Tuesday, 3 November 2026

The documentation now lists Microsoft Graph PowerShell commands to read and update a group’s `IsCloudManaged` state, and documents cloud-specific authentication options. It also notes that Graph Explorer isn’t supported in Azure China.

The example now shows `AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled` as a direct property of the `Features` object, with `AdditionalProperties` empty.

The guide now covers connecting with Microsoft Graph PowerShell, required permissions and cloud settings, troubleshooting consent, and the PowerShell command for changing a group’s source of authority.

The documentation now explains how to install and connect with Microsoft Graph PowerShell, select cloud environments, grant required permissions, and update a user’s source of authority with PowerShell.

The article now describes contacts as Outlook items, retains the required Contacts-OnPremisesSyncBehavior.ReadWrite.All permission, and uses a generic contact PATCH example. Detailed SOA read, transfer, verification, PowerShell, sovereign-cloud, and contact cmdlet guidance was removed.

The documentation now lists Graph PowerShell commands for setting and reading user SOA, identifies the Hybrid Administrator role, and documents cloud-specific connection environments. It also notes that Graph Explorer isn't supported in Azure China.

The configuration article now links to Microsoft Graph PowerShell cmdlets for updating and retrieving a contact’s on-premises sync behavior.

The page no longer includes the note that Graph Explorer is unsupported in Azure China or the instructions to use Microsoft Graph PowerShell for sovereign clouds.

The documentation now describes Every time strict, including its 10-second validity window, application session-management requirements, targeting guidance, and Office 365 warning. It also explains Global Secure Access reauthentication for sensitive private applications using a five-minute window.

The table now lists External multifactor authentication as method 3, Certificate-based authentication as method 4, and Microsoft Authenticator notifications as method 5. The External MFA entry also has updated dash formatting.

The article now says the passkey sample demonstrates listing, registration, and deletion flows, and removes the previous Microsoft Graph deletion-flow warning.

The documentation now explains that in-place upgrades from RHEL 8.x to 9.x can remove the `aadsshlogin` package, causing `Permission denied (publickey)` errors. It provides steps to uninstall and reinstall the AADSSHLoginForLinux extension.

The documentation now directs administrators through Function App → Functions → SendOtp → Invocations when checking the latest transaction and HTTP 200 result.

The account discovery preview documentation now explains how to view discovered groups’ member counts and membership lists.

The article adds Microsoft Graph API and PowerShell examples for transferring the source of authority (SOA) for organizational contacts synchronized from AD DS, including permissions, verification, and sovereign-cloud guidance.

The tutorial adds requirements to enable SOAP API `login()` and grant the integration account API Enabled, Manage Users, and Use Any API Auth permissions. It also documents Salesforce’s December 1, 2026 requirement for Use Any API Auth and related credential errors.

The tutorial now requires SOAP API `login()` to be enabled and the Admin Username account to have **Use Any API Auth**. It also documents credential-validation troubleshooting and Salesforce’s December 1, 2026 requirement.

Removed the sentence explaining that `AllowOnPremUpdateOfOnPremisesObjectIdentifierEnabled` belongs to the `Features` object rather than `AdditionalProperties`.

The documentation changed the SOA-related resource table into a bulleted list while retaining the same three Microsoft Graph PowerShell links.

The Update-MgGroupOnPremiseSyncBehavior and Get-MgGroupOnPremiseSyncBehavior links no longer include the graph-powershell-1.0 view parameter.

Microsoft is updating the Microsoft Defender for Office 365 Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. Rollout starts December 2026. Organizations must manually assign permissions if continued access is needed.

The documentation now states that Office perpetual clients version 2024 and later support Token Protection, while versions earlier than 2024 aren't supported.

Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication for self-service password reset (SSPR) starting February 2027, with a 50-day transition per user group. Organizations must prepare alternative recovery methods, as SMS/voice will no longer be available for SSPR after the transition.

The User Source of Authority configuration guide now links to the current Microsoft Graph PowerShell cmdlet pages without the `view=graph-powershell-1.0` version parameter.

The documentation now describes the sample as supporting passkey listing, registration, and deletion. It removes the separate deletion endpoint guidance and the warning about the sample using Microsoft Graph with high-privilege permissions and a client secret.

The new page describes the preview sign-in-every-time capability, its Conditional Access dependency, Windows client requirement (version 2.34.222 or later), and five-minute reauthentication window.

Microsoft Entra Private Access documentation now explains how to configure, test, and deploy reauthentication for selected private applications using one Conditional Access policy and a pilot group. It requires Global Secure Access Windows client version 2.34.222 or later.

The guidance now explains that administrators may allow access to private applications from non-Windows devices while skipping sign-in frequency requirements, using device platform conditions.

The documentation now links to instructions for configuring sign-in every time for Microsoft Entra Private Access (preview).

The documentation clarifies Quick Access and per-app targeting, emergency account exclusions, connection-based prompting, and pilot validation using Report Only mode and Global Secure Access Traffic Logs.