You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -29,7 +29,216 @@ The What's new in Azure Active Directory? release notes provide information abou
29
29
- Plans for changes
30
30
31
31
---
32
+
33
+
## July 2021
34
+
35
+
### New Google sign-in integration for Azure AD B2C and B2B self-service sign-up and invited external users will stop working starting July 12, 2021
36
+
37
+
**Type:** Plan for change
38
+
**Service category:** B2B
39
+
**Product capability:** B2B/B2C
40
+
41
+
Previously we announced that [the exception for Embedded WebViews for Gmail authentication will expire in the second half of 2021](https://www.yammer.com/cepartners/threads/1188371962232832).
42
+
43
+
On July 7, 2021, we learned from Google that some of these restrictions will apply starting **July 12, 2021**. Azure AD B2B and B2C customers who set up a new Google ID sign-in in their custom or line of business applications to invite external users or enable self-service sign-up will have the restrictions applied immediately. As a result, end-users will be met with an error screen that blocks their Gmail sign-in if the authentication is not moved to a system webview. See the docs linked below for details.
44
+
45
+
Most apps use system web-view by default, and will not be impacted by this change. This only applies to customers using embedded webviews (the non-default setting.) We advise customers to move their application's authentication to system browsers instead, prior to creating any new Google integrations. To learn how to move to system browsers for Gmail authentications, read the Embedded vs System Web UI section in the [Using web browsers (MSAL.NET)](../develop/msal-net-web-browsers.md#embedded-vs-system-web-ui) documentation. All MSAL SDKs use the system web-view by default. [Learn more](../external-identities/google-federation.md#deprecation-of-web-view-sign-in-support).
46
+
47
+
---
48
+
49
+
### Google sign-in on embedded web-views expiring September 30, 2021
50
+
51
+
**Type:** Plan for change
52
+
**Service category:** B2B
53
+
**Product capability:** B2B/B2C
54
+
55
+
56
+
About two months ago we announced that the exception for Embedded WebViews for Gmail authentication will expire in the second half of 2021.
57
+
58
+
Recently, Google has specified the date to be **September 30, 2021**.
59
+
60
+
Rolling out globally beginning September 30, 2021, Azure AD B2B guests signing in with their Gmail accounts will now be prompted to enter a code in a separate browser window to finish signing in on Microsoft Teams mobile and desktop clients. This applies to invited guests and guests who signed up using Self-Service Sign-Up.
61
+
62
+
Azure AD B2C customers who have set up embedded webview Gmail authentications in their custom/line of business apps or have existing Google integrations, will no longer can let their users sign in with Gmail accounts. To mitigate this, make sure to modify your apps to use the system browser for sign-in. For more information, read the Embedded vs System Web UI section in the [Using web browsers (MSAL.NET)](../develop/msal-net-web-browsers.md#embedded-vs-system-web-ui) documentation. All MSAL SDKs use the system web-view by default.
63
+
64
+
As the device login flow will start rolling out on September 30, 2021, it is likely that it may not be rolled out to your region yet (in which case, your end-users will be met with the error screen shown in the documentation until it gets deployed to your region.)
65
+
66
+
For details on known impacted scenarios and what experience your users can expect, read [Add Google as an identity provider for B2B guest users](../external-identities/google-federation.md#deprecation-of-web-view-sign-in-support).
67
+
68
+
---
69
+
70
+
### Bug fixes in My Apps
71
+
72
+
**Type:** Fixed
73
+
**Service category:** My Apps
74
+
**Product capability:** End User Experiences
75
+
76
+
- Previously, the presence of the banner recommending the use of collections caused content to scroll behind the header. This issue has been resolved.
77
+
- Previously, there was another issue when adding apps to a collection, the order of apps in All Apps collection would get randomly reordered. This issue has also been resolved.
78
+
79
+
For more information on My Apps, read [Sign in and start apps from the My Apps portal](https://support.microsoft.com/account-billing/sign-in-and-start-apps-from-the-my-apps-portal-2f3b1bae-0e5a-4a86-a33e-876fbd2a4510).
80
+
81
+
---
82
+
83
+
### Public preview - Application authentication method policies
84
+
85
+
**Type:** New feature
86
+
**Service category:** MS Graph
87
+
**Product capability:** Developer Experience
88
+
89
+
Application authentication method policies in MS Graph which allow IT admins to enforce lifetime on application password secret credential or block the use of secrets altogether. Policies can be enforced for an entire tenant as a default configuration and it can be scoped to specific applications or service principals. [Learn more](/graph/api/resources/policy-overview).
90
+
91
+
---
92
+
93
+
### Public preview - Authentication Methods registration campaign to download Microsoft Authenticator
94
+
95
+
**Type:** New feature
96
+
**Service category:** Microsoft Authenticator App
97
+
**Product capability:** User Authentication
98
+
99
+
The Authenticator registration campaign helps admins to move their organizations to a more secure posture by prompting users to adopt the Microsoft Authenticator app. Prior to this feature, there was no way for an admin to push their users to set up the Authenticator app.
100
+
101
+
The registration campaign comes with the ability for an admin to scope users and groups by including and excluding them from the registration campaign to ensure a smooth adoption across the organization. [Learn more](../authentication/how-to-mfa-registration-campaign.md)
102
+
103
+
---
104
+
105
+
### Public preview - Separation of duties check
106
+
107
+
**Type:** New feature
108
+
**Service category:** User Access Management
109
+
**Product capability:** Entitlement Management
110
+
111
+
In Azure AD entitlement management, an administrator can define that an access package is incompatible with another access package or with a group. Users who have the incompatible memberships will be then unable to request more access. [Learn more](../governance/entitlement-management-access-package-request-policy.md#prevent-requests-from-users-with-incompatible-access-preview).
