πŸ“‹ Microsoft Entra Documentation Changes

Daily summary for changes since June 21st 2026, 11:17 PM PDT

Report generated on June 22nd 2026, 11:17 PM PDT

πŸ“Š Summary

31
Total Commits
1
New Files
12
Modified Files
0
Deleted Files
12
Contributors

πŸ†• New Documentation Files

+114 lines added
Commit: Sign in to Connect Sync with passwordless authentication (#13478)

πŸ“ Modified Documentation Files

Modified by learn-build-service-prod[bot] on Jun 22, 2026 4:38 PM
πŸ“– View on learn.microsoft.com
+7 / -11 lines changed
Commit: Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/entra-docs (branch main) (#13582)
Changes:
Before
After
- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).
- It elevates your threat detection and response by recording accurate source IP in [Microsoft Entra sign-in logs](/azure/active-directory/reports-monitoring/concept-all-sign-ins) and in [Microsoft Entra audit logs](/entra/identity/monitoring-health/concept-audit-logs).
 
> [!NOTE]
> To achieve source IP restoration for non-Microsoft apps, you must also configure Conditional Access policies and ensure traffic flows through a compliant network. For more information, see [Enable compliant network check with Conditional Access](/entra/global-secure-access/how-to-compliant-network#protect-your-resources-behind-the-compliant-network).
 
## Prerequisites
 
- Administrators who interact with **Global Secure Access** features must have both of the following role assignments depending on the tasks they're performing:
- The [Global Secure Access Administrator role](/azure/active-directory/roles/permissions-reference) role to manage the Global Secure Access features.
- The [Conditional Access Administrator](/azure/active-directory/roles/permissions-reference#conditional-access-administrator) to create and interact with Conditional Access policies.
- The product requires Microsoft Entra ID P1 licenses. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
- You must enable the [Microsoft Traffic Profile](concept-microsoft-traffic-profile.md) to use Source IP restoration.
 
### Known limitations
 
[!INCLUDE [known-limitations-include](../includes/known-limitations-include.md)]
 
## Enable Global Secure Access signaling for Conditional Access
 
- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).
- It elevates your threat detection and response by recording accurate source IP in [Microsoft Entra sign-in logs](/azure/active-directory/reports-monitoring/concept-all-sign-ins) and in [Microsoft Entra audit logs](/entra/identity/monitoring-health/concept-audit-logs).
 
## Prerequisites
 
- Administrators who configure source IP restoration settings must have one of the following role assignments:
- The [Global Secure Access Administrator role](/azure/active-directory/roles/permissions-reference)
- The [Global Administrator role](/azure/active-directory/roles/permissions-reference)
- The product requires Microsoft Entra ID P1 licenses. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
- You must enable the [Microsoft Traffic Profile](concept-microsoft-traffic-profile.md) to use source IP restoration.
 
### Known limitations
 
[!INCLUDE [known-limitations-include](../includes/known-limitations-include.md)]
 
<a name="enable-global-secure-access-signaling-for-conditional-access"></a>
## Enable Global Secure Access signaling for Microsoft Entra ID and Microsoft Graph
 
> [!NOTE]
> Source IP restoration is now enabled by default for new tenants. If you enabled Global Secure Access features in your tenant before June 2025, you might need to explicitly enable source IP restoration.
+3 / -11 lines changed
Commit: Update BYOD documentation and remove preview label
Changes:
Before
After
ai-usage: ai-assisted
---
 
# Bring Your Own Device (Preview)
 
## Overview
 
- Install and register the device using the Company Portal (no device enrollment required).
- Enable private traffic profiles for these users.
 
## Tenant selection and switching (Preview)
 
How the Global Secure Access client selects a tenant depends on platform and Microsoft Entra device state.
 
### Key concepts
- Microsoft Entra joined or hybrid joined: Windows-only device state that establishes tenant ownership and management.
- Microsoft Entra registered: User-associated device identity for BYOD and unmanaged devices across platforms.
 
### Platform behavior
 
ai-usage: ai-assisted
---
 
# Bring Your Own Device
 
## Overview
 
- Install and register the device using the Company Portal (no device enrollment required).
- Enable private traffic profiles for these users.
 
