Thursday, 5 November 2026

macOS Shared Device Keys guidance now flags Platform SSO re-registration

Nine Entra ID pages were updated on 5 November, with the strongest operational guidance concentrated in macOS Platform SSO, Conditional Access, password writeback, custom telephony, and Zendesk provisioning. The clearest rollout consideration is macOS: updated troubleshooting guidance recommends Use Shared Device Keys on macOS 14 or later for wake or unlock authentication errors and says changing the setting triggers device re-registration.

• Entra ID · Troubleshooting

  Shared Device Keys guidance adds a macOS Platform SSO rollout warning

  The updated troubleshooting page recommends enabling Use Shared Device Keys on macOS 14 or later for authentication errors after locking or waking a Mac. It states that changing the setting in an existing deployment triggers device re-registration with Microsoft Entra ID, so administrators should plan the rollout, notify users, and complete the required re-registration.

• Entra ID · Conditional Access

  Authenticator registration now has an explicit delegated permission requirement

  Conditional Access Grant guidance now states that Microsoft Authenticator requires the delegated UserAuthenticationMethod.ReadWrite scope to register credentials. It also clarifies that this registration access is not blocked by the Require device to be marked as compliant grant control.

• Entra ID · Authentication

  Password writeback guidance warns of events 656 and 657 during initial sync

  The guide now warns that first-time password writeback enablement may generate password change events 656 and 657 during password hash resynchronization. It also clarifies how to stop cloud sync writeback or all password writeback, giving administrators cleanup guidance when changing the configuration.

• Entra ID · Authentication

  Custom telephony setup now reserves app-ID creation for the deployment script

  Choose Your Own Telephony instructions now say to leave the provider’s Application (client) ID blank initially, let the setup script create it in step 2, and use only the ID in the deployment summary. Tenant, subscription, and existing app IDs must not be used; following the sequence avoids registration errors.

• Entra ID · Provisioning

  Zendesk provisioning guidance removes its mid-December 2026 OAuth target

  The Zendesk tutorial no longer lists a mid-December 2026 target for OAuth client credentials authentication. It still says support is being introduced and directs customers to the exception process in the meantime, so administrators should use that process for new provisioning integrations.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.