Microsoft Entra ID
AuthenticationMicrosoft Entra Connect: Cloud authentication via Staged Rollout
In brief
The documentation, dated August 11, 2026, replaces general transition text with scenarios describing additional interactive sign-ins when users are added to or removed from Staged Rollout. It also covers certain Microsoft Entra ID Protection remediation events, including SSPR and risk remediation.
What Entra admins need to know
Administrators should account for an additional federated or Microsoft Entra sign-in when troubleshooting authentication changes during Staged Rollout transitions.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
title: 'Microsoft Entra Connect: Cloud authentication via Staged Rollout'
description: This article explains how to migrate from federated authentication, to cloud authentication, by using a Staged Rollout.
ms.topic: how-to
ms.date: 07/22/08/11/2026
ai-usage: ai-assisted
ms.subservice: hybrid-connect
ms.custom: sfi-image-nochange
Editing a group (adding or removing users), it can take up to 24 hours for changes to take effect. Seamless SSO will apply only if users are in the Seamless SSO group and also in either a PTA or PHS group.
User Authentication Behavior Duringauthentication behavior during Staged Rollout Transitionstransitions
Scenarios that require an additional federated or managed sign-in
User added to Staged Rollout.When a user is added to a Staged Rollout
(SR) groupgroup, or when a group they belong to isadded to SR, theirenabled for Staged Rollout, the authenticationmethod will transitionexperience doesn't switch from federated tomanaged. This change takes effect after themanaged immediately. The usercompletesmust complete onemoreadditional interactive sign-in using their existing federatedlogin.authentication method. After this sign-in, Microsoft Entra updates the user's state and appliesthemanaged authenticationexperiencefor subsequentlogins.sign-ins.Similarly, whenUser removed from Staged Rollout. When a user is removed fromthe SR groupa Staged Rollout group, or when their group is removed fromSR, they will continueStaged Rollout, the user continues to use managedauthentication until theyauthentication. The user must complete onemoreadditional interactive sign-in.in through Microsoft Entra. Afterthat, federation is re-appliedthis sign-in, Microsoft Entra switches the user back to federated authentication, andfuture logins willsubsequent sign-ins redirect to the federated identity provider.This behavior ensuresMicrosoft Entra ID Protection remediation events. Certain account recovery and Microsoft Entra ID Protection remediation actions, including self-service password reset (SSPR), risk remediation, and risk dismissal, can reset the user's Staged Rollout state. As aseamless transition betweenresult, the user might be redirected to the federated identity provider on their next sign-in. The user must complete one additional interactive sign-in using their existing federated authenticationmethods while maintaining user access continuity and security.method. After this sign-in, Microsoft Entra reestablishes managed authentication for subsequent sign-ins.
Workaround for newly added Staged Rollout users
@@ -2,7 +2,7 @@ title: 'Microsoft Entra Connect: Cloud authentication via Staged Rollout' description: This article explains how to migrate from federated authentication, to cloud authentication, by using a Staged Rollout. ms.topic: how-to-ms.date: 07/22/2026+ms.date: 08/11/2026 ai-usage: ai-assisted ms.subservice: hybrid-connect ms.custom: sfi-image-nochange@@ -208,13 +208,15 @@ To configure Staged Rollout, follow these steps: >Editing a group (adding or removing users), it can take up to 24 hours for changes to take effect. >Seamless SSO will apply only if users are in the Seamless SSO group and also in either a PTA or PHS group. -## User Authentication Behavior During Staged Rollout Transitions+## User authentication behavior during Staged Rollout transitions -When a user is added to a Staged Rollout (SR) group or when a group they belong to is added to SR, their authentication method will transition from federated to managed. This change takes effect after the user completes one more interactive sign-in using their existing federated login. After this sign-in, Microsoft Entra applies the managed authentication experience for subsequent logins.+### Scenarios that require an additional federated or managed sign-in -Similarly, when a user is removed from the SR group or when their group is removed from SR, they will continue to use managed authentication until they complete one more interactive sign-in. After that, federation is re-applied and future logins will redirect to the federated identity provider.+1. **User added to Staged Rollout.** When a user is added to a Staged Rollout group, or when a group they belong to is enabled for Staged Rollout, the authentication experience doesn't switch from federated to managed immediately. The user must complete one additional interactive sign-in using their existing federated authentication method. After this sign-in, Microsoft Entra updates the user's state and applies managed authentication for subsequent sign-ins. -This behavior ensures a seamless transition between authentication methods while maintaining user access continuity and security.+1. **User removed from Staged Rollout.** When a user is removed from a Staged Rollout group, or when their group is removed from Staged Rollout, the user continues to use managed authentication. The user must complete one additional interactive sign-in through Microsoft Entra. After this sign-in, Microsoft Entra switches the user back to federated authentication, and subsequent sign-ins redirect to the federated identity provider.++1. **Microsoft Entra ID Protection remediation events.** Certain account recovery and [Microsoft Entra ID Protection remediation actions](~/id-protection/howto-identity-protection-remediate-unblock.md#how-risk-remediation-works), including self-service password reset (SSPR), risk remediation, and risk dismissal, can reset the user's Staged Rollout state. As a result, the user might be redirected to the federated identity provider on their next sign-in. The user must complete one additional interactive sign-in using their existing federated authentication method. After this sign-in, Microsoft Entra reestablishes managed authentication for subsequent sign-ins. ### Workaround for newly added Staged Rollout users