MODIFIED docs/identity/authentication/concept-sspr-howitworks.md

Modified by Dr Bill Mcilhargey on Dec 10, 2025 4:21 PM
📖 View on learn.microsoft.com

+6 / -8 lines changed

Commit: Update authentication methods in SSPR documentation for clarity and accuracy

Changes:

Before

After

 
The following authentication methods are available for SSPR:
 
* Mobile app notification
* Mobile app code
* Hardware OATH token
* Software OATH token
* Email
* Mobile phone
* Office phone (available only for tenants with paid subscriptions)
* Security questions
 
Users can only reset their password if they register an authentication method that the administrator has enabled.
 

 
The following authentication methods are available for SSPR:
 
* [Microsoft Authenticator push notifications](concept-authentication-authenticator-app.md)
* [Hardware OATH tokens (preview)](concept-authentication-oath-tokens.md#hardware-oath-tokens)
* [Software OATH tokens](concept-authentication-oath-tokens.md#software-oath-tokens)
* [Short Message Service (SMS) sign-in](concept-authentication-phone-options.md#sms-sign-in)
* [Voice call](concept-authentication-phone-options.md#voice-call)
* [Email OTP](concept-authentication-email-otp.md)
 
Users can only reset their password if they register an authentication method that the administrator has enabled.

MODIFIED docs/global-secure-access/concept-b2b-guest-access.md

Modified by Michael Morten Sonne | Microsoft MVP on Dec 10, 2025 7:56 AM
📖 View on learn.microsoft.com

+4 / -0 lines changed

Commit: Update B2B guest access documentation for Global Secure Access B2B

Changes:

Before

After

**Q: Can I configure MFA on the resource tenant?**   
A: Yes, you can configure MFA on the user and on the applications.
 
## Known limitations
- B2B guest access doesn't support keeping the Internet Access, Microsoft 365, and Microsoft Entra tunnels to the home tenant.
- Switching an account to the resource tenant fails when the resource tenant is configured for required MFA in the cross-tenant configuration and the home tenant is configured with passwordless sign-in (PSI) on the authenticator app.

**Q: Can I configure MFA on the resource tenant?**   
A: Yes, you can configure MFA on the user and on the applications.
 
**Q: How does a home tenant (external tenant) user access an on-premises resource in the resource tenant when the resource uses AD DS and Kerberos (such as a file share or a Kerberos-integrated application)?**  
A: This scenario isn't supported. Microsoft Entra B2B doesn't provide Kerberos tickets, and Global Secure Access Private Access doesn't proxy Kerberos or support Kerberos Constrained Delegation (KCD). As a result, guest users can't directly access on-premises resources requiring Kerberos (for example, SMB file shares or applications using Integrated Windows Authentication).  
For web applications, the only supported method for B2B users to access Kerberos-backed on-premises apps is by publishing the app through **Application Proxy with KCD**. For more information, see [Configure single sign-on with Kerberos constrained delegation](../identity/app-proxy/how-to-configure-sso-with-kcd.md).
 
## Known limitations
- B2B guest access doesn't support keeping the Internet Access, Microsoft 365, and Microsoft Entra tunnels to the home tenant.
- Switching an account to the resource tenant fails when the resource tenant is configured for required MFA in the cross-tenant configuration and the home tenant is configured with passwordless sign-in (PSI) on the authenticator app.

MODIFIED docs/identity/conditional-access/concept-condition-filters-for-devices.md

Modified by John Flores on Dec 10, 2025 3:18 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Correct link formatting in condition filters documentation

Changes:

Before

After

   1. Under **Include**, select **Directory roles**, then all roles with administrator in the name.
   
      > [!WARNING]
      > Conditional Access policies support built-in roles. Conditional Access policies are not enforced for other role types including [administrative unit-scoped](../role-based-access-control/manage-roles-portal.md or [custom roles](../role-based-access-control/custom-create.md).
 
   1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts. 
   1. Select **Done**.

   1. Under **Include**, select **Directory roles**, then all roles with administrator in the name.
   
      > [!WARNING]
      > Conditional Access policies support built-in roles. Conditional Access policies are not enforced for other role types including [administrative unit-scoped](../role-based-access-control/manage-roles-portal.md) or [custom roles](../role-based-access-control/custom-create.md).
 
   1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts. 
   1. Select **Done**.

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files