Entra Id Federation Customers
General
The user-creation example replaces the source tenant ID with its primary domain name in the issuer value and defines the new placeholder with an example domain.
Cross-product topic
General
A cross-product view of Microsoft Entra changes related to General.
Latest General changes
Configure home network support for Microsoft Entra Private Access
General
A new guide explains how directly connected local resources can remain reachable while Private Access is enabled, including routing behavior, prerequisites, and configuration steps.
Create Blueprint
General
The documentation now states that when **Users can create agent blueprints** is set to **Yes**, any tenant user can create an agent identity blueprint and its principal. Otherwise, the Agent ID Developer and Agent ID Administrator roles can create them.
Permissions Reference
General
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
Manage Device Identities
General
The documentation now states that any user can use **Download devices** to export a CSV of devices, with optional filters; without filters, all devices are included.
Microsoft Entra Verified ID - IDV partner gallery
General
The Entra Verified ID identity verification partners page now lists HYPR, with a link to HYPR documentation and a description of its integration for workforce identity verification.
What's new for Microsoft Entra Verified ID
General
The Microsoft Entra Verified ID updates page now lists HYPR as an API-based integration partner.
Agent Id
General
The documentation clarifies that policies scoped through the Users assignment do not apply to agent user accounts, regardless of whether they target all users, selected users, groups, directory roles, or external users. To protect agents, select Agents under Users, agents, or workload identities.
Agent Id
General
The documentation now identifies the agent identity, rather than the application or autonomous agent, as the subject in application-only access.
Agent Id
General
The Conditional Access Agent ID page now links to Microsoft Agent 365 plans and pricing instead of the Agent ID getting-started information.
Howto Target Agent Identities
General
The agent identity targeting documentation now links to the relevant section on Conditional Access policies and agent identity blueprints.
Policy Agent User
General
The guidance now links to the Windows 365 Cloud PC for Agents introduction and the Entra Global Secure Access overview.
Policy Agent User
General
The documentation adds links and clarifies that relevant agents run on Intune-managed Windows 365 Cloud PCs, with Global Secure Access for compliant network policies. It also refines targeting, assignment, and risk-level guidance.
Policy Agent User
General
The documentation now lists Microsoft 365 E7, or Microsoft Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3, instead of a general Entra ID P1 or P2 requirement.
Policy Autonomous Agents
General
The documentation now specifies Microsoft Entra ID P1 or Microsoft 365 E3 for Conditional Access, and Microsoft Entra ID P2 or Microsoft 365 E5 when using agent risk-based Conditional Access with Microsoft Agent 365.
Policy Autonomous Agents
General
The documentation now says Microsoft 365 E7 protects access for both users and agents, replacing wording about governance of user and agent identities.
Policy Autonomous Agents
General
The documentation now lists two licensing options: Microsoft 365 E7, or Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3. It also states that Agent 365 will soon be required.
Policy Autonomous Agents
General
The documentation now uses corrected step numbering and clearer instructions for excluding agent blueprints or identities and creating custom attributes and predefined values.
Agent Access Packages
General
The documentation now states more clearly that an agent needs assigned OAuth delegated permissions to assist a user when accessing a target resource’s APIs.
Agent Access Packages
General
The documentation now states that agent identities need delegated OAuth permissions for target resources, such as Microsoft Graph or an application, to assist users with API access.
Analyze Azure AD B2C custom policies for Microsoft Entra External ID migration
General
The custom policy analysis article no longer includes the `author` and `ms.author` metadata fields.
Connect Version History
General
The version history page was updated with spelling fixes in existing release and feature descriptions.
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Atlassian Cloud so that I can…
General
The tutorial received spelling and wording corrections across its SAML attribute mapping, authentication policy, testing, and account discovery sections.
Get started integrating with Microsoft Entra ID
General
The guide now covers selecting Cloud Sync or Connect Sync and configuring Cloud Sync to synchronize Active Directory computer objects for Microsoft Entra hybrid join.
