The documented deadline changed to April 7, 2027. Synchronization services require version 2.5.79.0 or later and application-based authentication after legacy authentication ends.

The required Microsoft Entra Connect Sync version is now 2.6.84.0 or later, with application-based authentication configured by April 7, 2027. Legacy authentication retirement will stop synchronization services after that date if requirements are unmet.

The documentation now requires Microsoft Entra Connect Sync version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are unmet.

The required minimum version changed from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.

The prerequisites page now bolds the warning to upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.

The documentation now bolds the warning that Microsoft Entra Connect Sync must be upgraded to version 2.5.79.0 or later and configured for application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.

The tutorial now uses `https://account.samsung.com/` instead of `https://accounts.samsung.com/` and includes updated documentation metadata.

The instructions now say to verify notification email addresses configured through Microsoft Graph or PowerShell in the Microsoft Entra admin center. Opening the SAML certificate experience can initialize notification registration for custom signing certificates.

The documentation now uses clearer wording to describe fine-grained permissions, scopes, and how apps request them through the `scope` parameter.

The Viva Glint entry now includes WORKPLACE_ANALYTICS_INSIGHTS_BACKEND and its associated identifier.

The documentation now highlights that device platform conditions rely on user agent strings and recommends pairing them with policies requiring device compliance or app protection to reduce risk.

The group writeback migration documentation now links to the guidance for changing other attribute mappings.

New preview documentation explains how to capture a group's distinguished name in a GroupDN extension before converting its Source of Authority to Microsoft Entra ID.

Version 2.6.92.0 was released on September 18, 2026, fixing a 2.6.91.0 issue that could prevent Pass-through Authentication setup through the Microsoft Entra Connect wizard.

New applications will be subject to Microsoft Entra COOP policy across web protocols after January 31, 2027. Popup-based sign-in may fail unless apps use a COOP-compatible flow, such as MSAL.js v5.

The page metadata was updated, and its references now link to the revised “Provision users and groups from Microsoft Entra ID to Active Directory” article.

The version history no longer states that the 09/23/2026 hotfix will be deployed through phased auto-upgrade. The Microsoft Graph permissions notice was repositioned.

The version history now lists release 2.6.92.0 as September 23, 2026, and the related 2.6.91.0 support date as September 23, 2027. The page metadata date was also updated.

The page’s subservice changed from hybrid to hybrid-cloud-sync, and its reviewer changed from dhanyak to dhanyahk.

The page’s subservice metadata changed from hybrid to hybrid-cloud-sync, and its reviewer metadata was updated.

The page now identifies the subservice as hybrid-cloud-sync instead of hybrid and corrects the reviewer attribution.

The page’s Microsoft Entra ID-to-AD attribute mapping section was removed and its introductory link now points to the dedicated configuration guide.

The version history now states that auto-upgrade will move existing installations to the September 18, 2026 hotfix through multiple phases.

The guide for provisioning from Microsoft Entra ID to Active Directory was removed. It covered attribute mappings, scoping filters, sAMAccountName customization, and target-container configuration.

The guide now provides explicit Rootly fields for the Entra identifier, login and logout URLs, PEM certificate, and domain, followed by enabling and saving the SSO configuration.

The tutorial now lists the Rootly fields to populate with the copied URLs and PEM certificate, then instructs administrators to enable and save required SSO. The previous instruction to send these details to Rootly support was removed.

Administrators configuring notification email addresses through Microsoft Graph or PowerShell should re-confirm the address under SAML Certificates and select Save in the Microsoft Entra admin center.

The article updates navigation and steps for email notifications, server or service deletion, and role-based access control, with new screenshots.

The documentation now describes the AD FS service overview, updated alert filtering and details, and the revised Usage Analytics experience with time-range controls. Screenshots and metadata were also refreshed.

The guide now uses the Microsoft Entra Connect Health Sync errors area to access notification settings, review Global Administrator and custom recipients, and export recorded sync errors as a CSV from the command bar.

The page now explains selecting an alert row to view its details, including detection times, affected servers, resolution guidance, and related documentation. It also replaces the alert screenshot and improves image descriptions.

The documentation adds release notes for an upcoming version with Delos sovereign cloud support, authentication and connector behavior changes, bug fixes, and security improvements. The version and release date remain TBD.

The 2.6.90.0 release adds a guided migration workflow from Microsoft Entra Connect Sync to Cloud Sync, including assessment, agent setup, staged activation, validation, and rollback. It is available only in the Azure public cloud.

The entry now uses “phishing-resistant authentication” instead of “passwordless authentication” and updates the page date to September 14, 2026.

The version history table adds a Release date column for listed Microsoft Entra Connect versions while retaining end-of-support dates.

The documentation replaces version 2.6.90.0 with 2.6.91.0 and updates related guidance, including the 2.6.84.0 support timeline and fixes for existing-database upgrades and Synchronization Service Manager crashes.

The documentation replaces references to version 2.6.90.0 with 2.6.91.0, updates related fix guidance, and identifies 2.6.91.0 as the latest available version.

The documentation metadata and release entries now show September 16, 2026 instead of September 15, 2026 for version 2.6.91.0 and its related timeline.

Four references to version 2.6.91.0 now point to the correct documentation section, #26910, instead of #26900.

The documentation now records a fix for an issue where reopening the wizard and expanding a fully deselected domain could reselect it and enable synchronization for the entire domain.

The documentation now requires importing `ADSync.psd1` before `AzureADSSO.psd1` when configuring Seamless Single Sign-On with the standalone module.

