn more](../cloud-sync/how-to-attribute-mapping.md)
4660
-
4661
-
- On-demand Provisioning or Test User experience
4662
-
4663
-
Once you have set up your configuration, you might want to test to see if the user transformation is working as expected before applying it to all your users in scope. With on-demand provisioning, IT Admins can enter the Distinguished Name (DN) of an AD user and see if they're getting synced as expected. On-demand provisioning provides a great way to ensure that the attribute mappings you did previously work as expected. [Learn More](../cloud-sync/how-to-on-demand-provision.md)
4664
-
4665
-
---
4666
-
4667
-
### Audited BitLocker Recovery in Azure AD - Public Preview
When IT admins or end users read BitLocker recovery key(s) they have access to, Azure Active Directory now generates an audit log that captures who accessed the recovery key. The same audit provides details of the device the BitLocker key was associated with.
4674
-
4675
-
End users can [access their recovery keys via My Account](https://support.microsoft.com/account-billing/manage-your-work-or-school-account-connected-devices-from-the-devices-page-6b5a735d-0a7f-4e94-8cfd-f5da6bc13d4e#view-a-bitlocker-key). IT admins can access recovery keys via the [BitLocker recovery key API](/graph/api/resources/bitlockerrecoverykey) or via the Azure portal. To learn more, see [View or copy BitLocker keys in the Azure portal](../devices/device-management-azure-portal.md#view-or-copy-bitlocker-keys).
4676
-
4677
-
---
4678
-
4679
-
### Teams Devices Administrator built-in role
4680
-
4681
-
**Type:** New feature
4682
-
**Service category:** RBAC
4683
-
**Product capability:** Access Control
4684
-
4685
-
Users with the [Teams Devices Administrator](../roles/permissions-reference.md#teams-devices-administrator) role can manage [Teams-certified devices](https://www.microsoft.com/microsoft-365/microsoft-teams/across-devices/devices) from the Teams Admin Center.
4686
-
4687
-
This role allows the user to view all devices at single glance, with the ability to search and filter devices. The user can also check the details of each device including logged-in account and the make and model of the device. The user can change the settings on the device and update the software versions. This role doesn't grant permissions to check Teams activity and call quality of the device.
4688
-
4689
-
---
4690
-
4691
-
### Advanced query capabilities for Directory Objects
4692
-
4693
-
**Type:** New feature
4694
-
**Service category:** MS Graph
4695
-
**Product capability:** Developer Experience
4696
-
4697
-
All the new query capabilities introduced for Directory Objects in Azure AD APIs are now available in the v1.0 endpoint and production-ready. Developers can Count, Search, Filter, and Sort Directory Objects and related links using the standard OData operators.
4698
-
4699
-
To learn more, see the documentation [here](https://aka.ms/BlogPostMezzoGA), and you can also send feedback with this [brief survey](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR_yN8EPoGo5OpR1hgmCp1XxUMENJRkNQTk5RQkpWTE44NEk2U0RIV0VZRy4u).
4700
-
4701
-
---
4702
-
4703
-
### Public preview: continuous access evaluation for tenants who configured Conditional Access policies
Continuous access evaluation (CAE) is now available in public preview for Azure AD tenants with Conditional Access policies. With CAE, critical security events and policies are evaluated in real time. This includes account disable, password reset, and location change. To learn more, see [Continuous access evaluation](../conditional-access/concept-continuous-access-evaluation.md).
4710
-
4711
-
---
4712
-
4713
-
### Public preview: ask users requesting an access package additional questions to improve approval decisions
4714
-
4715
-
**Type:** New feature
4716
-
**Service category:** User Access Management
4717
-
**Product capability:** Entitlement Management
4718
-
4719
-
Administrators can now require that users requesting an access package answer additional questions beyond just business justification in Azure AD Entitlement management's My Access portal. The users' answers will then be shown to the approvers to help them make a more accurate access approval decision. To learn more, see [Collect additional requestor information for approval](../governance/entitlement-management-access-package-approval-policy.md#collect-additional-requestor-information-for-approval).
4720
-
4721
-
---
4722
-
4723
-
### Public preview: Enhanced user management
4724
-
4725
-
**Type:** New feature
4726
-
**Service category:** User Management
4727
-
**Product capability:** User Management
4728
-
4729
-
4730
-
The Azure portal has been updated to make it easier to find users in the All users and Deleted users pages. Changes in the preview include:
4731
-
- More visible user properties including object ID, directory sync status, creation type, and identity issuer.
