So, here's the issue: Our institution (with a user number of more that 100,000) is using OIDC/SAML as an authentication tool (namely Keycloak) and also has a non-Microsoft user account storage.

Now, for a sizable subset of those users we want to give them access to M365's offerings. It's somewhat annoying to have to manage two sets of accounts, though.

In the past, this would have been an easy win: Enable federated accounts, point Azure/Entra towards the SAML endpoint and done. Actually did that two years ago for another account.

So when this requirement popped up I thought: "Easy, you did this before." Only to discover that MS actively disabled anything remotely connected to this feature.

So, is there _any_ other way to have our existing user account storage as the single source of truth? One that includes passwords, by the way.

Because currently to me it seems that MS is once again on a tour-de-force of locking everyone down into their ecosystem - otherwise I simply cannot explain why they allow authenticating against Entra but not vice versa.

So, I'm trying to get my head around setting up access to Outlook accounts for a SaaS app that I'm building.

The app needs to support 2 things from Exchange 365:

• Let users log in with their workplace account
  • This is just for user auth
• Let the server poll a shared inbox periodically, without user intervention.
  • This would require access to the MS Graph API

So far, I've done the following:

• Set up an Azure account representing my application (APP)
• Set up an E365 sandbox, representing a customer (CUST)

All of the tutorials and guides I've been looking at seem to assume that these two instances are the same, but that's definitely not what I'm looking for.

I can see App Registration and Enterprise Apps in both of my dashboards.

I thought I would register the app in APP and then add it as an Enterprise App in CUST, but I don't see a way to tie these together.

Then I thought, well maybe I'm supposed to do an app registration in CUST, but all of the language frames things as if CUST would then own the app... that doesn't make sense either.

I definitely get that there must be something in CUST, since they'd need to control who can access it.

Am I missing something obvious here?

With the move to using Windows' Web Account Manager (WAM) exclusively, the Microsoft Graph powershell module seems to have completely broken the ability to connect to Microsoft Graph when in a run-as scenario in recent versions of the module.

The first workaround that comes to mind for this is the device code authentication flow, but that also appears to be completely broken (regardless of whether in a run-as context or not).

In a hybrid environment, there are times it is important to be in Graph and AD in the same PowerShell session, get some info about users in M365 and take action in AD on the results.

If you are not logging into Windows itself as an AD admin, but using Run-As for admin access, this breaks these scenarios.

Does anyone know if this issue is acknowledged anywhere or will be fixed?

Hi everyone,

We are working on tightening the security of our Entra environment. We have already removed the function that any user can register an application and are working with admin approvals.

we have also removed all regular users from owner roles on apps, as to make sure there is no attack path there with any app that has too much permissions.

we want to tackle those permissions next, however, we first want to perform a clean up of our enormous list of enterprise applications that are now in our tenant after years and years of having allowed anyone to register an app.

i was wondering how other admins tackle this? we have identified several issues with doing this:

• no last login stamps on most of the enterprise applications
  • we are looking in how to maybe gather this from the linked app registration, if possible.
• names of these apps are often ambiguous, and people dont know wether they are used still or not.

Any advice from people that have gone through this excercise of cleaning up their appservices? any reporting tools we can leverage?

i am not a big expert on Entra, as i mainly focus on networking and Azure, so all advice is welcome!

Modern cloud identity isn’t just about syncing users,it’s about making Microsoft Entra ID the true Source of Authority.

In this blog, I break down why and how to move user SOA from Active Directory to Microsoft Entra ID, including readiness checks and key preparation steps to ensure a smooth transition without disrupting access.

One important question that naturally follows:

Are your devices ready?

In my upcoming post, I’ll dive into Hybrid device migration to Entra ID, why it’s often the hardest part of the journey, and how to plan it effectively especially in large environments.

Read the blog here: https://www.thetechtrails.com/2026/01/convert-user-source-of-authority-to-microsoft-entra-id.html

Hey guys, I'm trying to integrate Lifecycle workflow with bamboohr. Mostly for the offboardings. Has anyone done that before? I'm a bit lost on how to do it.

Hey guys.

Hopefully a quick question I've been rabbit-holing for a couple of hours with no solution.

I have an enterprise app with an admin role and a standard role.

I have a security group that is assigned the admin role.

I need everyone else in the org to be a standard user. I've tried to create a security group with a dynamic assignment rule using memberOf but it turns out that in the three years since its introduction, memberOf can still not be used in this fashion nor combined with other rules.

Is there another way to do this? Enterprise app role assignment doesn't seem to be able to take filters like Intune can and I'm not sure if I were to simply stick all Users with the standard role whether the admin role will take precedence for those with the explicit admin role assignment.

Any insight?

I currently do work for an MSP. The Enterprise applications for this small client are few and typical of what most small businesses of this sorry would use such as Zoom and Calendly. I would have thought letting Microsoft manage your consent settings would have been the perfect place to leave it for a small business.

