You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Customers can now require a fresh authentication each time a user performs a certain action. Forced reauthentication supports requiring a user to reauthenticate during Intune device enrollment, password change for risky users, and risky sign-ins.
45
+
46
+
For more information, see: [Configure authentication session management with Conditional Access](../conditional-access/howto-conditional-access-session-lifetime.md#require-reauthentication-every-time)
47
+
48
+
---
49
+
50
+
### General Availability - Multi-Stage Access Reviews
51
+
52
+
**Type:** Changed feature
53
+
**Service category:** Access Reviews
54
+
**Product capability:** Identity Governance
55
+
56
+
Customers can now meet their complex audit and recertification requirements through multiple stages of reviews. For more information, see: [Create a multi-stage access review](../governance/create-access-review.md#create-a-multi-stage-access-review).
57
+
58
+
59
+
60
+
---
61
+
62
+
### Public Preview - External user leave settings
63
+
64
+
**Type:** New feature
65
+
**Service category:** Enterprise Apps
66
+
**Product capability:** B2B/B2C
67
+
68
+
Currently, users can self-service leave for an organization without the visibility of their IT administrators. Some organizations may want more control over this self-service process.
69
+
70
+
With this feature, IT administrators can now allow or restrict external identities to leave an organization by Microsoft provided self-service controls via Azure Active Directory in the Microsoft Entra portal. In order to restrict users to leave an organization, customers need to include "Global privacy contact" and "Privacy statement URL" under tenant properties.
71
+
72
+
A new policy API is available for the administrators to control tenant wide policy:
### Public Preview - Restrict self-service BitLocker for devices
85
+
86
+
**Type:** New feature
87
+
**Service category:** Device Registration and Management
88
+
**Product capability:** Access Control
89
+
90
+
In some situations, you may want to restrict the ability for end users to self-service BitLocker keys. With this new functionality, you can now turn off self-service of BitLocker keys, so that only specific individuals with right privileges can recover a BitLocker key.
91
+
92
+
For more information, see: [Block users from viewing their BitLocker keys (preview)](../devices/device-management-azure-portal.md#block-users-from-viewing-their-bitlocker-keys-preview)
93
+
94
+
95
+
---
96
+
97
+
### Public Preview- Identity Protection Alerts in Microsoft 365 Defender
Identity Protection risk detections (alerts) are now also available in Microsoft 365 Defender to provide a unified investigation experience for security professionals. For more information, see: [Investigate alerts in Microsoft 365 Defender](/microsoft-365/security/defender/investigate-alerts?view=o365-worldwide#alert-sources&preserve-view=true)
104
+
105
+
106
+
107
+
108
+
---
109
+
110
+
### New Federated Apps available in Azure AD Application gallery - August 2022
111
+
112
+
**Type:** New feature
113
+
**Service category:** Enterprise Apps
114
+
**Product capability:** 3rd Party Integration
115
+
116
+
In August 2022, we've added the following 40 new applications in our App gallery with Federation support
For more information about how to better secure your organization by using automated user account provisioning, see: [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md).
144
+
145
+
146
+
147
+
---
148
+
### General Availability - Workload Identity Federation with App Registrations are available now
149
+
150
+
**Type:** New feature
151
+
**Service category:** Other
152
+
**Product capability:** Developer Experience
153
+
154
+
Entra Workload Identity Federation allows developers to exchange tokens issued by another identity provider with Azure AD tokens, without needing secrets. It eliminates the need to store, and manage, credentials inside the code or secret stores to access Azure AD protected resources such as Azure and Microsoft Graph. By removing the secrets required to access Azure AD protected resources, workload identity federation can improve the security posture of your organization. This feature also reduces the burden of secret management and minimizes the risk of service downtime due to expired credentials.
155
+
156
+
For more information on this capability and supported scenarios, see [Workload identity federation](../develop/workload-identity-federation.md).
157
+
158
+
159
+
---
160
+
161
+
### Public Preview - Entitlement management automatic assignment policies
162
+
163
+
**Type:** Changed feature
164
+
**Service category:** Entitlement Management
165
+
**Product capability:** Identity Governance
166
+
167
+
In Azure AD entitlement management, a new form of access package assignment policy is being added. The automatic assignment policy includes a filter rule, similar to a dynamic group, that specifies the users in the tenant who should have assignments. When users come into scope of matching that filter rule criteria, an assignment is automatically created, and when they no longer match, the assignment is removed.
168
+
169
+
For more information, see: [Configure an automatic assignment policy for an access package in Azure AD entitlement management (Preview)](../governance/entitlement-management-access-package-auto-assignment-policy.md).
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments