Choose Your Own Telephony Set Up
Authentication
The documentation now directs administrators through Function App → Functions → SendOtp → Invocations when checking the latest transaction and HTTP 200 result.
Product
Microsoft Entra ID
Track documentation and Message Center changes for Microsoft Entra ID.
Microsoft Learn documentation ↗Latest Microsoft Entra ID changes
Configure Group Source of Authority (SOA)
General
The guide now covers connecting with Microsoft Graph PowerShell, required permissions and cloud settings, troubleshooting consent, and the PowerShell command for changing a group’s source of authority.
Configure Salesforce for automatic user provisioning with Microsoft Entra ID
Provisioning
The tutorial now requires SOAP API `login()` to be enabled and the Admin Username account to have **Use Any API Auth**. It also documents credential-validation troubleshooting and Salesforce’s December 1, 2026 requirement.
Configure Salesforce Sandbox for automatic user provisioning with Microsoft Entra ID
Provisioning
The tutorial adds requirements to enable SOAP API `login()` and grant the integration account API Enabled, Manage Users, and Use Any API Auth permissions. It also documents Salesforce’s December 1, 2026 requirement for Use Any API Auth and related credential errors.
Credential Management Api
Authentication
The article now says the passkey sample demonstrates listing, registration, and deletion flows, and removes the previous Microsoft Graph deletion-flow warning.
Customer intent: As an administrator, I want to understand sign-in frequency controls so that I can require fresh authentication for sensitive applic…
Authentication
The documentation now describes Every time strict, including its 10-second validity window, application session-management requirements, targeting guidance, and Office 365 warning. It also explains Global Secure Access reauthentication for sensitive private applications using a five-minute window.
Deployment Guide Token Protection Windows
Security
The documentation now states that Office perpetual clients version 2024 and later support Token Protection, while versions earlier than 2024 aren't supported.
Group Source Of Authority Configure
Fundamentals
The Update-MgGroupOnPremiseSyncBehavior and Get-MgGroupOnPremiseSyncBehavior links no longer include the graph-powershell-1.0 view parameter.
Group Source Of Authority Configure
General
The page no longer includes the note that Graph Explorer is unsupported in Azure China or the instructions to use Microsoft Graph PowerShell for sovereign clouds.
Group Source Of Authority Configure
Fundamentals
The documentation changed the SOA-related resource table into a bulleted list while retaining the same three Microsoft Graph PowerShell links.
Group Source Of Authority Configure
General
The documentation now lists Microsoft Graph PowerShell commands to read and update a group’s `IsCloudManaged` state, and documents cloud-specific authentication options. It also notes that Graph Explorer isn’t supported in Azure China.
Howto Vm Sign In Azure Ad Linux
Authentication
The documentation now explains that in-place upgrades from RHEL 8.x to 9.x can remove the `aadsshlogin` package, causing `Permission denied (publickey)` errors. It provides steps to uninstall and reinstall the AADSSHLoginForLinux extension.
Microsoft Entra ID: Microsoft-provided SMS and voice authentication to retire for self-service password reset (SSPR)
Conditional Access
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication for self-service password reset (SSPR) starting February 2027, with a 50-day transition per user group. Organizations must prepare alternative recovery methods, as SMS/voice will no longer be available for SSPR after the transition.
System Preferred Authentication
Authentication
The table now lists External multifactor authentication as method 3, Certificate-based authentication as method 4, and Microsoft Authenticator notifications as method 5. The External MFA entry also has updated dash formatting.
User Source Of Authority Configure
General
The documentation now explains how to install and connect with Microsoft Graph PowerShell, select cloud environments, grant required permissions, and update a user’s source of authority with PowerShell.
User Source Of Authority Configure
Monitoring
The User Source of Authority configuration guide now links to the current Microsoft Graph PowerShell cmdlet pages without the `view=graph-powershell-1.0` version parameter.
User Source Of Authority Configure
General
The configuration article now links to Microsoft Graph PowerShell cmdlets for updating and retrieving a contact’s on-premises sync behavior.
User Source Of Authority Configure
General
The article now describes contacts as Outlook items, retains the required Contacts-OnPremisesSyncBehavior.ReadWrite.All permission, and uses a generic contact PATCH example. Detailed SOA read, transfer, verification, PowerShell, sovereign-cloud, and contact cmdlet guidance was removed.
User Source Of Authority Configure
Provisioning
The article adds Microsoft Graph API and PowerShell examples for transferring the source of authority (SOA) for organizational contacts synchronized from AD DS, including permissions, verification, and sovereign-cloud guidance.
User Source Of Authority Configure
General
The documentation now lists Graph PowerShell commands for setting and reading user SOA, identifies the Hybrid Administrator role, and documents cloud-specific connection environments. It also notes that Graph Explorer isn't supported in Azure China.
Choose Your Own Telephony Fraud Costs
Authentication
The documentation now links to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center instead of the API-based setup guide.
Choose Your Own Telephony Reliability
Authentication
The article now links to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center instead of the API-based setup guide.
Choose Your Own Telephony Troubleshoot
Authentication
The troubleshooting page’s setup link was updated from API-based instructions to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center.
Phone Providers
Authentication
The documentation now links Infobip’s Microsoft Security Store offer and directs administrators to the Microsoft Entra admin center setup guide instead of the API setup guide.
Set up SMS and voice with your own telecom provider in the Microsoft Entra admin center
Authentication
The documentation adds an end-to-end guide for purchasing and activating a telecom provider, deploying the Azure integration, configuring authentication method profiles, validating evaluation mode, and gradually rolling out SMS and voice delivery.
Set Up Sms Voice Api
Authentication
The article describing CYOT provider purchase, Azure integration deployment, permissions, policy configuration, and testing is no longer documented at this location.
(Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants
Authentication
Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing tenants will be auto-migrated to a default passkey profile with configurable passkeyType. Registration campaign settings and rollout timelines vary by cloud region.
Choose Your Own Telephony Fraud Costs
Authentication
The documentation link for monitoring and troubleshooting SMS and voice with your own telecom provider now points to the custom-telephony troubleshooting page.
Choose your own telephony provider for SMS and voice authentication
Authentication
The article now explains CYOT architecture, Azure Function integration, supported providers, and planning considerations such as coverage, pricing, fraud protection, resiliency, and costs.
Choose Your Own Telephony Reliability
Authentication
The monitoring and troubleshooting references now point to the dedicated choose-your-own-telephony troubleshooting page.
General Availability: Microsoft Entra passkeys on Windows
Conditional Access
Microsoft Entra passkeys on Windows will be generally available from late April 2026, enabling passwordless, phishing-resistant sign-in on Windows devices without requiring explicit admin allow-listing. It supports corporate, personal, and shared devices, with control via Authentication Methods policies and Conditional Access. No action is needed unless blocking is desired.
Microsoft Entra: Choose your own telephony provider now generally available
Authentication
Microsoft Entra ID now generally supports Choose Your Own Telephony Provider (CYOT) for SMS and voice authentication, retiring Microsoft-provided services by February 1, 2027. Organizations must select a provider, set up CYOT, and transition before that date, while Microsoft recommends phishing-resistant methods like passkeys.
Phone Providers
Authentication
The phone providers documentation now links SMS and voice troubleshooting guidance to the dedicated `choose-your-own-telephony-troubleshoot.md` page.
Plan for resiliency and high availability
Authentication
The documentation explains CYOT delivery dependencies and resiliency approaches, including multi-region Azure Front Door deployments, secondary telecom providers, failover testing, capacity planning, and associated costs.
Protect against telephony fraud with your own telecom provider
Authentication
A new article explains how to configure telecom-provider fraud, destination, channel, spending, and alert controls; secure the CYOT integration; monitor activity; and respond to suspected fraud.
Set up SMS and voice
Authentication
The article now uses a shorter title and consolidated guidance emphasizing that CYOT updates the existing SMS or voice policy, may affect current users, and requires preserving production `includeTargets`. It also recommends saving the current policy JSON and using a test tenant for alternate targeting.
Set up SMS and voice with your own telecom providers
Authentication
The new guide explains how to connect Microsoft Entra SMS and voice authentication to a telecom provider using CYOT, including purchasing, Azure deployment, permissions, policy configuration, testing, and rollout.
Set Up Sms Voice Api
Authentication
The SMS/voice API setup documentation now links its rollout and diagnostic references to the choose-your-own-telephony troubleshooting page.
SMS-based user sign-in for Microsoft Entra ID
Authentication
The documentation states that Microsoft-provided SMS and voice authentication, including SMS first-factor sign-in, retires on February 1, 2027. It also updates the setting label to “Enable first factor sign-in” and notes automatic disabling after 30 days without traffic.
Troubleshoot MFA voice call and SMS problems
Authentication
The article now covers general Microsoft Entra MFA SMS and voice problems, including telecom delivery, Microsoft’s visibility, and investigation using correlation IDs and timestamps. CYOT-specific troubleshooting content was replaced, and phishing-resistant alternatives are recommended.
Troubleshoot SMS and voice with your own telecom provider
Authentication
The documentation explains how to trace Choose Your Own Telephony Provider requests across Microsoft Entra audit logs, sign-in logs, Function App logs, and the telecom provider portal, including relevant fields and queries.
Troubleshoot SMS and voice with your own telecom provider
Authentication
The article now explains how to trace Choose Your Own Telephony Provider requests through Microsoft Entra audit and sign-in logs, Function App logs, and the telecom provider portal.
Brivo Onair Identity Connector Provisioning Tutorial
Provisioning
The tutorial now links to Brivo’s contact page instead of its quote page for obtaining a Brivo Onair Identity Connector tenant.
Combined registration for SSPR and Microsoft Entra multifactor authentication
Authentication
Organizations can allow users to change cloud passwords after authenticating with a registered FIDO2 passkey or Windows Hello for Business credential, without knowing the current password or using SSPR. Temporary Access Pass isn't supported unless the user knows the existing password.
Configure AD user and group enforcement in Microsoft Entra Cloud Sync
Provisioning
The documentation now requires all writable domain controllers to meet specified Windows Server update levels and requires ADSyncTools version 2.6.0 or later. It also adds a warning that enforcement cannot be configured if any writable domain controller is unsupported.
Microsoft Authenticator: Usability improvements for iOS and Android
Authentication
Microsoft Authenticator for iOS and Android will receive usability updates starting November 2026, including a refreshed home experience, clearer account restoration guidance, improved sign-in flows, and platform-specific prompts. Android improvements for restoration and battery optimization prompts will follow in January 2027. No action required.
Microsoft Entra AD object enforcement
Provisioning
The title no longer includes “(Preview),” and the publication date changed from August 11, 2026, to October 29, 2026.
Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication
Authentication
Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.
Registration Mfa Sspr Combined
Authentication
The documentation section describing password changes after sign-in with CBA, FIDO2 passkeys, or Authenticator passwordless notifications was revised.
Registration Mfa Sspr Combined
Authentication
The documentation now uses the exact name of the secure sign-in setting related to changing cloud passwords after passwordless sign-in.
Registration Mfa Sspr Combined
Authentication
The documentation updates the name of the password-change flow available after CBA, passkey, or Authenticator passwordless sign-in.
Registration Mfa Sspr Combined
Authentication
The combined MFA and SSPR registration documentation updates its passwordless sign-in reference with a link to the relevant passwordless documentation.
Registration Mfa Sspr Combined
Authentication
The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.
Self-service password reset deep dive
Authentication
The documentation now explains how users can change Microsoft Entra cloud passwords with FIDO2 passkeys or Windows Hello for Business, including the tenant-wide setting required to enable the experience and its limitation for on-premises password writeback.
Sspr Howitworks
Authentication
The documentation now states that rollout across all clouds begins in late October 2026 and is expected to finish by the end of November 2026.
Sspr Howitworks
Authentication
The page now labels the section “Allow password change after secure sign-in” and its subsection “Enable the setting,” replacing the previous “Passwordless authentication” heading.
Sspr Howitworks
Authentication
The heading “Allow password change after secure sign-in” now ends with a period.
Sspr Howitworks
Authentication
The documentation updates the section heading and setting label to “Allow password change after secure sign-in.”
Sspr Howitworks
Authentication
The documentation now states that users need a Microsoft Entra ID P1 or P2 license to use this feature.
Sspr Howitworks
Authentication
The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.
Sspr Howitworks
Authentication
In hybrid environments, password changes made with passwordless authentication can be written to an on-premises directory when password writeback is configured.
Sspr Howitworks
Authentication
The documentation now lists Microsoft Entra CBA, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change a cloud password without entering the current password.
Usage and insights report
Fundamentals
The documentation now explains that reported last activity can include incomplete sign-ins absent from sign-in logs. A timestamp does not confirm successful authentication or token issuance, and some partial activity may be misclassified as app-only during preview.
Configure Puzzel for automatic user provisioning with Microsoft Entra ID
Provisioning
The documentation states that OAuth 2.0 Authorization Code Grant is being retired for Puzzel provisioning. Affected jobs should use OAuth 2.0 Client Credentials Grant; otherwise provisioning may stop working after the deadline.
Configure Vonage for automatic user provisioning with Microsoft Entra ID
Provisioning
Vonage provisioning will stop supporting OAuth 2.0 Authorization Code Grant after March 31, 2027. The updated procedure generates and uses client credentials; SSO is unaffected.
Enable Authenticator Passkey
Conditional Access
The documentation now states that the Microsoft Authenticator Credential Registration resource will be available in November 2026. It also retains the prerequisite to provision the enterprise application before excluding the resource from a Conditional Access policy.
Microsoft Entra ID: Final reminder to replace MemberOf rule operator configurations by November 3, 2026
Conditional Access
Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations using MemberOf in dynamic groups, administrative units, or entitlement policies must replace it to avoid outdated memberships, access, and licensing issues. Action is required before this date to maintain proper functionality.
Microsoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in
Authentication
Microsoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September to November 2026. SMS for MFA and password reset remains unaffected. Admins should review usage, notify users, and ensure alternate sign-in methods.
Snowflake Provisioning Tutorial
Standards
The tutorial’s task lists were changed from numbered items to bullet points; the instructions and screenshots remain the same.
Snowflake Provisioning Tutorial
Standards
The tutorial now links to Snowflake SCIM documentation, specifies using an account administrator, explains the SQL script, emphasizes that `AAD_PROVISIONER` is case-sensitive and uppercase, and adds related authentication links.
Support passkeys in Authenticator in your Microsoft Entra ID tenant
Authentication
The guidance now documents provisioning the Microsoft Authenticator Credential Registration enterprise application and excluding it from Conditional Access policies scoped to All resources to unblock passkey registration.
Microsoft Authenticator: Improved backup and restore experience for Android
Authentication
Microsoft Authenticator for Android will improve backup and restore with clearer setup guidance and support for passkeys starting mid-January 2027. Users must enable Google One backup and screen lock. Work/school accounts aren’t backed up, and backup works only in the Android personal profile. No admin action needed.
Microsoft Entra ID: Reminder to migrate from Microsoft-provided SMS and voice authentication
Authentication
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.
Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors
Conditional Access
Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting early November 2026, allowing users to satisfy MFA without additional passkeys. No configuration changes are needed, but organizations should update onboarding and MFA registration guidance accordingly.
Snowflake Tutorial
General
The tutorial now uses single quotes in the Snowflake ALTER SECURITY INTEGRATION commands and links to Snowflake’s SAML2 security integration guide.
