MODIFIED docs/identity/authentication/how-to-authentication-external-method-manage.md

Modified by Akul Loomba on Oct 28, 2025 7:43 PM
📖 View on learn.microsoft.com

+10 / -0 lines changed

Commit: Add FAQ on External Authentication Methods for Windows 10

Changes:

Before

After

 
Include a test group of users for each policy, but not both. If a user is included in both policies, or any policy with both conditions, the user has to satisfy MFA during sign-in. They also have to satisfy the custom control, which makes them redirected to the external provider a second time.
 
## Next steps
 
For more information about how to manage authentication methods, see [Manage authentication methods for Microsoft Entra ID](/entra/identity/authentication/concept-authentication-methods-manage).

 
Include a test group of users for each policy, but not both. If a user is included in both policies, or any policy with both conditions, the user has to satisfy MFA during sign-in. They also have to satisfy the custom control, which makes them redirected to the external provider a second time.
 
## FAQ
### 1. Why doesn’t External Authentication Methods (EAM) work on Windows 10 during device setup?
**Answer:**  
If you are setting up a device running **Windows 10** using an **EAM-only identity**, you may encounter an issue where the **Out-of-Box (OOB) setup experience** fails and prevents you from proceeding with sign-in.
 
This behavior occurs because **Windows 10 does not natively support EAM during OOBE (Out-of-Box Experience)**.  
Microsoft no longer supports Windows 10 (https://www.microsoft.com/en-us/windows/end-of-support?msockid=26a3312b6b246f501ec624846a4f6e11), and there are **no plans to extend EAM support** to it.
 
To use External Authentication Methods for sign-in, **upgrade to Windows 11**
 
## Next steps
 
For more information about how to manage authentication methods, see [Manage authentication methods for Microsoft Entra ID](/entra/identity/authentication/concept-authentication-methods-manage).

MODIFIED docs/external-id/customers/how-to-sign-in-alias.md

Modified by Robert Lyon on Oct 28, 2025 6:56 PM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Update email references to woodgrovebank

Changes:

Before

After

        {
            "signInType": "emailAddress",
            "issuer": "contoso.onmicrosoft.com",
            "issuerAssignedId": "[email protected]"
        },
        {
            "signInType": "username",
            "issuerAssignedId": "dylan123"
        }
    ],
    "mail": "[email protected]",
    "passwordProfile": {
        "password": "passwordValue",
        "forceChangePasswordNextSignIn": false
Use `$filter` to get the user object, and `$select` to return the ID and `identities[]` properties. The following request example shows how to retrieve a user account using the email address as a sign-in identifier.
 
```http
GET https://graph.microsoft.com/v1.0/users?$select=displayName,id,identities&$filter=identities/any(c:c/issuerAssignedId eq '[email protected]' and c/issuer eq 'contoso.onmicrosoft.com')
```
 

        {
            "signInType": "emailAddress",
            "issuer": "contoso.onmicrosoft.com",
            "issuerAssignedId": "[email protected]"
        },
        {
            "signInType": "username",
            "issuerAssignedId": "dylan123"
        }
    ],
    "mail": "[email protected]",
    "passwordProfile": {
        "password": "passwordValue",
        "forceChangePasswordNextSignIn": false
Use `$filter` to get the user object, and `$select` to return the ID and `identities[]` properties. The following request example shows how to retrieve a user account using the email address as a sign-in identifier.
 
```http
GET https://graph.microsoft.com/v1.0/users?$select=displayName,id,identities&$filter=identities/any(c:c/issuerAssignedId eq '[email protected]' and c/issuer eq 'contoso.onmicrosoft.com')
```
 

MODIFIED docs/identity/enterprise-apps/disable-user-sign-in-portal.md

Modified by Dennis Rea on Oct 28, 2025 8:15 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Typo fix

Changes:

Before

After

---
# Disable user sign-in for an application
 
There might be situations while configuring or managing an application where you don't want tokens to be issued for an application. Or, you might want to block an application that you don't want your employees to try to access, like the deprecared Azure AD PowerShell modules (AppID 1b730954-1685-4b74-9bfd-dac224a7b894). To block user access to an application, you can disable user sign-in for the application, which prevents all tokens from being issued for that application.
 
In this article, you learn how to prevent users from signing in to an application in Microsoft Entra ID through both the Microsoft Entra admin center and PowerShell. If you're looking for how to block specific users from accessing an application, use [user or group assignment](./assign-user-or-group-access-portal.md).

