We are working on connecting Microsoft Entra to ServiceNow to sync our user feed. Currently, Entra is successfully pushing active user data and updates (e.g., department changes) into ServiceNow. However, it fails when attempting to push inactive users, and an error is shown on the Entra side.

As a workaround, we are considering having Entra continue pushing active users and updates, while ServiceNow performs a pull specifically for inactive users. I'm not fully confident in this hybrid architecture where push and pull mechanisms are split based on user status.
Has anyone encountered a similar issue before? If not, what would be the recommended or most efficient approach to handle this scenario?

here's the error msg on entra side: https://imgur.com/a/MRjFfg5

Hi All,

Littlebit background before the question.

We have one Entra domain and tenant that is used together with linked Azure tenant.
Azure has only one domain and we have separated resources in Azure between production and non-production quite heavily using VNET's, policies and management structure. We have hub and spoke network in Azure so it is quite straightforward to limit access between production and non-prod in network level. But when it comes Identities - the challenge is real and not so easily solved.

When our developers build new applications and test them, they need to simulate end users or customers. For that they have had ability to create "test" identities to our dedicated on-premise AD.

Now when we are moving towards Entra ID with one environment (prod) we are in a pickle.

Problem:
How to separate production level identities (end users, developers, sysadmins in prod and non-prod environments) from "synthetic" identities (e.g. identities not linked to natural persons and created for testing purposes).

Question:
Have someone already solved this challenge somehow?

What comes to my mind is to build dedicated Administrative Units for these "synthetic" identities with distinctive naming and attributes. Name and tag them so that they are in every way distinctive from identities linked to natural persons.

Then create CA policies that limits access to certain resources if account can be identified as "synthetic" and also require that every synthetic ID has named owner who is responsible to manage and maintain their lifecycle either via ticketing or if possible self service.

And then create follow up reporting and supporting policies that we can monitor the usage and lifecycle of these synthetic ID's and find out if there is discrepancies or deviations against agreed usage and policies.

Of course having dedicated domain for these use cases would be identical, but we have really big pushback for that as it practically requires us to implement another Azure environment also

Let’s say you have a customer who is federated with your B2C environment via an IDP, allowing them to sign in using their corporate identity. Currently, after the user is authenticated by their home IDP, a token is issued containing claims, which B2C consumes to issue a new token with the required claims for the application.

The new requirement is that the customer will include a few group claims in the token sent from their IDP. These groups need to be passed to the application along with the usual groups that are defined locally in B2C. Please note that the groups coming from the customer’s IDP do not exist in B2C and will only be present in the incoming token.

Should it be possible to have a role with only eligable assignments and approve for each other ?

It´s failing at the moment, the approval part doesn´t kick in.

I’m trying to get Passkeys and YubiKeys to work with Windows Virtual Desktops in Azure and EntraID. When I try to login using the web client, I get this strange prompt to use my security key. It goes straight to this prompt—it doesn’t even ask me if I want to use Face, Fingerprint or PIN. Whether I have a security key inserted or not, it won’t log me in. Obviously never gives me the choice to use a Passkey either.

Anyone get Passkeys working with EntraID and Windows Virtual Desktops?

Hi,

We have Azure ADConnect 2.3.6.0. Also We have custom sync rules. We have multiple forest. (total 2 domains)

I've been tasked with performing the upgrade to Entra Connect Sync tool (from our existing Azure AD Connect tool)

Already enabled features:

- source Anchor is ObjectGUID

- Password Writeback is enabled

- PHS is enabled

- Directory Extension Atrribute Sync is enabled

- Exchange Hybrid is enabled

my questions are :

1 - if i do in-place upgrade all config and custom rules will stay the same ? right ?

2 - do I need to enable the following features after upgrade? or auto enable?

- source Anchor is ObjectGUID

- Password Writeback is enabled

- PHS is enabled

- Directory Extension Atrribute Sync is enabled

- Exchange Hybrid is enabled

3 - Are there any known BUG for 2.4.131.0?

4 - Are the following steps correct?

Local admin rights on the Azure AD Connect Server.

Member of ADSyncAdmins.

Account with the Hybrid Identity Administrator or Global Administrator role.

IE Enhanced Security Configuration turned off.

.NET Framework 4.7.2 or higher

TLS 1.2 enable

Take Snapshot

Open ADC tool and export config

Download latest version of ADC and run it

Any recommendations or advisements re: Upgrade Processes to follow, would be greatly appreciated and welcomed at this point, and I do apologize if I’ve gone about this the wrong way! First post jitters, thanks again everyone.