### Platform behavior
 
| Platform/device state | Connection target | Microsoft Entra tunnel | M365 tunnel | Internet tunnel | Private tunnel | Notes |
|---|---|---|---|---|---|---|
| Windows Microsoft Entra Joined and Hybrid joined device | Client connects to the tenant to which device joined. | βœ… | βœ… | βœ… | βœ… | Enable the Sign out option in the client to allow users to sign out and switch to an external tenant. Allows user to switch to a resource tenant using external user access(B2B). |
| Windows Microsoft Entra Registered device | User selects a tenant at first sign-in; remains connected to that tenant. | ❌ | ❌ | ❌ | βœ… | Can switch to other tenant by selecting **Sign out** option on the client. Allows user to switch to a resource tenant using external user access(B2B). |
| MacOS Microsoft Entra Registered device with and without device enrollment | User selects a tenant at first sign-in; remains connected to that tenant | βœ… | βœ… | βœ… | βœ… | Uses Company Portal to Microsoft Entra register the device. |
| Android Microsoft Entra Registered with and without device enrollment | User selects a tenant at first sign-in; remains connected to that tenant | βœ… | βœ… | βœ… | βœ… | Applies to enrolled devices with Company Portal. For unmanaged devices, Microsoft Entra registration can be done with Company portal and Authenticator app. |
| iOS Microsoft Entra Registered with and without device enrollment | User selects a tenant at first sign-in; remains connected to that tenant | βœ… | βœ… | βœ… | βœ… | Applies to enrolled devices with Company Portal. For unmanaged devices, Microsoft Entra registration can be done with Authenticator app. |
 
Modified by Kenga Derdus on Jun 22, 2026 9:55 AM
πŸ“– View on learn.microsoft.com
+0 / -9 lines changed
Commit: Learn Editor: Update concept-native-authentication.md
Changes:
Before
After
 
While browser-delegated authentication offers benefits such as reduced attack vectors and support for single sign-on (SSO), it offers limited UI customization options.
 
## Available authentication methods
 
Currently, native authentication supports local account identity provider for two authentications methods:
 
- Email with one-time passcode (OTP) sign-in.
- Email and password sign-in with support for self-service password reset (SSPR).
 
Native authentication doesn't yet support federated identity providers such as social or enterprise identities.
 
## When to use native authentication
 
When it comes to implementing authentication for mobile and desktop apps on External ID, you have two options:
 
While browser-delegated authentication offers benefits such as reduced attack vectors and support for single sign-on (SSO), it offers limited UI customization options.
 
## When to use native authentication
 
When it comes to implementing authentication for mobile and desktop apps on External ID, you have two options:
 
 
 
 
 
 
 
 
 
Modified by learn-build-service-prod[bot] on Jun 22, 2026 4:38 PM
πŸ“– View on learn.microsoft.com
+3 / -3 lines changed
Commit: Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/entra-docs (branch main) (#13582)
Changes:
Before
After
The export.csv file contains all changes that are about to be exported. Each row corresponds to a change for an object in the connector space and the object is identified by the DN attribute. The DN attribute is a unique identifier assigned to an object in the connector space. When you have many rows/changes in the export.csv to analyze, it may be difficult for you to figure out which objects the changes are for based on the DN attribute alone. To simplify the process of analyzing the changes, use the `csanalyzer.ps1` PowerShell script. The script retrieves common identifiers (for example, displayName, userPrincipalName) of the objects. To use the script:
1. Copy the PowerShell script from the section [CSAnalyzer](#appendix-csanalyzer) to a file named `csanalyzer.ps1`.
2. Open a PowerShell window and browse to the folder where you created the PowerShell script.
1. Run: `.\csanalyzer.ps1 -Path %temp%\export.xml`.
1. You now have a file or multiple files named `processedbatch[n].csv` (where `[n]` is the number of the batch, for example `processedbatch1.csv`) that can be examined in Microsoft Excel. Note that the file provides a mapping from the DN attribute to common identifiers (for example, displayName and userPrincipalName). It currently doesn't include the actual attribute changes that are about to be exported.
 