---
# Disable user sign-in for an application
 
There might be situations while configuring or managing an application where you don't want tokens to be issued for an application. Or, you might want to block an application that you don't want your employees to try to access, like the deprecated Azure AD PowerShell modules (AppID 1b730954-1685-4b74-9bfd-dac224a7b894). To block user access to an application, you can disable user sign-in for the application, which prevents all tokens from being issued for that application.
 
In this article, you learn how to prevent users from signing in to an application in Microsoft Entra ID through both the Microsoft Entra admin center and PowerShell. If you're looking for how to block specific users from accessing an application, use [user or group assignment](./assign-user-or-group-access-portal.md).

MODIFIED docs/identity/enterprise-apps/manage-app-consent-policies.md

Modified by Diana Richards on Oct 28, 2025 8:07 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Update docs/identity/enterprise-apps/manage-app-consent-policies.md

Changes:

Before

After

Updates to this consent policy will have at least 30 days of given notice.
 
> [!NOTE]
> Starting at the end of October 2025, the Microsoft managed policy will be updated to require admin consent for the following MS Graph permissions: Mail.Read, Mail.ReadWrite, Mail.ReadBasic, Mail.Read.Shared, Mail.ReadBasic.Shared, Mail.ReadWrite.Shared, MailboxItem.Read, Calendars.Read, Calendars.ReadBasic, Calendars.ReadWrite, Calendars.Read.Shared, Calendars.ReadBasic.Shared, Calendars.ReadWrite.Shared, Chat.Read, Chat.ReadWrite, ChannelMessage.Read.All, OnlineMeetings.Read, OnlineMeetings.ReadWrite, OnlineMeetingTranscript.Read.All, OnlineMeetingRecording.Read.All. At the end of November 2025, this will expand to include EAS.AccessAsUser.All, EWS.AccessAsUser.All, IMAP.AcessAsUser.All, POP.AccessAsUser.All

Updates to this consent policy will have at least 30 days of given notice.
 
> [!NOTE]
> Starting at the end of October 2025, the Microsoft managed policy will be updated to require admin consent for the following MS Graph permissions: Mail.Read, Mail.ReadWrite, Mail.ReadBasic, Mail.Read.Shared, Mail.ReadBasic.Shared, Mail.ReadWrite.Shared, MailboxItem.Read, Calendars.Read, Calendars.ReadBasic, Calendars.ReadWrite, Calendars.Read.Shared, Calendars.ReadBasic.Shared, Calendars.ReadWrite.Shared, Chat.Read, Chat.ReadWrite, ChannelMessage.Read.All, OnlineMeetings.Read, OnlineMeetings.ReadWrite, OnlineMeetingTranscript.Read.All, OnlineMeetingRecording.Read.All. At the end of November 2025, this will expand to include EAS.AccessAsUser.All, EWS.AccessAsUser.All, IMAP.AccessAsUser.All, POP.AccessAsUser.All

MODIFIED docs/identity/managed-identities-azure-resources/reference-managed-identity-libraries.md

Modified by Jason Howell on Oct 28, 2025 5:19 PM
📖 View on learn.microsoft.com

+0 / -1 lines changed

Commit: Update reference-managed-identity-libraries.md

Changes:

Before

After

ms.topic: reference
ms.date: 11/11/2024
ms.author: shermanouko
ms.reviewer: rwike77
 
#Customer intent: As a developer, I'd like to know the available libraries that I can use when authenticating my apps using managed identities.
---

ms.topic: reference
ms.date: 11/11/2024
ms.author: shermanouko
 
#Customer intent: As a developer, I'd like to know the available libraries that I can use when authenticating my apps using managed identities.
---
 

MODIFIED docs/identity/managed-identities-azure-resources/overview.md

Modified by Jason Howell on Oct 28, 2025 5:18 PM
📖 View on learn.microsoft.com

+0 / -1 lines changed

Commit: Update overview.md

Changes:

Before

After

ms.topic: overview
ms.date: 08/19/2025
ms.author: shermanouko
ms.reviewer: ryanwi
 
#Customer intent: As a developer, I'd like to securely manage the credentials that my application uses for authenticating to cloud services without having the credentials in my code or checked into source control.
---

ms.topic: overview
ms.date: 08/19/2025
ms.author: shermanouko
 
#Customer intent: As a developer, I'd like to securely manage the credentials that my application uses for authenticating to cloud services without having the credentials in my code or checked into source control.
---
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files