The documentation now states that the Select Containers dialog remains available for viewing selections, while changes should be made through Customize synchronization options in the Microsoft Entra Connect wizard.

The article’s publication date changed from April 9, 2025, to September 15, 2026, and an AI-assisted usage marker was added.

We are announcing the ability to assign non-Power Platform licensed Entra users to Dataverse Activities in Dataverse. This feature will reach public preview on September 30, 2026.

As of July 2026, ESR can no longer be managed in the Microsoft Entra admin center. Administrators must use Windows settings backup and restore policies; the supported settings remain unchanged.

The documentation now states that applications using Microsoft identity platform v1 endpoints cannot be validated through self-service App Gallery onboarding. It recommends migrating to v2 endpoints.

The configuration guide no longer includes the note about synchronization service account creation and possible errors involving multifactor or interactive authentication.

My Staff access is now determined by administrative role assignments and their administrative unit scope. The legacy settings under Manage user feature settings no longer affect behavior and are being removed.

Several licensing entries now use updated Microsoft 365 Copilot product names, including Education, Finance, and Sales offerings.

Several entries now use Microsoft Copilot branding instead of Microsoft 365 Copilot branding. Their service plan identifiers and mappings remain unchanged in the documented rows.

The page no longer identifies the legacy My Apps and My Staff settings as being under Manage user feature settings. It states that these settings are unused, do not affect behavior, and are being removed from the admin center.

The June 2026 update adds the Entra SOC Identity Responder role and updates the Security Operator and AI Administrator roles.

The documentation now lists Security Administrator, alongside Helpdesk Administrator and User Administrator, for invalidating non-admin users’ refresh tokens.

The permissions reference now documents the Entra SOC Identity Responder role and its identity-containment actions, including disabling users, revoking active sign-in sessions, and resetting passwords.

The task delegation table now maps identity containment actions for SOC incident response to the Entra SOC Identity Responder role.

The documentation now describes submission states from Draft through Published, with example review and publishing timelines measured in business days. It notes that actual times vary based on submission completeness and validation.

The app gallery listing documentation now uses the Partner Program URL without the `/en-US` locale segment.

The app gallery listing guide now uses shorter link text for the Microsoft AI Cloud Partner Program; the destination URL is unchanged.

The article adds lightbox links to four screenshots, adds a next-step link to submit validation results, and removes the app gallery publication request link.

The roadmap now links to download ID 108777 for both the AD FS and AD DS Connect Health agents, replacing download ID 108565.

The documentation now links to “Publish your app to Microsoft Entra App Gallery” instead of the “Submit your validation results” section.

The documentation corrects an internal section link and improves grammar, spelling, punctuation, and wording throughout the rollout guidance.

The page now describes how Windows Hello for Business cloud Kerberos trust uses Microsoft Entra Kerberos to provide passwordless access to Active Directory resources and links to a deployment guide.

The documentation now states that users accessing Active Directory-protected resources need corresponding Active Directory accounts. Cloud-managed users should be provisioned from Microsoft Entra ID, including required group memberships.

The SSPR documentation now refers to a “Microsoft Entra administrator role” instead of an “Azure administrator role” when describing enforcement of the strong two-gate password policy.

The backup authentication system documentation no longer lists Workplace from Facebook in its integration table.

The provision-on-demand article no longer includes references to Meta Workplace. The displayed guidance about stopping provisioning for OAuth-based applications remains unchanged.

The Microsoft Entra FIDO2 hardware vendor documentation now references MDS version 279 instead of 275 and adds the FEITIAN FT-JCOS BioCard, including its AAGUID and feature capabilities. The page date was also updated.

The documentation now identifies affected accounts as cloud-managed users and explains that password writeback is unavailable for them. It also states that they can access Kerberos-based applications through passwordless authentication using the AD account created by provisioning.

The documentation now specifies that password writeback isn't available for users created in Microsoft Entra. These users can authenticate to Kerberos-based applications only through passwordless authentication using the provisioned AD account.

The documentation identifies Soprano and Telesign as initial private-preview providers for SMS and voice authentication. It also states that provider selection and configuration through Microsoft Security Store will begin October 30, 2026.

The documentation now identifies Soprano and Telesign as initial providers and links to their commercial offers. Configuration begins October 30, 2026.

The page now refers to customer-managed telephony providers as Choose Your Own Telephony Provider and updates related headings and descriptions. The availability dates remain September 18, 2026, for provider information and October 30, 2026, for configuration.

The documentation now refers to selected providers as “telephony providers” instead of “telecommunications providers.”

The documentation no longer includes recommendations to pilot with a limited group or prepare a fallback authentication method and support process for delivery interruptions.

The SSPR policy documentation now uses “Microsoft Entra administrators” instead of “Azure administrators.”

Microsoft-provided SMS and voice authentication retires February 1, 2027, for users including internal guests. Global Administrators and external users follow a later July 1, 2027 retirement date. Users whose only MFA method is SMS or voice will receive a blocking passkey-registration prompt after their applicable date.

The documentation clarifies that Global Administrators and external users are affected on July 1, 2027, while internal guest users follow the February 1, 2027 date. Users can continue using phishing-resistant methods such as passkeys.

A how-to article explains how to enable FIDO2 and passkey methods, register credentials, configure a registry setting, and sign in to Microsoft Entra Connect Sync without a password.

The procedure now uses revised Microsoft Entra Connect paths and module-import commands, including the ADSync module and the AzureADSSO module. Step numbering and wording were also updated.