4732
-
- Search now allows combined search of names, emails, and object IDs.
4733
-
- Enhanced filtering by user type (member, guest, and none), directory sync status, creation type, company name, and domain name.
4734
-
- New sorting capabilities on properties like name, user principal name and deletion date.
4735
-
- A new total users count that updates with any searches or filters.
4736
-
4737
-
For more information, please see [User management enhancements (preview) in Azure Active Directory](../enterprise-users/users-search-enhanced.md).
4738
-
4739
-
---
4740
-
4741
-
### New notes field for Enterprise applications
4742
-
4743
-
**Type:** New feature
4744
-
**Service category:** Enterprise Apps
4745
-
**Product capability:** SSO
4746
-
4747
-
You can add free text notes to Enterprise applications. You can add any relevant information that will help manager applications under Enterprise applications. For more information, see [Quickstart: Configure properties for an application in your Azure Active Directory (Azure AD) tenant](../manage-apps/add-application-portal-configure.md).
4748
-
4749
-
---
4750
-
4751
-
### New Federated Apps available in Azure AD Application gallery - September 2020
4752
-
4753
-
**Type:** New feature
4754
-
**Service category:** Enterprise Apps
4755
-
**Product capability:** 3rd Party Integration
4756
-
4757
-
In September 2020 we have added following 34 new applications in our App gallery with Federation support:
You can also find the documentation of all the applications from here: https://aka.ms/AppsTutorial.
4762
-
4763
-
For listing your application in the Azure AD app gallery, read the details here: https://aka.ms/AzureADAppRequest.
4764
-
4765
-
---
4766
-
4767
-
### New delegation role in Azure AD entitlement management: Access package assignment manager
4768
-
4769
-
**Type:** New feature
4770
-
**Service category:** User Access Management
4771
-
**Product capability:** Entitlement Management
4772
-
4773
-
A new Access Package Assignment Manager role has been added in Azure AD entitlement management to provide granular permissions to manage assignments. You can now delegate tasks to a user in this role, who can delegate assignments management of an access package to a business owner. However, an Access Package Assignment Manager can't alter the access package policies or other properties that are set by the administrators.
4774
-
4775
-
With this new role, you benefit from the least privileges needed to delegate management of assignments and maintain administrative control on all other access package configurations. To learn more, see [Entitlement management roles](../governance/entitlement-management-delegate.md#entitlement-management-roles).
4776
-
4777
-
---
4778
-
4779
-
### Changes to Privileged Identity Management's onboarding flow
Previously, onboarding to Privileged Identity Management (PIM) required user consent and an onboarding flow in PIM's blade that included enrollment in Azure Active Directory Multi-Factor Authentication (MFA). With the recent integration of PIM experience into the Azure AD roles and administrators blade, we are removing this experience. Any tenant with valid P2 license will be auto-onboarded to PIM.
4786
-
4787
-
Onboarding to PIM does not have any direct adverse effect on your tenant. You can expect the following changes:
4788
-
- Additional assignment options such as active vs. eligible with start and end time when you make an assignment in either PIM or Azure AD roles and administrators blade.
4789
-
- Additional scoping mechanisms, like Administrative Units and custom roles, introduced directly into the assignment experience.
4790
-
- If you're a global administrator or privileged role administrator, you may start getting a few additional emails like the PIM weekly digest.
4791
-
- You might also see ms-pim service principal in the audit log related to role assignment. This expected change shouldn't affect your regular workflow.
4792
-
4793
-
For more information, see [Start using Privileged Identity Management](../privileged-identity-management/pim-getting-started.md).
4794
-
4795
-
---
4796
-
4797
-
### Azure AD Entitlement Management: The Select pane of access package resources now shows by default the resources currently in the selected catalog
4798
-
4799
-
**Type:** Changed feature
4800
-
**Service category:** User Access Management
4801
-
**Product capability:** Entitlement Management
4802
-
4803
-
4804
-
In the access package creation flow, under the Resource roles tab, the Select pane behavior is changing. Currently, the default behavior is to show all resources that are owned by the user and resources added to the selected catalog.
4805
-
4806
-
This experience will be changed to display only the resources currently added in the catalog by default, so that users can easily pick resources from the catalog. The update will help with discoverability of the resources to add to access packages, and reduce risk of inadvertently adding resources owned by the user that aren't part of the catalog. To learn more, see [Create a new access package in Azure AD entitlement management](../governance/entitlement-management-access-package-create.md#resource-roles).
0 commit comments