112
+
113
+
---
114
+
115
+
### Public preview - Identity Protection logs in Log Analytics, Storage Accounts, and Event Hubs
You can now send the risky users and risk detections logs to Azure Monitor, Storage Accounts, or Log Analytics using the Diagnostic Settings in the Azure AD blade. [Learn more](../identity-protection/howto-export-risk-data.md).
122
+
123
+
---
124
+
125
+
### Public preview - Application Proxy API addition for backend SSL certificate validation
126
+
127
+
**Type:** New feature
128
+
**Service category:** App Proxy
129
+
**Product capability:** Access Control
130
+
131
+
The onPremisesPublishing resource type now includes the property, "isBackendCertificateValidationEnabled" which indicates whether backend SSL certificate validation is enabled for the application. For all new Application Proxy apps, the property will be set to true by default. For all existing apps, the property will be set to false. For more information, read the [onPremisesPublishing resource type](/graph/api/resources/onpremisespublishing?view=graph-rest-beta&preserve-view=true) api.
132
+
133
+
---
134
+
135
+
### General availability - Improved Authenticator setup experience for add Azure AD account in Microsoft Authenticator app by directly signing into the app.
136
+
137
+
**Type:** New feature
138
+
**Service category:** Microsoft Authenticator App
139
+
**Product capability:** User Authentication
140
+
141
+
Users can now use their existing authentication methods to directly sign into the Microsoft Authenticator app to set up their credential. Users don't need to scan a QR Code anymore and can use a Temporary Access Pass (TAP) or Password + SMS (or other authentication method) to configure their account in the Authenticator app.
142
+
143
+
This improves the user credential provisioning process for the Microsoft Authenticator app and gives the end user a self-service method to provision the app. [Learn more](https://support.microsoft.com/account-billing/add-your-work-or-school-account-to-the-microsoft-authenticator-app-43a73ab5-b4e8-446d-9e54-2a4cb8e4e93c#sign-in-with-your-credentials).
144
+
145
+
---
146
+
147
+
### General availability - Set manager as reviewer in Azure AD entitlement management access packages
148
+
149
+
**Type:** New feature
150
+
**Service category:** User Access Management
151
+
**Product capability:** Entitlement Management
152
+
153
+
Access packages in Azure AD entitlement management now support setting the user's manager as the reviewer for regularly occurring access reviews. [Learn more](../governance/entitlement-management-access-reviews-create.md).
154
+
155
+
---
156
+
157
+
### General availability - Enable external users to self-service sign-up in Azure AD using MSA accounts
158
+
159
+
**Type:** New feature
160
+
**Service category:** B2B
161
+
**Product capability:** B2B/B2C
32
162
163
+
Users can now enable external users to self-service sign-up in Azure Active Directory using Microsoft accounts. [Learn more](../external-identities/microsoft-account.md).
164
+
165
+
---
166
+
167
+
### General availability - External Identities Self-Service Sign-Up with Email One-time Passcode
168
+
169
+
**Type:** New feature
170
+
**Service category:** B2B
171
+
**Product capability:** B2B/B2C
172
+
173
+
174
+
Now users can enable external users to self-service sign-up in Azure Active Directory using their email and one-time passcode. [Learn more](../external-identities/one-time-passcode.md).
Anomalous token detection is now available in Identity Protection. This feature can detect that there are abnormal characteristics in the token such as time active and authentication from unfamiliar IP address. [Learn more](../identity-protection/concept-identity-protection-risks.md#sign-in-risk).
185
+
186
+
---
187
+
188
+
### General availability - Register or join devices in Conditional Access
The Register or join devices user action in Conditional access is now in general availability. This user action allows you to control multifactor authentication (MFA) policies for Azure AD device registration.
195
+
196
+
Currently, this user action only allows you to enable multifactor authentication as a control when users register or join devices to Azure AD. Other controls that are dependent on or not applicable to Azure AD device registration continue to be disabled with this user action. [Learn more](../conditional-access/concept-conditional-access-cloud-apps.md#user-actions).
197
+
198
+
---
199
+
200
+
### New provisioning connectors in the Azure AD Application Gallery - July 2021
201
+
202
+
**Type:** New feature
203
+
**Service category:** App Provisioning
204
+
**Product capability:** 3rd Party Integration
205
+
206
+
You can now automate creating, updating, and deleting user accounts for these newly integrated apps:
For more information about how to better secure your organization by using automated user account provisioning, read [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md).
218
+
219
+
---
220
+
221
+
### Changes to security and Microsoft 365 group settings in Azure portal
222
+
223
+
**Type:** Changed feature
224
+
**Service category:** Group Management
225
+
**Product capability:** Directory
226
+
227
+
228
+
In the past, users could create security groups and Microsoft 365 groups in the Azure portal. Now users will have the ability to create groups across Azure portals, PowerShell, and API. Customers are required to verify and update the new settings have been configured for their organization. [Learn More](../enterprise-users/groups-self-service-management.md#group-settings).
229
+
230
+
---
231
+
232
+
### "All Apps" collection has been renamed to "Apps"
233
+
234
+
**Type:** Changed feature
235
+
**Service category:** My Apps
236
+
**Product capability:** End User Experiences
237
+
238
+
In the My Apps portal, the collection that was called "All Apps" has been renamed to be called "Apps". As the product evolves, "Apps" is a more fitting name for this default collection. [Learn more](../manage-apps/my-apps-deployment-plan.md#plan-the-user-experience).
239
+
240
+
---
241
+
33
242
## June 2021
34
243
35
244
### Context panes to display risk details in Identity Protection Reports
0 commit comments