The instructions replace the custom OMA-URI profile process with a Microsoft Intune Settings Catalog policy. Administrators now select **Authentication > Allow Aad Password Reset** and set it to **Allow**.

The Microsoft Entra Connect version history page removes Learn more links from entries covering WAM and phishing-resistant authentication. The descriptions remain unchanged.

The authentication overview now shows “No” for Microsoft Authenticator push notifications in the affected status column; the method remains listed for MFA and SSPR.

The documentation page describing passwordless sign-in for Microsoft Entra Connect Sync, including setup, credential registration, registry configuration, and sign-in steps, was deleted.

The tutorial replaces the previous SCIM token steps with instructions to create an OAuth2 service account, copy its Client ID and Client Secret, and select OAuth2 Client Credentials Grant. Screenshots and navigation steps were also refreshed.

The documentation now states that Select Containers is read-only, clarifies the existing ADSync database error, and lists failures in version 2.6.84.0 plus a Connector Properties crash.

The version history page now uses “Learn more” as the link text to the cloud sync SSO instructions. The documented PowerShell import order is unchanged.

The version history entry now states that the Generic LDAP connector validates the TLS server certificate chain and server name, removing the detailed rejection conditions.

The Connect version history page no longer states that the Generic LDAP connector wizard validates the TLS server certificate chain and server name.

The documentation now distinguishes Microsoft-managed and enabled campaigns. It specifies the MFA method required for each targeted authentication method and broadens eligible users from SMS or voice sign-ins to users signing in with any MFA method.

The QR code authentication documentation now links to the main My Staff setup page instead of a specific section anchor.

The table now refers to “Microsoft Copilot (Office)” instead of “Microsoft 365 Copilot (Office)”; compatibility indicators are unchanged.

Microsoft Entra is enhancing passkey registration campaigns to optimize user experience and increase phishing-resistant authentication adoption. Eligible users will be automatically prompted based on qualifying passkey profiles. Rollout begins early September 2026. Administrators should review campaign configurations and user assignments before rollout.

The documentation now explains how supported audit events can include DUSI, maps linkable identifiers to audit-log attributes, and provides steps for correlating sign-ins with administrative activity. Some events may not include DUSI.

The documentation now states that when Cloud Sync and Connect Sync are configured for the same domain, Cloud Sync processes password writeback for users synchronized from that domain.

The documentation now describes Microsoft managed, Enabled, and Disabled campaign states, method-specific eligibility and prompting conditions, and prerequisites for Authenticator and passkey campaigns. The updated experience is rolling out through the end of September 2026, so tenant behavior may vary during rollout.

The permissions reference no longer states that Security Administrators can perform identity containment actions during security incidents. It now describes the role as reading security information and reports and managing configuration in Microsoft Entra ID and Office 365.

The role description now states that Security Administrators can perform identity containment actions during security incidents.

Microsoft Entra ID is optimizing passkey registration to better align with administrator policies, prioritize local device passkeys, and improve successful registrations without UI changes. The rollout begins late August 2026, completing by mid-September. No action is required; organizations should continue promoting passkey adoption.

The page title and heading no longer include “(preview).”

The documented password example now includes an exclamation mark at the end.

A new article explains how to diagnose intermittent STATUS_ACCOUNT_DISABLED sign-in and unlock errors on Microsoft Entra hybrid joined Windows devices, including relevant event logs and the stale-cache and connectivity conditions that can cause them.

The documentation now states that Microsoft-managed system-preferred authentication deployment will continue through September 2026, rather than August 2026.

Microsoft Entra improves the iOS Microsoft Authenticator app's passkey restore experience with a clearer, guided flow for device migration, launching worldwide mid-September 2026. It affects iOS users with iCloud backup, requires no action, and includes updated user guidance without policy changes.

Microsoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September 2026. SMS for MFA and password reset remains unaffected. Review and update authentication methods to ensure users have alternate sign-in options.

The documentation standardizes the product name to “Chatwork” and states that SCIM provisioning support will end on October 1, 2026. The Entra Enterprise App Gallery integration will then stop provisioning users.

The article no longer labels Microsoft Entra Cloud Sync device sync as preview and removes the preview legal notice. Its publication date was also updated.

The new tutorial explains how to provision cloud-managed users, a security group, and its membership into AD DS so members can access an on-premises Kerberos application. User provisioning is identified as being in preview.

The page updates diagram descriptions and explains that provisioned group members must have an AD account. Eligible members include synchronized users, cloud-managed users in scope for user provisioning, and cloud-created security groups. The provisioning example link was also updated.

The article documents how Cloud Sync scopes, matches, creates, updates, and deletes users, groups, and memberships in Active Directory, including matching with msDS-ExternalDirectoryObjectId and user source-of-authority scenarios.

The article expands beyond group-only provisioning to explain provisioning users, groups, or both from Microsoft Entra ID to on-premises AD DS. It adds prerequisites, deployment options, scoping filters, target containers, and attribute-mapping guidance; user-related options are marked Preview.

A new preview how-to explains on-demand testing for users and groups, default accidental-delete and email settings, enabling configurations, handling quarantines, restarting sync, and removing configurations.

A new article documents prerequisites and license requirements for provisioning users and groups from Microsoft Entra ID to on-premises AD DS using Cloud Sync. It also links to configuration, testing, deployment, and agent setup guidance.

The tutorial now covers provisioning both users and groups from Microsoft Entra ID to Active Directory. It adds examples for filtering groups by an extension value and mapping a user extension into an Active Directory attribute, along with updated prerequisites and guidance.