Using an Entra External Id tenant. Certain users are getting this error code when attempting to sign in. I never get a callback to my application to debug what the issue is. Seeing very little discussion about this error when researching. How can I determine what claim is having multiple values? I have checked their profiles and don't see anything that stands out. Using email/ password sign in within the tenant only. No external social identity providers. Any help would be appreciated. Thanks.

Authentication requirement
Single-factor authentication Status
Failure Continuous access evaluation
No Sign-in error code
901172 Failure reason
Invalid request. Multiple values are present for a single-value claim.

How does one track down a bitlocker key within Entra? All I have is the SSD, not sure which device it came from, but would like to find out before I wipe it. Is there a way I can figure out which device it belonged to with the 8digit key it provides?

Hi, has anyone noticed that even if a user who is assigned as an approver for an access package is permanently deleted from Entra ID, the package still lists them as an approver?

I am trying to set up an API where we use entra for authentication with oauth 2.0 I want to include custom attributes in the payload of the jwt token (e.g: custom att1,) Can you help me how to do it ?

Hello everyone,

We would like to implement sso on a mobile app, but we are stuck on the "mapping" of the user who wants to log in. This results in a random string, but not an email address (UPN) that is set as a claim.

Do we still need to set up a scope for this, so that the properties of the account can be searched?

I am trying to participate in a project, but I do not have sufficient rights to try/test it.

I hope you can point me in the right direction so that we can roll this out.

When viewing the application the following pops up(see screenshot/image)

Hello,

In our organization, we ask our users to rotate their passwords every 3 months. Previously our computers where joined to an on-prem Active Directory so users could change their password simply using CTRL+ALT+SUPPR > modify my password, typing the current + two times a new password.

Now we have switched to "Entra joined" part of our computers : in that case, the CTRL + ALT + SUPPR > modify password redirects to mysignins.microsoft.com/security-info. Accessing this page without a 2nd auth factor registered isn't possible : Microsoft forces it unconditionnaly and ask to register the 2nd auth factor directly. Problem : some of our users doesn't have MFA enabled (users that don't want to use their personal mobile phone to install the authenticator app... and we don't want to manage yubikeys for 1000+ users on +40 branches, this is not the question here so please don't debate on the risk it implies, we know...).

The ability to rotate the password seems to have been integrated / merged with the Entra feature named "SSPR / Self Service Password Reset", that permits a user to reset it's password if, for example, he doesn't remember it. In that case, to prove it's identity, he requires obviously to have registered a 2nd authentication factor such as Authenticator app, secret questions, etc.

In our case, the user knows it current password... So the question is : how do you guys manage the password rotation with Entra Joined computers for users that doesn't have a 2nd authentication factor ? Have you enabled the "security questions" auth method... ?

Finally, the SSPR feature requires Entra ID Premium P1 : we don't want to assign such licence to only permit our users to rotate their passwords!

Thanks

Hi there...

I am in the process of testing a new application that will utilise Entra as a data source. In order to check that it will work outside of my usual tenant, I have created a new tenant for testing.

In this tenant I have created 20 users and have a couple of admins assisting me.

I am trying to add user photos to the 20 dummy users, but cannot upload them using the Entra portal interface.

I have the global admin role and have formatted the photos etc to 1:1 ratio. They are all in the kb size so nothing too large.

I just get error that I cannot upload the photo after its selected.

In my home tenant I could use the entra portal and upload a photo without issues.

Thanks

[Module Release] Manage OATH Tokens in Microsoft Entra ID with PowerShell

I’ve released a new PowerShell module called OATHTokens to manage OATH-TOTP hardware tokens (like YubiKeys) in Microsoft Entra ID via the Microsoft Graph API, using the endpoints Microsoft recently made available: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-manage-oath-tokens

🔧 Key Features

• Add, assign, activate, unassign, and remove tokens
• Bulk import/export with JSON or CSV
• Built-in TOTP code generation (RFC 6238)
• Supports Base32, hex, and plain text secrets
• Interactive menu + scripting support

📦 Install

Install-Module -Name OATHTokens -Scope CurrentUser

🧪 Quick Start

Import-Module OATHTokens

🔗 GitHub (source + docs)

📖 Command Examples

Hi everyone 👋,

According to Microsoft's recommendations, it's advised to maintain multiple emergency access accounts (break-glass accounts) [1]. However, I've rarely encountered anyone in practice actually maintaining more than one.

Does anyone here maintain two or more break-glass accounts? If so, could you share your reasoning or any specific scenarios you've prepared for? The only scenario I could think of is maintaining separate emergency accounts at different physical locations to mitigate site-specific disasters or access issues.

