Originally reported by Redmond Magazine. This article summarises Microsoft’s Azure Active Directory release milestone announcement from May 2020.
Free Single Sign-On Now Available to All Azure AD Subscribers
Microsoft announced that unlimited Single Sign-On (SSO) access is now available at no extra cost to every Azure Active Directory (Azure AD) subscriber, including those on the free tier. Previously, a limit existed on the number of apps that could be assigned to a user for SSO. That limit has been removed.
SSO allows end users to authenticate once and then access multiple applications without repeating the login process for each one. Any organisation holding a subscription to a Microsoft commercial online service — including Azure, Microsoft 365 (Office 365), Dynamics, or Power Platform — can now enable SSO across all their cloud apps, even with the Azure AD Free plan.
The expanded SSO support covers gallery apps and non-gallery apps, and works with OpenID Connect (OIDC), SAML, and password-based SSO protocols.
“Whether you need gallery apps or non-gallery apps, using OIDC, SAML or password SSO, we have removed the limit on the number of apps each user can be assigned for SSO access in Azure AD.”
— Microsoft Azure AD announcement, May 2020
This builds on Microsoft’s earlier move to make multi-factor authentication (MFA) and security defaults free across all Azure AD pricing tiers, meaning every application can now benefit from both SSO and MFA protection at no additional licensing cost.
New Azure AD Features Reaching General Availability
Microsoft also announced several Azure AD capabilities that moved from preview to general availability (GA) — meaning they are now fully supported for production use. Note that some require Azure AD Premium licensing.
Bulk Operations for Users and Groups
IT administrators can now use comma-separated value (CSV) files to perform bulk operations such as importing or exporting users and groups, deleting users, updating group memberships, and downloading user or group data. This significantly reduces the manual overhead of managing large directories.
Report-Only Mode for Conditional Access
The report-only mode for Azure AD Conditional Access allows administrators to evaluate the impact of a Conditional Access policy change before enforcing it in production. This is valuable for change management and reduces the risk of accidentally locking out users.
Continuous Access Evaluation
Continuous Access Evaluation (CAE) extends access control beyond the initial authentication event. It monitors for changed conditions — such as a user account being disabled or a session being revoked — after access has already been granted. At GA, CAE is available for Exchange Online and Microsoft Teams. Microsoft’s implementation is based on a developing standard from the OpenID Foundation.
Combined MFA and Password Reset Registration
A combined registration experience allows end users to set up both multi-factor authentication and self-service password reset (SSPR) in a single workflow. Users can complete this through the My Profile website or the Microsoft Authenticator app on their mobile device, reducing support burden on IT helpdesks.
Token Configuration
Application developers can now use the token configuration feature to specify which optional claims should appear in access tokens, ID tokens, and SAML tokens sent to their applications. This provides greater flexibility for applications that require specific user or tenant attributes at runtime.
SAML Token Encryption
SAML token encryption, an Azure AD Premium feature, is now generally available. While Azure AD already transmits SAML tokens over encrypted HTTPS channels, token-level encryption adds an additional layer of protection by ensuring the token payload itself is encrypted and can only be decrypted by the intended application.
Azure AD Features in Preview
Dynamic Groups Rule Validation
Azure AD’s Dynamic Groups feature automatically adds users to groups based on attribute-based rules. The new rule validation preview lets IT administrators test whether a specific user would be included in a dynamic group under a given rule, before committing the rule to production. This reduces errors in group membership configuration, which has been a common pain point since the feature launched.
Administrative Units
The administrative units preview introduces a way to logically scope administrative permissions within a tenant. An administrative unit acts as a container for Azure AD resources — users and devices — enabling organisations to delegate administration only over specific subsets of their directory.
A typical use case is a large university where different administrators manage different schools. An administrator for the “Business School” administrative unit would only have permission over users and devices in that unit, not the entire directory. This is a meaningful step forward for least-privilege administration in large, complex organisations.
Azure AD B2B and B2C Improvements
Redesigned B2B Collaboration Invitation Emails (GA)
Microsoft updated the invitation emails used in Azure AD B2B collaboration, which govern how external business partners are invited to access shared resources. The redesigned emails are now generally available and are intended to provide external users with clearer context so they can make an informed decision about accepting the invitation.
Invite Internal Users to B2B Collaboration (Preview)
A new preview capability allows administrators to convert existing internal users to B2B guest users, targeting organisations that had previously collaborated with external people without formally classifying them as guests. The conversion retains the user’s existing user ID, user principal name (UPN), group memberships, and app assignments.
SAML-Based Application Support for Azure AD B2C (GA)
Azure AD B2C tenants can now integrate with SAML-based applications at general availability. This means B2C deployments can offer identity providers using OIDC, OAuth, and SAML protocols — including providers such as Salesforce, Facebook, Google, and Active Directory Federation Services (ADFS) — to their end users.
Azure AD and Zero Trust Security
Alongside the feature updates, Microsoft outlined how Azure AD fits into a Zero Trust security model. The core principles of Zero Trust, as stated by Tarek Dawoud, a Microsoft principal program manager, are:
- Verify explicitly — always authenticate and authorise based on all available data points.
- Use least privileged access — limit user access with just-in-time and just-enough-access controls.
- Assume breach — minimise blast radius and segment access; verify end-to-end encryption.
“Azure Active Directory can act as the policy decision point to enforce your access policies based on insights on the user, device, target resource, and environment.”
— Tarek Dawoud, Principal Program Manager, Microsoft
Implementing a full Zero Trust architecture with Azure AD typically requires at minimum Azure AD Premium P1 or P2 licensing, with some advanced scenarios calling for Microsoft 365 E5 licensing. The free-tier SSO and MFA improvements announced in this release do, however, lay a foundation for Zero Trust at no additional cost.
Summary of Key Changes
| Feature | Status | Licensing Required |
|---|---|---|
| Unlimited SSO for all cloud apps | Generally Available | Azure AD Free (any commercial subscription) |
| Bulk operations for users and groups | Generally Available | Azure AD (tier varies) |
| Report-only mode for Conditional Access | Generally Available | Azure AD Premium |
| Continuous Access Evaluation (Exchange, Teams) | Generally Available | Azure AD Premium |
| Combined MFA and SSPR registration | Generally Available | Azure AD (MFA free; SSPR requires Premium) |
| Token configuration | Generally Available | Azure AD (tier varies) |
| SAML token encryption | Generally Available | Azure AD Premium |
| Dynamic Groups rule validation | Preview | Azure AD Premium |
| Administrative units | Preview | Azure AD Premium |
| Redesigned B2B invitation emails | Generally Available | Azure AD B2B |
| Invite internal users to B2B collaboration | Preview | Azure AD B2B |
| SAML-based app support for B2C | Generally Available | Azure AD B2C |
Licensing requirements shown are approximate based on the announcement. Always verify current licensing requirements in the official Microsoft Azure AD documentation, as tiers and entitlements change over time.