The guide now documents testing individual users or groups when provisioning from Microsoft Entra ID to Active Directory. It adds steps for selecting objects, selecting up to five group members, and reviewing detailed results, retries, and additional tests.

The article now covers directory extensions for both users and groups, clarifies the supported application identifier and Tenant Schema Extension App prerequisite, and updates examples, links, and related content.

The documentation warns that ChatWork will discontinue SCIM-based provisioning on October 1, 2026, retiring the Entra Enterprise App Gallery integration.

The page’s subservice metadata was updated, and its attribute-mapping link now points to the renamed configuration guide.

The article now states that it covers on-demand provisioning from Active Directory to Microsoft Entra ID and links to a separate article for provisioning in the reverse direction.

The tutorial for provisioning groups to AD DS with Microsoft Entra Cloud Sync was deleted, including its setup guidance, scoping recommendation, and group/user synchronization scenarios.

The article title no longer includes “(preview)” for custom call-outs using LCW extensibility workflows.

The documented Tenant URL changed from `https://docs.rootly.com/integrations/scim` to `https://rootly.com/scim`.

The tutorial now specifies `https://rootly.com/scim` as the Tenant URL instead of `https://docs.rootly.com/integrations/scim`.

The tutorial now uses a new screenshot and updated alternative text for the Netskope User Authentication results list.

Microsoft added documentation for using the guided migration tool to assess an environment, create Cloud Sync configurations, run a preactivation check, and validate synchronization after migration.

Microsoft Graph permissions have been added to Microsoft Entra Connect. Administrators using app-scoped Conditional Access policies should review policies targeting Microsoft.Azure.SyncFabric or Microsoft 365 Reporting Service.

The version history now refers to an additional sovereign cloud environment instead of naming Delos. Support for Pass-through Authentication, Seamless SSO, password writeback, and Health Agent monitoring remains listed.

The page now describes Connect Health as providing monitoring data in one place and directs administrators to the Microsoft Entra admin center for alerts, performance monitoring, usage analytics, synchronization errors, and service information.

The documented workflow now covers configuration assessment, provisioning agent setup, staged activation, and validation. Rollback is no longer included, and the workflow remains limited to the Azure public cloud.

The documentation adds preview support for clearing mapped target attributes through Workday and SAP SuccessFactors inbound provisioning, with configuration, schema, testing, and troubleshooting guidance.

The reference explains how optional single-valued source attributes can clear mapped target attributes when Workday returns null or empty values, with configuration guidance linked.

The documentation now explains how optional single-valued source attributes can clear mapped target attributes when SAP SuccessFactors returns null or empty values.

The tutorial now requires Microsoft Entra ID P1, P2, or Governance licenses for every identity sourced through API-driven provisioning.

The documentation and screenshot alt text now refer to the field as “Submission ID” instead of “submission request ID.”

New documentation explains how HiBob can provision and update users in on-premises Active Directory through Microsoft Entra API-driven provisioning and the provisioning agent. It covers prerequisites, permissions, configuration, and synchronization flow.

The user provisioning validation guide now uses an updated Microsoft Entra admin center URL with additional parameters.

The partner-driven integrations documentation now lists Dropbox and Snowflake as examples and no longer references Workplace by Facebook.

The article now documents configuring a SCIM endpoint that uses an OAuth2 client-credentials grant from a non-Entra issuer, including the token endpoint, client credentials, credential placement, and scopes.

The documentation now explains how to investigate failed validation tests using provisioning error details, recommendation URLs, and Logic App run details. It also lists common authentication, user, group, and SCIM compliance failures with recommended remedies.

The documentation lists SAML capabilities that can be validated, including IdP- and SP-initiated SSO, SLO, application-specific claims, and user identifiers. It also states that applications should reject assertions signed with expired certificates and recommends reviewing validation logic if they do not.

The article no longer includes guidance to confirm procedures for expired SAML signing certificates, propagation time, and cleanup with the Entra App Validator team before publication. It now directly presents the validation steps.

The reference now documents up to 999 users per page when the projection excludes the manager attribute, plus filters for active users, negated suffix matches, group membership, and group ownership.

The permissions table removes individual inline links and adds a note linking to the Microsoft Graph permissions reference. The listed permissions and descriptions remain the same.

The reference adds least-privilege permissions for basic user reads, user creation and updates, group creation and membership changes, and specific user attributes.

The permissions table now lists granular options for reading, creating, and updating users, plus creating groups and managing group memberships. Existing permission descriptions were also clarified.

The schema now documents read-only, multi-valued `User:ownedGroups` and `Group:owners` attributes. Their IDs are usable in filter queries but are never returned in response bodies. It also corrects the `members.value` response-body description for groups.

The SCIM API reference now advises apps that update specific user attributes to use the least-privileged permission and links to the detailed permissions guidance.

A new how-to explains registering an MCP server as an OAuth 2.0 protected resource, enabling v2 access tokens, and connecting MCP clients through Microsoft Entra Agent ID.

The app gallery publishing documentation now refers to the required identifier as a Partner One ID and notes that it was formerly called the Microsoft Partner Network (MPN) ID.

The SAML App Gallery validation article adds lightbox support to screenshots and a Next step link to the validation-results section.

The documentation link now directs readers to “Publish your app to Microsoft Entra App Gallery” instead of “Review and submit validation results.”

The table now explicitly labels Group Managed Service Account (gMSA) and Standalone Managed Service Account (sMSA), with corresponding installation guidance.

