Atlas

Fewer trips to the Azure portal, and better answers where you already are. This release of EasyLife 365 Identity lets application owners download a certificate without leaving the app, shows them when their application was last signed into, and opens the admin API to unattended services.

What's new?

1. Download a certificate

   Certificates could be uploaded and replaced in EasyLife 365 Identity, but not read back, so anyone who needed the public key had to open the Azure portal. Every certificate row now has a Download action.

   For an app registration, the action downloads the certificate straight away as Base64 text. For a SAML enterprise application, it opens a short menu, because the format matters to whatever you are configuring:

   • Base64 certificate — the text form most tools expect.
   • PEM certificate — the same key with BEGIN CERTIFICATE and END CERTIFICATE around it.
   • Raw certificate — the binary DER form.
   • Federated certificate XML — SAML federation metadata, ready to hand to a service provider.

   Only the public half of a certificate is ever downloaded. Microsoft Entra ID never returns a private key after upload, so a downloaded file cannot be used to impersonate the application.

   The action is available to whoever may already manage the application's credentials. For anyone else it is visible but disabled.

   Read more in Certificates.

2. Last sign-in on the application overview

   The activity rule asks an application owner a question they had no way to answer: is this application still in use? The answer was collected on every activity scan, but only administrators could see it, in the admin portal.

   The Overview page of an enterprise application now shows a Last sign-in row, next to the application and object identifiers. An application with no recorded sign-in reads No sign-in recorded yet, rather than showing an empty value that could mean either "never" or "not known".

   The row appears for enterprise applications on the Professional plan, and follows the activity scan, so it is as current as the last scan. App registrations do not have sign-in activity of their own and do not show the row.

   Read more in Overview.

3. Application-only access to the admin API

   The EasyLife 365 Identity admin API accepted only a signed-in administrator, so anything unattended, such as a nightly governance job, had to run as a real user account.

   The admin API now also accepts an application token carrying a Microsoft Entra ID application role. An administrator grants the role to the calling application once, and no user account or password is involved:

   • Identity.Config.ReadWrite.All — the whole admin API.
   • Identity.Manage.ReadWrite.All — the Manage operations only: assigning and clearing policies, enabling and disabling sign-in, and deleting applications.

   Nothing changes for the admin portal, which continues to call the same API as the signed-in administrator.

How these updates will affect you

• Application owners can collect a certificate's public key from EasyLife 365 Identity instead of being sent to the Azure portal.
• A SAML integration can be completed from the format the service provider asks for, including federation metadata XML.
• Owners judging an inactivity reminder can see the last recorded sign-in themselves, without access to the admin portal.
• Governance automation can authenticate as an application rather than as a named administrator, which removes a shared user account from your scripts.
• Grant Identity.Manage.ReadWrite.All rather than Identity.Config.ReadWrite.All when a job only assigns policies or changes sign-in state.