#### Switch active server
$resolvedXMLtoimport=Resolve-Path -Path ([Environment]::ExpandEnvironmentVariables($xmltoimport))
 
#use an XmlReader to deal with even large files
$result=$readerΒ =Β [System.Xml.XmlReader]::Create($resolvedXMLtoimport)Β 
$result=$reader.ReadToDescendant('cs-object')
if($result)
{
doΒ 
{
#create the object placeholder
#adding them up here means we can enforce consistency
The export.csv file contains all changes that are about to be exported. Each row corresponds to a change for an object in the connector space and the object is identified by the DN attribute. The DN attribute is a unique identifier assigned to an object in the connector space. When you have many rows/changes in the export.csv to analyze, it may be difficult for you to figure out which objects the changes are for based on the DN attribute alone. To simplify the process of analyzing the changes, use the `csanalyzer.ps1` PowerShell script. The script retrieves common identifiers (for example, displayName, userPrincipalName) of the objects. To use the script:
1. Copy the PowerShell script from the section [CSAnalyzer](#appendix-csanalyzer) to a file named `csanalyzer.ps1`.
2. Open a PowerShell window and browse to the folder where you created the PowerShell script.
1. Run: `.\csanalyzer.ps1 -xmltoimport %temp%\export.xml`.
1. You now have a file or multiple files named `processedbatch[n].csv` (where `[n]` is the number of the batch, for example `processedbatch1.csv`) that can be examined in Microsoft Excel. Note that the file provides a mapping from the DN attribute to common identifiers (for example, displayName and userPrincipalName). It currently doesn't include the actual attribute changes that are about to be exported.
 
#### Switch active server
$resolvedXMLtoimport=Resolve-Path -Path ([Environment]::ExpandEnvironmentVariables($xmltoimport))
 
#use an XmlReader to deal with even large files
$result=$reader=[System.Xml.XmlReader]::Create($resolvedXMLtoimport)
$result=$reader.ReadToDescendant('cs-object')
if($result)
{
do
{
#create the object placeholder
#adding them up here means we can enforce consistency
Modified by Geoffrey W Wasilwa on Jun 22, 2026 12:49 PM
πŸ“– View on learn.microsoft.com
+3 / -3 lines changed
Commit: Update version history for Microsoft Entra Connect
Changes:
Before
After
|[2.5.79.0](#25790)|23 Oct 2026 (12 months after release of 2.5.190.0)|
|[2.5.190.0](#251900)|02 Feb 2027 (12 months after release of 2.6.1.0)|
|[2.6.1.0](#2610)|10 Mar 2027 (12 months after release of 2.6.3.0)|
|[2.6.3.0](#2630)|22 Jun 2027 (12 months after release of 2.6.78.0)|
|[2.6.78.0](#26780)||
 
**All other versions are not supported**
 
 
 
 
## 2.6.78.0
 
> [!IMPORTANT]
> This release includes security fixes. We recommend upgrading to this version as soon as possible.
|[2.5.79.0](#25790)|23 Oct 2026 (12 months after release of 2.5.190.0)|
|[2.5.190.0](#251900)|02 Feb 2027 (12 months after release of 2.6.1.0)|
|[2.6.1.0](#2610)|10 Mar 2027 (12 months after release of 2.6.3.0)|
|[2.6.3.0](#2630)|22 Jun 2027 (12 months after release of 2.6.79.0)|
|[2.6.79.0](#26790)||
 
**All other versions are not supported**
 
 
 
 
## 2.6.79.0
 
> [!IMPORTANT]
> This release includes security fixes. We recommend upgrading to this version as soon as possible.
Modified by learn-build-service-prod[bot] on Jun 22, 2026 4:38 PM
πŸ“– View on learn.microsoft.com
+1 / -1 lines changed
Commit: Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/entra-docs (branch main) (#13582)
Changes:
Before
After
 
## Related content
 
- [Enable Global Secure Access signaling for Conditional Access](how-to-source-ip-restoration.md#enable-global-secure-access-signaling-for-conditional-access)
- [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2)
- [Enable source IP restoration](how-to-source-ip-restoration.md)
- [Enable compliant network check with Conditional Access](how-to-compliant-network.md)
 
## Related content
 
- [Enable Global Secure Access signaling for Microsoft Entra ID and Microsoft Graph](how-to-source-ip-restoration.md#enable-global-secure-access-signaling-for-microsoft-entra-id-and-microsoft-graph)
- [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2)
- [Enable source IP restoration](how-to-source-ip-restoration.md)
- [Enable compliant network check with Conditional Access](how-to-compliant-network.md)
Modified by learn-build-service-prod[bot] on Jun 22, 2026 4:38 PM
πŸ“– View on learn.microsoft.com
+2 / -0 lines changed
Commit: Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/entra-docs (branch main) (#13582)
Changes:
Before
After
* If needed, [create a Microsoft Entra tenant][create-azure-ad-tenant] or [associate an Azure subscription with your account][associate-azure-ad-tenant].
* A Microsoft Entra Domain Services managed domain enabled and configured in your Microsoft Entra tenant.
* If needed, [create and configure a Microsoft Entra Domain Services managed domain][create-azure-ad-ds-instance].
 