The sign-in step now lists Application Owners alongside Application Administrators as acceptable roles for accessing the Microsoft Entra admin center.

The guidance now directs administrators to the Exchange admin center for role assignments through dynamic membership groups. If the old Exchange admin center is required, assign the eligible role directly to the user rather than through role-assignable groups; Exchange PowerShell cmdlets work as expected.

A new article explains groups-only, users-only, and users-and-groups provisioning from Microsoft Entra ID to AD DS. User provisioning is in preview, while group provisioning is generally available; it also documents per-domain configuration limits and performance guidance.

The new overview describes how Cloud Sync provisions users, groups, and memberships from Microsoft Entra ID to AD, including supported configurations, user types, attribute updates, enforcement, and provisioning flow. User provisioning is in preview, while group provisioning is generally available; password writeback isn't supported.

The article now describes provisioning Microsoft Entra-managed users back to Active Directory with Cloud Sync so they can access Kerberos-based on-premises applications while their lifecycle is governed from the cloud. It also updates passwordless authentication guidance and diagrams.

The guidance now specifies that password-based apps, including LDAP-authenticated apps, must be updated to Kerberos for cloud-managed users to use passwordless authentication.

The guidance now links to updated Microsoft Entra Cloud Sync documentation for provisioning groups to Active Directory and nested-group membership behavior. Page metadata was also refreshed.

The article’s introductory wording and references were updated, including the link to cloud-first identity management guidance. The described Group SOA and group replication steps remain unchanged.

The documentation now states that password writeback isn't supported for applications that collect passwords, including applications that authenticate users through an LDAP bind.

The Continuous Access Evaluation documentation no longer includes the note that SharePoint Online doesn't support user risk events.

The page now directs administrators to Microsoft Entra Connect Health in the Microsoft Entra admin center and documents updated navigation for Sync, AD FS, AD DS, settings, troubleshooting, and support. It also clarifies that agents must be installed before monitoring data appears.

The required Microsoft Entra Connect Sync version changed from 2.5.79.0 to 2.6.84.0 or later. Application-based authentication must still be configured by April 7, 2027.

The deadline changed to April 7, 2027. Administrators must upgrade to version 2.5.79.0 or later and configure application-based authentication; synchronization stops after the deadline if requirements are unmet.

The warning is bolded: upgrade Microsoft Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are not met.

The documentation now bolds the mandatory upgrade warning: upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Legacy authentication will be retired, and synchronization will stop after that date if requirements are unmet.

The documentation now requires version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop afterward if these requirements are unmet.

The required Microsoft Entra Connect Sync version increased from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.

The guide now states that users without a registered or enrolled device are prompted to register it, and documents a different message for users who have not installed the latest September 2026 Windows update.

The version history entry now links readers to the latest available Microsoft Entra Connect Sync version.

The Windows token protection guide now refers to Microsoft Copilot instead of Microsoft 365 Copilot.

The Microsoft Entra External ID credential management API reference was deleted. It previously documented how applications let signed-in customers list, register, and delete passkeys.

Starting late September 2026, Microsoft Viva Engage will require Microsoft Entra permissions—Yammer Administrator role or Community Admin assignment—for community and membership management tasks previously allowed to Verified or Network Admins. Administrators should review and update role assignments accordingly.

The page’s subservice metadata changed to hybrid-cloud-sync, and the listed reviewer changed.

The documentation now notes that the AD FS Risky IP report is being deprecated and links to the Risky IP report workbook. It also updates portal navigation, export handling, notification settings, and threshold guidance.

The guide now documents the updated service overview, alert details and search, domain controller filtering and column options, replication error details, and 24-hour authentication performance charts.

The page now reflects the Sync services overview, updated alert and monitoring workflows, revised settings instructions, and expanded sync-error filtering, details, and CSV export guidance.

The August row on the SLA performance reference page now shows 99.999% in the previously blank final metric column.

The instructions now direct administrators to choose Resources > Specific resources, instead of Cloud apps, when adding Device Registration Service to the exclusion list.

The guide now directs administrators to use Exclude > Select resources > Select specific resources before adding Device Registration Service.

The documentation now lists Security Administrator alongside Security Operator and Entra SOC Identity Responder as limited to non-administrative user accounts and unable to act on privileged accounts.

The article now documents the guided workflow for duplicate-attribute errors, including finding affected objects, opening Error Details, using Troubleshoot, reviewing proposed resolutions, and applying supported fixes. Status descriptions and diagnostic images were also updated.

The procedure now imports the ADSync PowerShell module before importing the Seamless SSO module, with updated command and path details.

The documentation now explains how to configure attribute value clearing, fallback values, or ignored values when HR applications return null or empty attributes during provisioning.

The documentation now explains that target attributes are cleared only when **Flow null values** is enabled for both the source attribute and target mapping. It also documents options to clear, preserve, or replace empty values.

The troubleshooting guidance for SEC_E_NO_AUTHENTICATING_AUTHORITY now links to Windows Server 2025 build 26100.6905 information.

The troubleshooting guide now uses `-vAuth` instead of `-v` when starting `Start-auth.ps1`.

The hybrid join troubleshooting page was updated with revised guidance for AADSTS50034, and its date changed from July 27, 2025, to September 1, 2026.

The page now documents a shared default limit of 700 app roles and exposed delegated permission scopes per application or service principal, including counting rules, existing objects above the limit, and design guidance.

The guide now focuses on phased transitions of user and group source of authority to Microsoft Entra ID while maintaining application access. It also updates readiness content and LDAP-binding application guidance, including provisioning cloud-managed users and groups back to on-premises AD or using Microsoft Entra Domain Services.