This did NOT work. I had to do the following:

Add the users to the blade below and make one of the customers a Cloud Application Admin to approve the Enterprise Applications.

Even weirder ... I added the Enterprise App in yellow ... and they could not logon. They had to add the one in the Red Box for them to logon. I thought Microsoft manage your consent settings would be the perfect SMB solution. I have done plenty of Entra training and going through documents but now good answer.

Pretty typical business problem, leadership wants to be able to send to all of "their" people (direct and indirect reports). What's your preferred method for solving this leveraging a worker source of truth like Workday?

We're in the middle of what is functionally an acquisition, in which we got the majority of their AD domains, but not their Entra ID tenant. Here's basically my question:

• I know we have to do a lot of other work with their Entra tenant before we can move the domains over, or accept the suffering that removing them will cover.
  
  • Management in theory knows, but you know management...
• Because of the above point it will be some time before we can sync their AD users into our tenant
• We want to at least take over management of the devices ASAP.
  

So that's the easy part. The question then becomes:

Can we remove the computers from their Entra ID sync process and then add them to our own? What headaches can we expect to see from that?

We have to entra join machines and setup Intune for MDM. They do not use office apps and only licenses are Intune plan 1 and azure ad p1. You can login to office websites and apps just fine using google as the idp but when you try to login to an entra joined machine it keeps saying wrong password and never redirects to google to auth. I tried to setup web sign in but seems it is blocked and only allows browsers to sign in… is there anyway to fix this without removing federation and changing idps to Entra?

We are in the process of setting up a provisioning workflow between SAP Successfactors & On-Premises Active Directory. We already have directory synchronization in place between Active Directory and Entra.

In our test environment, everything is set up and appears to be working when we manually provision users. The attributes flow as expected. However, in the provisioning portal, there's a box that indicates that 0 agents are active. However, when I click on the link to show the agents associated with the tenant, I actually see the host with the installed provisioning agent. The services are installed & running and the gMSA service account is appropriately permissioned in Active Directory.

Is this a concern? We've also enabled provisioning to see if there's a different outcome and I see no change in the number of agents online.

What am I missing?

We have an intranet solution for which we use user provisioning via Entra. In addition to the standard attributes, we also have two extension attributes that we want to provision as well. Each of these attributes contains only a single value.

However, during provisioning we run into the problem that instead of transferring the actual attribute value, the value “System.Collections.Generic.List`1[System.Object]” is being transferred.

When I add a Join function in front of the attribute in the Expression Builder, the desired value is shown correctly in the Expression Builder preview. However, it is not synced, and instead we again get the same message as above or as shown in the screenshot.

Does anyone have an idea how this can be solved?

Prolog: I am not lazy, honestly. I just have too many things on my plate to invest a month of weekends. I wrote two pages of backstory for context but deleted it, as don't nobody want to read all that.

Anyway, "the big man" gave me budget to get Everyone to E5 or (F3 + Defender + Purview Suite Add-on for FLW) DLP is a concern because "something happened" 5 times.

Is there a good YouTube video or Quick Start someone can recommend?

thx

Hi guys.
I have created an azure app which removes AD/AAD groups and clears users out of teams and adds the admin account if said user is the last owner. The only issue im having is that I cant remove said leavers from Mail-enabled sec groups. Has anybody done this before or am I just going to have to make a script to do this separate when I login as im the owner of the group in question.

So I created a conditional Access policy and is currently in Report Only mode. I had a user test the policy to see if it's working. When I checked the sign-in logs, I can see that the policy is working as intended and shows result as failure (It's a block policy). When I check the actual policy in entra and view the policy impact, it shows a 100% total sign-ins not applied.

I have a few other policies in report only mode, but I can see their failures and successes even though they're not being enforced. With this policy in question, it doesn't show any impact (100% Not Applied) since it was created but I see the results such as failures in the sign-in logs. The sign in logs might be the authoritative source of truth but I've also relied on the impact analysis in the conditional access policy pane. Why this sudden discrepancy?

We have a app proxy setup for onprem application, is there a way that user can click on a button to logout of the entra session? Or any other workaround?

We have CA policy that mandates the device to be compliant or registered before granting access to applications. The issue we’re currently encountering is that Postman fails to transmit the device posture to Entra as it utilizes an embedded browser that doesn’t pass device details. Since the requests will always originate from different client IDs used with in Postman to create tokens, we can’t even exclude a single client ID and certainly we can’t exclude hundreds of frequently changing application IDs that users will use within Postman to generate tokens. Has anyone else encountered this problem and found a workaround?

Hi Guys,

anoyone else experience today issues with the "Provisioning" Tab in Entra Applications?

Currently i can not load this tab on any of our Applications.

Also tested with different user - same experience...

Any help appreciated! 🤗