Snowflake Tutorial
General
The tutorial now uses the Account Administrator role, reorganizes the SQL setup steps, updates Snowflake URL parameters, and links to automated user provisioning and deprovisioning.
Configure Secure Cloud User Integration for automatic user provisioning with Microsoft Entra ID
Provisioning
Microsoft added a step-by-step tutorial for configuring automatic user and group provisioning, updates, synchronization, and deprovisioning between Microsoft Entra ID and Secure Cloud using SCIM 2.0.
Configure Secure Cloud User Integration for single sign-on with Microsoft Entra ID
Standards
A new article explains how to configure Secure Cloud User Integration with Microsoft Entra ID using OIDC, including prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification.
Create a Conditional Access policy plan (preview)
Conditional Access
A new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method
Conditional Access
Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins November 2026, aiming to simplify strong authentication adoption and reduce registration friction.
Migrate Conditional Access policies to a policy plan (preview)
Conditional Access
A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
What are Microsoft Entra Conditional Access policy plans? (preview)
Conditional Access
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
Manage Object Connections - Microsoft Graph
Provisioning
New documentation explains how to inspect or remove stored source-to-target connections for provisioning jobs, including required identifiers, permissions, and recovery steps. The API is available through Microsoft Graph beta and deleting a connection does not delete either object.
Microsoft Entra HR provisioning timeouts
Troubleshooting
A new article explains how to diagnose intermittent timeouts and slow provisioning from Workday, SAP SuccessFactors, and API-driven HR integrations to on-premises Active Directory. It covers job status, provisioning agents, matching attributes, domain controllers, DNS, connectivity, and relevant logs.
Object Connection IDs - Microsoft Entra ID
Provisioning
A new reference lists source and target identifiers for provisioning scenarios, their required formats, and how to use them with Microsoft Graph to inspect or delete connections.
Prerequisites for Microsoft Entra Cloud Sync
General
The prerequisites now explain how incorrect DNS, subnet-to-site mappings, or site configuration can cause provisioning synchronization failures, performance issues, and intermittent connectivity. It directs administrators to correctly map agent server subnets in Active Directory Sites and Services.
System-preferred authentication in Microsoft Entra ID
Authentication
The article now explains that system-preferred authentication considers the user’s current device and browser, prioritizes accessible local passkeys, and handles device-bound credentials such as Windows Hello for Business and macOS Platform SSO by platform.
Application Properties
Developer
The documentation now states that tenant administrators cannot reverse Microsoft disablement by enabling tenant-local sign-in or reactivating the app registration.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
Device Sync
General
The article now explains that it covers configuring Device Sync in Microsoft Entra Cloud Sync, not transferring Device Sync with the guided migration tool. It links to the tool’s prerequisites.
Macos Platform Sso Architecture
Authentication
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
Mfa Number Match
Authentication
The documentation now shows an updated Android screenshot and describes selecting Approve or Deny instead of Yes or No for relevant number-matching prompts in Authenticator, Teams, and Outlook.
Microsoft Entra Cloud Sync migration decision guide
Provisioning
The guide now distinguishes platform capability comparisons from what the guided migration tool can transfer. It identifies device synchronization as a current guided-tool blocker and adds separate guidance for guided, manual, or deferred migration paths.
Migrate Connect Sync Cloud Sync Tool
General
The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.
Migrate to Microsoft Entra Cloud Sync
Provisioning
The documentation now directs administrators to a migration decision guide, guided-tool eligibility checks, or manual phased migration guidance. It also clarifies scope protection, reference validation, and migration-result verification.
Plan Cloud Sync Topologies
Monitoring
The documentation now explains that Connect Sync and Cloud Sync may coexist during a phased migration, but must not simultaneously export normal changes for the same object and attribute set. It adds links to manual migration steps and scope-removal planning.