The documentation now states that these legacy preview and experience settings no longer affect app launchers or user behavior and are being removed from the Microsoft Entra admin center.

The app gallery publishing documentation now refers to the Microsoft Partner One ID and identifies Microsoft Partner Network (MPN) ID as its former name.

The documentation now instructs app publishers to provide a Partner One ID associated with their Microsoft AI Cloud Partner Program organization and explains how to find help if they do not know it.

The guidance explains prerequisites, policy targeting, risk controls, device and network conditions, and blocking risky agent user accounts. It notes that all-user and group targeting don't include agent users.

The documentation now warns that device platform information, such as user agent strings, can be modified and isn't verified. It recommends using device platform with Microsoft Intune device compliance policies or in a block statement.

Microsoft is retiring SMS first-factor sign-in for Microsoft Entra ID workforce tenants worldwide starting February 1, 2027, to enhance security. Organizations must identify affected users, migrate them to phishing-resistant methods like passkeys, and update policies to avoid sign-in disruptions and comply with new requirements.

Passkeys became the default Microsoft Entra authentication on September 1, 2026. Microsoft-provided SMS and voice authentication will retire February 1, 2027, requiring customers to use telecom providers from the Microsoft Security Store. Transition to passkeys is recommended for stronger, phishing-resistant security.

The employee lifecycle documentation no longer links to the Workplace by Facebook provisioning tutorial.

The on-premises access guidance now links to a Microsoft Entra Cloud Sync how-to page for provisioning groups to Active Directory.

The tenant-estate architecture guidance now uses “Microsoft Copilot” instead of “Microsoft 365 Copilot.”

Microsoft Defender for Cloud Apps is updating App Governance permissions for select Microsoft Entra roles to align with Defender XDR Unified RBAC. Changes affect Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles starting mid-October 2026. Admins should review and adjust role assignments accordingly.

Account discovery now covers users and groups, classifying them as local, unassigned, or assigned identities. Group discovery is identified as being in preview, and correlation requires a direct matching attribute.

The documentation now explains how Entitlement Management integrates with ServiceNow for access package requests, request history, and approvals. It covers licensing, installation, configuration, and user workflows.

The documentation now lists a default limit of 700 shared permission definitions for app roles and exposed delegated scopes, plus an aggregate manifest limit of 1,200 collection entries.

User.ReadBasic.All will no longer provide access to user app role assignments and license details starting mid-September 2026 to fix a security issue. Applications needing this data must switch to User.Read.All or LicenseAssignment.Read.All permissions and update accordingly to avoid disruptions.

The Node.js Express and web application entries in the sample code documentation were updated, including their linked sample resources.

The article now presents Conditional Access for autonomous agents as a scenario-based pattern, adds prerequisites, and recommends starting block policies in report-only mode. It also notes that an Agent 365 license will soon be required.

The documentation now distinguishes agents acting for signed-in users, using their own identity, or using an agent user account. It adds separate guidance links for autonomous agents and agent users and updates the listed licensing combinations.

The article now uses a scenario-based structure, explains that conditions and controls depend on the token subject, and links separately to guidance for agent identities and agent user accounts. Terminology, metadata, and related links were also updated.

On August 24, 2026, we initiated the gradual roll out of self-service migrations to Microsoft Entra Agent IDs for Copilot Studio agents in Power Platform Advisor. Beginning on September 2026, automatic migrations of agents without Entra Agent ID to Microsoft Entra Agent ID were also initiated.

The authorization documentation now states that custom roles can be assigned to agents.

The documentation now states that sponsors cannot re-enable disabled agents; an owner or administrator must help re-enable them.

The AI Administrator and AI Reader descriptions were updated from “Microsoft 365 Copilot” to “Microsoft Copilot.” Their role IDs remain unchanged.

Sponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities.

The documentation now states that agent user accounts can be assigned custom roles, while privileged administrator roles remain restricted.

To strengthen your organization's security posture, Microsoft will create a new Microsoft-managed Conditional Access (CA) policy—Require risk remediation for high-risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self-remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.

The page now distinguishes diagnostic setting categories from KQL table names and maps six ID Protection signals to their corresponding AAD-prefixed Log Analytics tables.

The documentation now explains that `duration: P365D` makes an eligible assignment expire after 365 days. Permanent eligibility requires the target scope’s role management policy to allow it.

The Entra ID Governance apps page no longer lists Workplace from Meta in its application table.

The licensing table now covers guests disabled or deleted by lifecycle policies, sponsor attestations, and users sponsoring new guests. It also lists the related beta API endpoints for attestation and sponsorship.

The documentation adds access package drift reporting for groups and enterprise applications, including detection, remediation, export, roles, licensing, refresh timing, and limitations. The reports are in preview.

The documentation now uses clearer wording for configuring LCW extensibility workflow mappings, creating an Azure Logic App and workflow, and configuring provisioning jobs with attribute mappings.

The Tenant Governance licensing page now links to Microsoft Agent 365 licensing FAQs and guidance for using governance relationships with Microsoft Defender.

The access package creation documentation now explains that the search box can find matching SharePoint Online roles that are not initially displayed, especially on sites with many roles.

The documentation now recommends using the search box to find SharePoint Online roles when adding them to an access package. Search returns matching roles even when they are not initially displayed.

The licensing documentation’s Microsoft author alias was updated from `tafra00` to `tazkiaafra`.