## Use Security settings to harden your domain
 
 
 
* If needed, [create a Microsoft Entra tenant][create-azure-ad-tenant] or [associate an Azure subscription with your account][associate-azure-ad-tenant].
* A Microsoft Entra Domain Services managed domain enabled and configured in your Microsoft Entra tenant.
* If needed, [create and configure a Microsoft Entra Domain Services managed domain][create-azure-ad-ds-instance].
* You need [Application Administrator](/entra/identity/role-based-access-control/permissions-reference#application-administrator) and [Groups Administrator](/entra/identity/role-based-access-control/permissions-reference#groups-administrator) Microsoft Entra roles in your tenant to modify security settings for a managed domain.
* You need [Domain Services Contributor](/azure/role-based-access-control/built-in-roles#domain-services-contributor) Azure role to modify security settings for a managed domain.
 
## Use Security settings to harden your domain
 
Modified by Ortagus Winfrey on Jun 22, 2026 2:18 PM
πŸ“– View on learn.microsoft.com
+1 / -1 lines changed
Commit: Remove wipe mode from jailbreak detection rollout phases
Changes:
Before
After
**Service category:** Microsoft Authenticator App
**Product capability:** Identity Security & Protection
Starting February 2026, Microsoft Authenticator will introduce jailbreak/root detection for Microsoft Entra credentials in the Authenticator app. The rollout progresses from warning mode β†’ blocking mode β†’ wipe mode. Users must move to compliant devices to continue using Microsoft Entra accounts in Authenticator.
---
**Service category:** Microsoft Authenticator App
**Product capability:** Identity Security & Protection
Starting February 2026, Microsoft Authenticator will introduce jailbreak/root detection for Microsoft Entra credentials in the Authenticator app. The rollout progresses from warning mode β†’ blocking mode. Users must move to compliant devices to continue using Microsoft Entra accounts in Authenticator.
---
+1 / -0 lines changed
Commit: Add Account Discovery link to provisioning Next steps
Changes:
Before
After
 
- [App provisioning](user-provisioning.md)
- [Tutorial: ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
 
 
- [App provisioning](user-provisioning.md)
- [Tutorial: ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
- [Discover identities in target applications with Account Discovery](how-to-account-discovery.md)
+1 / -0 lines changed
Commit: Add Account Discovery link to provisioning Next steps
Changes:
Before
After
- [App provisioning](user-provisioning.md)
- [ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
- [ECMA Connector Host LDAP connector](on-premises-ldap-connector-configure.md)
 
- [App provisioning](user-provisioning.md)
- [ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
- [ECMA Connector Host LDAP connector](on-premises-ldap-connector-configure.md)
- [Discover identities in target applications with Account Discovery](how-to-account-discovery.md)
+1 / -0 lines changed
Commit: Add Account Discovery link to provisioning Next steps
Changes:
Before
After
 
- [App provisioning](user-provisioning.md)
- [Tutorial: ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
 
 
- [App provisioning](user-provisioning.md)
- [Tutorial: ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
- [Discover identities in target applications with Account Discovery](how-to-account-discovery.md)
+1 / -0 lines changed
Commit: Add Account Discovery link to provisioning Next steps
Changes:
Before
After
- [App provisioning](user-provisioning.md)
- [ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
- [ECMA Connector Host LDAP connector](on-premises-ldap-connector-configure.md)
 
- [App provisioning](user-provisioning.md)
- [ECMA Connector Host generic SQL connector](tutorial-ecma-sql-connector.md)
- [ECMA Connector Host LDAP connector](on-premises-ldap-connector-configure.md)
- [Discover identities in target applications with Account Discovery](how-to-account-discovery.md)