Global Secure Access egress IP ranges
General
The page no longer includes the `author` and `ms.author` metadata fields.
Integrate N8n Agent
General
The n8n agent integration page no longer includes the `author` and `ms.author` metadata fields.
Managed Identities Faq
General
The FAQ now uses “towards” instead of the misspelled “torwards” in its soft-deleted objects quota guidance.
Multi-Geo for Microsoft Entra Private Access
General
The guide now consistently spells “Multi-Geo,” including correcting a typo in the Japan region limitation.
Plan your SSO integration with Microsoft Entra ID (ISVs)
General
The page no longer includes the author, manager, and ms.author metadata fields.
Private Access Sensor Release History
General
Version 2.2.79, released September 29, 2026, adds over-the-air sensor updates, enhanced Kerberos security and diagnostics, SID-based service matching, and corrected wildcard matching.
Claims Customization Custom Claims Policy
General
Example 3 now clearly describes creating the `JoinedData` claim by joining `extensionattribute1` with `-ext` for JWTs issued to linked service principals.
Connect Configure Ad Ds Connector Account
General
The documentation now lists the module under `C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\ADSyncConfig.psm1`.
Connect Health Agent Install
General
The documentation now states that, by default, a Global Administrator account has permission to register the agent, replacing Hybrid Identity Administrator.
Connect Health Operations
General
The documentation now identifies Microsoft Entra Global Administrators, rather than Hybrid Identity Administrators, in the default Connect Health RBAC guidance and Owner role description.
Bulk create users in the Azure portal
General
The documentation now requires preserving downloaded column headings, allows the examples row to remain, and identifies only Name, User name, and Initial password as required fields. The sample CSV was simplified.
Bulk delete users in Microsoft Entra ID
General
The instructions now require the exact downloaded column header and allow each user row to contain either a user principal name or object ID. The examples row may remain, and User Administrator is listed as the minimum role.
Bulk restore deleted users in the Azure portal
General
The article now requires the downloaded `Object ID [objectId] Required` header to remain unchanged and says the examples row can be retained. It also documents the User Administrator prerequisite.
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Cisco Secure Firewall - Secur…
General
The article now uses a Cisco FQDN placeholder for the SAML metadata URL and emphasizes that Identifier and Reply URL examples must be verified against the intended Cisco endpoints and trusted domains.
Service limits and restrictions
General
The page’s publication date and custom metadata tags were updated.
Authorization Agent Id
General
The authorization documentation now states that custom roles can be assigned to agents.
Known limitations for Global Secure Access
General
The known limitations article now states that the client doesn't support Secure DNS variants such as DoH, DoT, or DNSSEC, and that the macOS client bypasses Secure DNS to enforce FQDN-based tunneling.
Configure Samsung Knox and Business Services for Single sign-on with Microsoft Entra ID
General
The tutorial now uses `https://account.samsung.com/` instead of `https://accounts.samsung.com/` and includes updated documentation metadata.
Connect Install Prerequisites
General
The required minimum version changed from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.
Connect Install Prerequisites
General
The prerequisites page now bolds the warning to upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.
Connect Install Prerequisites
General
The documentation now requires Microsoft Entra Connect Sync version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are unmet.
Connect Version History
General
The required Microsoft Entra Connect Sync version is now 2.6.84.0 or later, with application-based authentication configured by April 7, 2027. Legacy authentication retirement will stop synchronization services after that date if requirements are unmet.
Connect Version History
General
The documentation now bolds the warning that Microsoft Entra Connect Sync must be upgraded to version 2.5.79.0 or later and configured for application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.
Connect Version History
General
The documented deadline changed to April 7, 2027. Synchronization services require version 2.5.79.0 or later and application-based authentication after legacy authentication ends.
Licensing Service Plan Reference
General
The Viva Glint entry now includes WORKPLACE_ANALYTICS_INSIGHTS_BACKEND and its associated identifier.