The documentation now specifies that existing guest users can be directly assigned, but external users who are not yet in the directory cannot be invited through direct assignment when access is limited to administrator direct assignments.

The HR integrations table now includes a link for HiBob to Microsoft Entra ID/Active Directory and updates the Rippling provisioning link text.

The documentation explains that related PIM activation and deactivation events can have different CorrelationId values. It recommends using roleAssignmentRequestId to trace a complete request and adds Log Analytics query examples.

The documentation now directs administrators to the **Who can request access** section on the **Requests** tab, where selecting **Manager** enables managers to request access packages for employees.

The documentation now states that credential protection covers group members and owners, including eligible members and owners who have not yet activated.

The role-assignable groups description now includes members and owners, including eligible members and owners who have not activated their assignments.

The overview describes access drift, account discovery, access package drift detection, and enforcement and remediation approaches for aligning resource access with governance policies.

The licensing fundamentals page was updated to align the Account Discovery section and state that the feature requires the Microsoft Entra ID Governance add-on or Microsoft Entra Suite.

The page now lists the Microsoft Agent 365 Licensing FAQs and governance relationships links without the previous section heading and introductory text.

The guidance now links to a different Microsoft Entra Cloud Sync configuration page for provisioning groups to Active Directory Domain Services.

Security Copilot is now included with Microsoft 365 E5/E7 plans, integrating agents across Defender, Entra, Intune, Purview, and its portal. No purchase or action is needed. Organizations get monthly Security Compute Units, developer tools, and can explore additional paid features or opt out by contacting support.

Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026. Only trusted Microsoft scripts will run, affecting organizations using script-injecting tools on login.microsoftonline.com. No action needed if such tools aren't used.

Microsoft Entra can hand brokered external-IdP authentication from an embedded WebView to the system browser, enabling external-IdP passkeys, browser SSO, and IdPs that block WebViews. The documentation lists supported platforms, brokers, versions, apps, and cloud availability.

The article now links to the authentication methods overview and the consolidated “Add an identity provider to a user flow” article instead of listing the Apple-specific setup steps inline.

A single article now documents how to add a configured OIDC, SAML/WS-Fed, or social identity provider to an External ID user flow, including prerequisites, permissions, portal steps, and testing.

The article now links to a consolidated guide for adding an identity provider to a user flow and reorganizes the sign-in and sign-up guidance. The duplicated setup and testing steps were removed.

The article’s step-by-step instructions and screenshot for adding an OIDC provider to a user flow were replaced with a link to a consolidated guide.

The article now links to a consolidated guide for adding Facebook as an identity provider to a user flow and updates the section heading and introductory guidance.

The article now directs administrators to a consolidated guide for adding Google as an identity provider to a user flow, instead of listing the steps inline.

The documentation no longer directs applications to the preview credential management API. It now recommends Microsoft Graph FIDO2 provisioning APIs and states that low-privilege passkey credential management APIs are on the roadmap.

The article replaces its embedded steps and screenshot for adding the Microsoft account identity provider with a link to the shared user-flow guidance.

The External tenants guidance now links to the consolidated article for adding a SAML/WS-Fed identity provider to a user flow.

The standalone article covering prerequisites and steps for adding a SAML or WS-Fed identity provider to a user flow was removed and consolidated into a single article referenced by the federation documentation.

The user profile information documentation no longer includes guidance that users can use My Apps preview features or that administrators can access My Staff.

The user profile information guidance no longer includes the “Manage user feature settings” reference.

The documentation now explains how Microsoft Entra ID accepts compliant-device claims from an external user’s home tenant and how Conditional Access evaluates those claims. It also describes the trust implications and behavior when the setting is disabled.

The new article explains how to use Quick setup, register applications, create credentials, and issue and verify credentials in a Microsoft Entra External ID tenant. It documents prerequisites and limits, including custom-domain requirements, shared signing keys, two requests per second per tenant, and six-month credential validity.

The documentation removes “preview” from the source traffic type and HTTP method request filtering conditions, updates their headings and links, and refreshes the page date.

Microsoft Purview DLP integrates with Entra Global Secure Access Internet Access to filter sensitive files at the network layer, preventing data leaks to unmanaged cloud apps. Public preview starts mid-November 2025; general availability by October 2026. Admins must configure policies, TLS inspection, and activate Purview pay-as-you-go.

The documentation now describes a preview Continue Evaluation default action. Unmatched traffic can pass to the next applicable security profile, while matching rules and Allow or Block stop evaluation. The Baseline Profile must use Allow or Block.

The Internet Access health-signal article now lists licensing, roles, Microsoft Graph permissions, and log access requirements. It also adds steps for investigating alerts and reviewing filtering and forwarding policies.

Documentation now describes default and custom profiles, including profile settings, assignments, prerequisites, and a preview limit of 10 custom profiles.

The documentation explains how to create up to 10 custom profiles, configure application acquisition rules, assign users and devices, and set profile priority.

The documentation explains how Global Secure Access Administrators can delete custom Private Access traffic forwarding profiles. Default profiles cannot be deleted, and deleted custom profiles cannot be restored.

Global Secure Access now documents a default Private Access profile plus up to 10 custom profiles during preview. Profiles can target users, groups, devices, and device platforms, with priority determining which applicable profile the client uses.

The documentation now requires a non-trial Microsoft Entra P1 or P2 license plus at least 100 monthly active users to view alerts and receive notifications. It also clarifies Private Access licensing, least-privilege roles, Graph permissions, and expanded signal and alert investigation guidance.