Protect against consent phishing
Security
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
Tutorial - Migrate to Microsoft Entra Cloud Sync for a Synced Active Directory Forest
General
The tutorial now emphasizes manual migration for test or pilot environments, directs eligible customers to the guided migration tool, adds scope-removal and source-anchor guidance, clarifies device migration coverage, and links related migration resources.
What Is Cloud Sync
Fundamentals
The page now directs Connect Sync users to review the decision guide, validate guided-tool prerequisites, and choose a supported guided or manual migration path. It also links the migration FAQ and separates Device Sync review from guided-tool eligibility.
Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles
Governance
Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.
Validate an OIDC app for Microsoft Entra App Gallery onboarding
Standards
The document author was changed from hkinyunyu to HildaK-pm.
Validate an OIDC app for Microsoft Entra App Gallery onboarding
Standards
The documentation now describes validation for both single-tenant and multitenant OIDC applications, including configuration-specific endpoint requirements and eligibility guidance.
Validate an OIDC multitenant app for Microsoft Entra App Gallery onboarding
Standards
The page author and manager metadata were changed.
Device Join Macos Platform Single Sign On Kerberos Configuration
Authentication
The documentation expands access from limited availability and updates setup links. It also clarifies that the storage account app registration must use a lowercase `cifs` identifier URI for SMB mounting on macOS.
Architecture and authentication flow for macOS Platform SSO with Microsoft Entra ID
Authentication
The page title was simplified, and the role descriptions now state that the Microsoft Enterprise SSO plug-in performs device and user registration with Microsoft Entra ID. Microsoft Entra ID is described as verifying credentials and proofs and issuing the PRT.
Add Microsoft Entra ID for customer sign-in
Authentication
The FAQ now states that identity provider buttons cannot be hidden. Removing a provider from a user flow prevents users from signing up or redeeming invitations with that provider, and `domain_hint` does not change this.
Security Defaults
Fundamentals
The Security Defaults article no longer includes the section describing individual protections, their preview availability, roles, behavior, and management steps.
Application Properties
Developer
The documentation now explains that Deactivated can result from tenant-local sign-in disablement, app registration deactivation, or Microsoft disablement. It also documents the related properties and clarifies that these conditions can overlap and must be remediated independently.
Architecture and authentication flow for macOS Platform SSO (Apple) with Microsoft Entra ID
Authentication
Microsoft added a conceptual guide describing macOS Platform SSO registration, Secure Enclave device keys, the Platform SSO PRT, app SSO, and the roles of MDM, macOS, the Microsoft Enterprise SSO plug-in, and Microsoft Entra ID.
Deactivate an app registration
Microsoft identity platform
The article now distinguishes deactivating an app registration from disabling sign-in on a tenant-local service principal. It also explains that activation status includes tenant-local and Microsoft disablement, and that reactivating the app registration does not automatically restore tenant-local sign-in.
Disable user sign-in for application
Authentication
The article now explains that disabling sign-in sets the service principal’s `accountEnabled` property to `false` and changes Activation status to Deactivated. It also adds steps to restore tenant-local sign-in and notes that other deactivation conditions can still apply.
Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in
Authentication
The documentation explains when users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls, including user experience, network requirements, and help-desk guidance.
Add Microsoft Entra ID for customer sign-in
Authentication
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
Delegate App Roles
Developer
The documentation now links to the “Restricting who can create applications and agents” section in two references, including the application registration error guidance.
Delegate application and agent management administrator permissions
Developer
The article now covers application and agent creation and management. It documents the **Users can create agent blueprints** setting, which administrators can turn off to restrict agent blueprint creation to administrators and Agent ID Developers.
Microsoft Purview | Information Protection: Sensitivity labels for Microsoft Entra security groups
Governance
Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026, allowing administrators to apply and enforce governance policies on these groups. Labels can be assigned via multiple platforms, cannot yet be changed once applied, and require separate tenant configuration from Microsoft 365 groups.
Permissions Reference
General
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
Provision On Demand
Fundamentals
Step 1 now links to the permissions reference anchor without the `.md` suffix.