Tuesday, 6 October 2026

The article was edited for spelling, headings, and presentation while retaining its documented enforcement phases, dates, affected applications, account scope, and break-glass guidance.

The guidance now states that Microsoft Authenticator, software OATH tokens, and hardware OATH tokens count as one authentication method for SSPR, regardless of Authentication methods policy migration status.

The native authentication API reference was updated with spelling corrections. The supplied examples, links, endpoints, error details, and configuration guidance remain unchanged.

The tutorial’s code comment was corrected from “Thge” to “The” and from “rquired” to “required.”

The article fixes the spelling of “OpenID Connect” and replaces an empty .NET NuGet link with an Azure Functions API link, along with other wording corrections.

The page no longer includes the `ms.author: justinha` metadata entry.

The passwordless authentication documentation no longer includes the `author` and `ms.author` fields.

The documentation fixes minor formatting in the scope notes and corrects the image text from `HKEY_LOCAL_MACHIEN` to `HKEY_LOCAL_MACHINE`.

The username/password token acquisition article no longer includes the author, manager, and ms.author fields.

The decision guide now states that Cloud Sync supports device synchronization for Microsoft Entra hybrid join. Device synchronization must be enabled separately, with updated migration guidance and configuration steps.

The guide now describes phased migration planning, including Cloud Sync device synchronization for Microsoft Entra hybrid join and prerequisite checks.

The article now helps administrators check their Microsoft Entra Connect version, evaluate Microsoft Entra Cloud Sync—including device synchronization—and find the latest upgrade guidance.

The tutorial now refers to Zscaler instead of Zscaler Authentication Service Provisioning throughout its title, prerequisites, configuration steps, and Microsoft Entra app-gallery instructions.

The tutorial now consistently refers to Zscaler ZSNet instead of Zscaler ZNet, including the title, prerequisites, gallery search instructions, and provisioning steps.

The comparison table now lists Microsoft Entra Cloud Sync as supporting Microsoft Entra hybrid join and links to Cloud Sync device synchronization instructions. The article also expands comparisons across Cloud Sync, Connect Sync, MIM, and ECMA Host.

The guide now covers configuring Microsoft Entra Cloud Sync and Connect Sync, including synchronizing Active Directory computer objects to Microsoft Entra ID for hybrid join.

The article now explains Cloud Sync as synchronizing users, groups, contacts, and devices, and links to device synchronization configuration guidance.

The comparison article now includes devices among supported synchronization scenarios and notes that Cloud Sync can synchronize computer objects for Microsoft Entra hybrid join when device sync is enabled. It also adds a comparison table and selection wizard.

The tutorial received spelling and wording corrections across its SAML attribute mapping, authentication policy, testing, and account discovery sections.

The version history page was updated with spelling fixes in existing release and feature descriptions.

The guide now covers selecting Cloud Sync or Connect Sync and configuring Cloud Sync to synchronize Active Directory computer objects for Microsoft Entra hybrid join.

Changed “cancelation” to “cancellation” in the recovery job instructions.

The page no longer includes the author, manager, and ms.author metadata fields.

The page no longer includes the author, manager, and ms.author metadata fields.

Removed the `manager` and `ms.author` metadata fields from the OIDC protocol documentation.

The document no longer includes the author, manager, and ms.author metadata fields.

The page no longer includes the author, manager, and ms.author metadata fields.

The single sign-on documentation no longer includes the author, manager, and ms.author metadata fields.

The enterprise application page received spelling corrections in its user, group, and app-role assignment guidance.

The page no longer includes the `manager` and `ms.author` metadata fields.

The daemon token acquisition documentation no longer includes the `manager` and `ms.author` fields.

The page no longer includes the author, manager, and ms.author metadata fields.

The article now explains that enabled device synchronization can sync Active Directory computer objects to Microsoft Entra ID so devices can become hybrid joined, and links to configuration steps.

The article now explains that Microsoft Entra Cloud Sync can synchronize Active Directory computer objects to Microsoft Entra ID for hybrid join and links to configuration guidance.