The workload identity federation documentation now uses Microsoft Graph Bicep extension version 1.0.0 instead of 0.1.8-preview.

The managed identities status table now links to permissions and identity guidance for Chaos Studio Workspaces, while retaining a separate link for Azure Chaos Studio (classic).

The documentation now clarifies that Azure CLI commands and IaC templates must use the provider namespace Microsoft.Storage, while Microsoft.Storage/* is only an Azure portal display convention.

The documentation now clarifies that Azure CLI commands and IaC templates must use Microsoft.Storage. The Microsoft.Storage/* format shown in the portal is only a display convention and is not accepted by the API.

The documentation now states that creating a managed identity is blocked when the resulting directory usage reaches or exceeds 98% of the tenant quota. This applies to new or recreated service principals; existing identities and assignments continue to work.

The page now explains how Microsoft Entra ID users and groups provisioned to Active Directory with Cloud Sync can access Kerberos-protected resources through Microsoft Entra Kerberos, Windows Hello for Business, or FIDO2. It also clarifies that provisioning alone does not enable Kerberos or passwordless access.

The article now provides explicit prerequisites, required Microsoft Entra and SAP permissions, SAP IAS OIDC and JWT Trust-by-Issuer configuration details, and a clearer token flow and revocation explanation.

The Entra documentation now uses the singular verb “needs” for “GitHub Actions” in an example about workload identities accessing Azure subscriptions.

The page now notes that, starting July 15, 2026, GitHub will automatically use immutable subject claims for newly created, renamed, or transferred repositories. Existing repositories will retain name-based claims unless opted in.

The documentation now explains setup for applications and user-assigned managed identities, using Microsoft Graph for applications and Azure Resource Manager for managed identities. It also adds details about credential properties, including claimsMatchingExpression.

The guidance now covers applications and user-assigned managed identities, including Azure Resource Manager setup instructions and updated GitLab claim-matching requirements.

The documentation now states that app roles and exposed delegated permission scopes share a default limit of 700 permission definitions per application or service principal. Disabled definitions count, and this limit is separate from the aggregate manifest limit.

The documentation now states that app roles and exposed delegated permission scopes share a default limit of 700 definitions per application or service principal. Disabled definitions count, and this limit is separate from the aggregate manifest limit.

The known limitations article now states that the client doesn't support Secure DNS variants such as DoH, DoT, or DNSSEC, and that the macOS client bypasses Secure DNS to enforce FQDN-based tunneling.

The article now documents assigning users, groups, devices, and device platforms to traffic forwarding profiles, including custom Private Access profiles. It also explains that user/device and platform conditions are evaluated together and that the highest-priority applicable profile is used.

The documentation now states that custom headers are available only with Web Filtering (v2) policies and links to the related guidance.

The page now explains how to find modified-header transactions in Global Secure Access traffic logs and add the Custom Headers column. During the September 2026 rollout, a special Entra Admin Center link may be needed to view these details.

The page title now marks custom headers as preview and notes that rollout is expected to complete by September 10, 2026.

Consistent spacing was added to domain lists for Claude, GitHub, Slack, Dropbox, and YouTube entries. Header names and descriptions are unchanged.

The documentation now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It adds a warning that blocking HTML or JSON can disrupt normal web and API traffic, and updates the stated coverage from HTTP/1.1 to HTTP/S.

The documentation replaces the Source type condition with Session type, adds a known internet access limitations reference, and revises guidance for WebSocket filtering, API rate limiting, and Purview inspection failures.

The TLS inspection documentation now explains how to configure either a Microsoft-managed certificate or your own certificate authority.

The guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The capability is in preview, and the private key remains protected by Microsoft.

The article now focuses on bringing your own certificate authority for TLS inspection, including CSR creation, PKI signing, and certificate upload. It also links to separate Microsoft-managed certificate guidance.

The AI prompt injection protection documentation now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before configuring TLS inspection policies.

The documentation specifies non-overlapping dynamic TCP ports 49152–65535 and AutoReuse TCP ports 10000–49151, with new configuration and verification commands. It also adds Windows Server 2016+ prerequisites and clarifies that AutoReuse applies only to TCP.

The documentation now covers preview device signals for deleted, disabled, or noncompliant devices. It also specifies reauthentication through a GSA client notification and tunnel disconnection after two minutes if reauthentication is incomplete.

The documentation now refers to “Microsoft Copilot” instead of “Microsoft 365 Copilot.”

The documentation now provides separate links for configuring TLS inspection with a Microsoft-managed certificate and with your own certificate.

The article now distinguishes tunnel and BGP connectivity scenarios and adds investigation steps, licensing requirements, least-privilege roles, and Microsoft Graph permissions for viewing and managing signals and alerts.

The troubleshooting page now links to separate guides for Microsoft-managed certificates and customer-provided certificates, and its publication date was updated.

The app-access troubleshooting guide now recommends enabling session persistence after confirming the application works through a single connector, keeping the same user and device routed through that connector during the session.

The documentation now clarifies Basic content filtering and Scan with Purview descriptions, including that scanning can audit or block selected file and text content based on conditions.

The documentation now describes real-time controls for content shared with generative AI applications, unmanaged cloud apps, and other internet destinations. It adds details about Basic content filtering and Purview-based inspection of files and text.

The connector configuration guidance now refers to configuring dynamic and AutoReuse TCP port ranges instead of extending TCP and UDP ephemeral ports.

The guidance now labels the link “Microsoft Copilot requirements” instead of “Microsoft 365 Copilot requirements.”