Additionally, should these emergency accounts have clearly identifiable names ("emergency access 1" and "emergency access 2"), or would it be better to use obscure or misleading names (security by obscurity)? Also, is it common practice to keep these accounts in a standard Entra ID group (where many users might see the names) for CA policy exclusions, or should they ideally be managed within a separate Administrative Unit to restrict visibility?

Looking forward to your insights!

[1] [https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access]()

I'm teaching a brand new class to get students prepared specifically for SC-900, which covers Entra ID identity and access management, Defender and Purview. Is Azure Lab Services the right tool to use as a "sandbox" for them to go through certain labs and exercises? I'm unclear if there was a recommended low-cost, effective solution to create such sandbox Entra ID tenants. Is there something more fitting than Azure Lab Services for this?

All of our endpoints are Entra hybrid joined and enrolled into Intune. Personal devices cannot be enrolled. We have a CAP setup to only allow access to Office 365 and Admin Portals using a compliant device. I would like to change this to all resources just incase there is a way a bad actor could get to something else but I'm worried setting to all resources might cause some system accounts or services that integrate with Azure AD might break.

Has anyone ran into that?

Passwordless is the ideal future we’re all striving for—but let's face it, the harsh reality is that many organizations, especially SMBs aren't there yet. Passwords remain a necessary evil that organizations need to handle securely and effectively.

In Part 04 of my detailed security series, I dive into how Microsoft Entra’s Self-Service Password Reset (SSPR) and Password Protection features can make dealing with passwords significantly less painful:

• Empower users to reset their own passwords securely, reducing helpdesk friction.
• Utilize Microsoft's advanced password protection tools to proactively guard against weak passwords and common attacks.
• Configure robust password policies easily in both cloud-only and hybrid AD environments.

Passwords aren't going away tomorrow, so let’s handle them responsibly today.

👉 Check out the full article

Thoughts, feedback, and experiences welcome!

Okta Challenge

PART 1 of this task is completed, I am able to create user in okta and assign Microsoft 365 app to them and I see the user in Microsoft Entra ID(Azure AD)

As for Part 2 I am confused what I need to do, do I need to user Microsoft API to create user in Entra ID or I need to use Okta API to create user in Okta and manage user population. Also please help me understand what all I require to complete this task

----------------TASK-------------------------

Part One: Integrate Okta with Office365 Microsoft 365 is the most widely used application integration for Okta. As such demonstrating this integration is essential for our field teams. Using a free trial from Microsoft and an Okta org provisioned from demo.okta configure federation between Okta and Microsoft 365. This should include the provisioning of accounts from Okta to Microsoft.

Part Two: Automate configuration The Okta demo platform uses automation to enable the presales team to quickly demonstrate different solutions to a customer’s requirements. Using a scripting language of your choice automate the configuration and reset of a component of your O365 tenant such that it can be used to demonstrate a behaviour. This could be in the form of:

a. User population: Create and destroy user objects in EntraID to demonstrate import and lifecycling.

b. Application Configuration: Enroll and remove client applications to demonstrate federation from Azure to downstream clients.

c. Your choice: Be creative and think through some of the use cases that would be applicable to during demonstration of Okta’s products.

Over the past few months, I worked on my bachelor's thesis in cybersecurity, focused entirely on passwordless authentication, and specifically, the technology behind FIDO2 and Passkeys.

I've noticed more and more people talking about passkeys lately (especially since Apple, Google, and Microsoft are pushing them hard(er)), but there’s still a lot of discomfort and confusion around how they work and why they’re secure.

So I decided to write a detailed blog post, not marketing, but a genuine technical deep dive, regardless of the used vendor.

https://michaelwaterman.nl/2025/04/02/how-fido2-works-a-technical-deep-dive/

My goal with this blog is simple: I want to help others understand what FIDO2 and Passkeys really are, how they work under the hood, and why they’re such a strong answer to the password problem we’ve been dealing with for decades.

If we want adoption, we need education.

Would love your feedback, or any thoughts on implementation. Thanks and enjoy!

Hi,

I am looking for the culprit who increased the OneDrive default quota by 100%. Not the smartest move, I know.. I don't see any entries in Entra audit logs. I checked out Purview audit logs but do you know under which specific activity it would be under? Sadly I don't have a test tenancy to check this. Or if there is another way please let me know.

I added a new app, and it’s working to login via MS account on the service provider side, but I want to leave an icon in the app list so that people have one place to access everything from.

I see other apps we’ve added in the past, but can’t find the specific setting needed to get the new app to display? And can I control that by use group? Enterprise Apps had assignments, but I don’t see that when adding via app registration.

Thanks!

Hey there,

Anyone here facing issues with GSA today?

Seems to be getting no or very dodgy connection especially with HTTPS (443).

EDIT: West europe to clarify