Corrected a spelling error and updated punctuation in the Microsoft Entra Health article.

The page no longer includes the ms.author, author, or manager metadata fields.

The article now links to a sample app demonstrating passkey listing and registration with delegated permissions and warns that its deletion flow uses high-privilege application permissions and a client secret in browser code.

The Microsoft Entra External ID credential management API reference was deleted, including guidance for passkey listing and registration, delegated permissions, authentication, and sample usage.

Corrected a spelling error in the explanation of “Report-only: Failure” results for the “Require app protection policy” control.

The documentation corrects wording and spacing in guidance about cross-tenant access policies, guest self-service sign-up, Conditional Access sign-in frequency, and governance.

Added a missing space between “authentication” and “and” in the documentation.

The Windows hybrid-join troubleshooting page received spelling and copy edits covering TPM errors, PRT checks, and Event Viewer guidance.

The documentation now states more clearly that an agent needs assigned OAuth delegated permissions to assist a user when accessing a target resource’s APIs.

The documentation now states that agent identities need delegated OAuth permissions for target resources, such as Microsoft Graph or an application, to assist users with API access.

The n8n agent integration page no longer includes the `author` and `ms.author` metadata fields.

The documentation corrects spelling errors, including “credentials,” and adds missing punctuation to a step describing token credentials and Azure SDK clients.

The documentation now identifies the resource role as applying to an AI agent’s service principal or agent ID and adds numbered steps for selecting API permissions, permission type, required permissions, and updating the configuration.

The documentation now describes the linked guidance as covering delegated and application permissions for Microsoft Graph and applications.

The page no longer includes the `ms.author` and `author` metadata fields.

Corrected spelling in the guest user licensing and governance documentation, including “governance-related.”

The entitlement management dynamic approval article received spelling corrections covering custom extensions, Logic Apps, approval setup, and HTTP trigger configuration.

Added a missing space after the bold “Prerequisite roles:” label. The linked role requirements are unchanged.

The documentation no longer includes the `author` and `ms.author` metadata fields.

The documentation updates wording across deployment scenarios, entitlement management, access reviews, separation of duties, birthright assignment, and Logic Apps guidance without changing the described capabilities or procedures.

The page title and description now use Microsoft Entra External ID terminology. Passkey sample links were updated from listing and registration to sign-in and management, and the sample table was revised.

The page now describes administrator-controlled passkey provisioning with the FIDO2 provisioning APIs and identifies the sample as testing-only with high-privilege permissions.

The documentation now describes a sample where signed-in customers list and register their own passkeys. It warns that the deletion flow uses high-privilege permissions and a client secret, so the sample is for test tenants only.

The documentation now states that SMS is unavailable only for first-factor authentication in external tenants, indicating availability for self-service password reset. SMS remains available for second-factor verification at additional cost.

The Android custom headers tutorial no longer includes the author, manager, and ms.author metadata fields.

The page now links to a sample for listing and registering passkeys and documents delegated permissions for those operations. It also warns that deletion uses high-privilege application permissions and a client secret in browser code.

The custom policy analysis article no longer includes the `author` and `ms.author` metadata fields.

The service connection link text now uses “configuring” instead of the misspelled “configurating.”

Version 2.2.79, released September 29, 2026, adds over-the-air sensor updates, enhanced Kerberos security and diagnostics, SID-based service matching, and corrected wildcard matching.

The guide now consistently spells “Multi-Geo,” including correcting a typo in the Japan region limitation.

The FAQ now uses “towards” instead of the misspelled “torwards” in its soft-deleted objects quota guidance.

The page no longer includes the `author` and `ms.author` metadata fields.

The documentation no longer includes the `author` and `ms.author` fields.

The PowerShell prompt now correctly refers to the `IPv4Preferred` registry key instead of `IPv4Preffered`.

The article metadata field was corrected from `ms.reviwer` to `ms.reviewer`; the topic classification remains unchanged.

The page no longer includes the `author` and `ms.author` metadata fields.

The page’s `author` and `ms.author` metadata fields were removed.

The documentation corrects “Web respositories” to “Web repositories” in an example of security rules.