Managed Identities Status
General
The managed identities status table now links to permissions and identity guidance for Chaos Studio Workspaces, while retaining a separate link for Azure Chaos Studio (classic).
Scopes Oidc
General
The documentation now uses clearer wording to describe fine-grained permissions, scopes, and how apps request them through the `scope` parameter.
Tutorial Manage Certificates For Federated Single Sign On
General
The instructions now say to verify notification email addresses configured through Microsoft Graph or PowerShell in the Microsoft Entra admin center. Opening the SAML certificate experience can initialize notification registration for custom signing certificates.
Workload Identity Federation Config App Trust Managed Identity
General
The workload identity federation documentation now uses Microsoft Graph Bicep extension version 1.0.0 instead of 0.1.8-preview.
Policy All Users Device Unknown Unsupported
General
The documentation now highlights that device platform conditions rely on user agent strings and recommends pairing them with policies requiring device compliance or app protection to reduce risk.
Attribute Mapping
General
The page’s Microsoft Entra ID-to-AD attribute mapping section was removed and its introductory link now points to the dedicated configuration guide.
Attribute Mapping Entra To Active Directory
General
The guide for provisioning from Microsoft Entra ID to Active Directory was removed. It covered attribute mappings, scoping filters, sAMAccountName customization, and target-container configuration.
Configure Group Source of Authority (SOA) in Microsoft Entra ID
General
The page metadata was updated, and its references now link to the revised “Provision users and groups from Microsoft Entra ID to Active Directory” article.
Configure user Source of Authority (SOA) in Microsoft Entra ID
General
The page’s subservice changed from hybrid to hybrid-cloud-sync, and its reviewer changed from dhanyak to dhanyahk.
Connect Version History
General
The version history no longer states that the 09/23/2026 hotfix will be deployed through phased auto-upgrade. The Microsoft Graph permissions notice was repositioned.
Connect Version History
General
The version history now lists release 2.6.92.0 as September 23, 2026, and the related 2.6.91.0 support date as September 23, 2027. The page metadata date was also updated.
Connect Version History
General
The version history now states that auto-upgrade will move existing installations to the September 18, 2026 hotfix through multiple phases.
Connect Version History
General
Version 2.6.92.0 was released on September 18, 2026, fixing a 2.6.91.0 issue that could prevent Pass-through Authentication setup through the Microsoft Entra Connect wizard.
Migrate Group Writeback
General
The group writeback migration documentation now links to the guidance for changing other attribute mappings.
Prepare apps for Microsoft Entra COOP policy
General
New applications will be subject to Microsoft Entra COOP policy across web protocols after January 31, 2027. Popup-based sign-in may fail unless apps use a COOP-compatible flow, such as MSAL.js v5.
Prepare Your Environment for User SOA
General
The page’s subservice metadata changed from hybrid to hybrid-cloud-sync, and its reviewer metadata was updated.
Preserve a group's organizational unit (Preview)
General
New preview documentation explains how to capture a group's distinguished name in a GroupDN extension before converting its Source of Authority to Microsoft Entra ID.
User Source Of Authority Guidance
General
The page now identifies the subservice as hybrid-cloud-sync instead of hybrid and corrects the reviewer attribution.
Rootly Tutorial
General
The guide now provides explicit Rootly fields for the Entra identifier, login and logout URLs, PEM certificate, and domain, followed by enabling and saving the SSO configuration.
Rootly Tutorial
General
The tutorial now lists the Rootly fields to populate with the copied URLs and PEM certificate, then instructs administrators to enable and save required SSO. The previous instruction to send these details to Rootly support was removed.
Tutorial Manage Certificates For Federated Single Sign On
General
Administrators configuring notification email addresses through Microsoft Graph or PowerShell should re-confirm the address under SAML Certificates and select Save in the Microsoft Entra admin center.
Assign users and devices to traffic forwarding profiles
General
The article now documents assigning users, groups, devices, and device platforms to traffic forwarding profiles, including custom Private Access profiles. It also explains that user/device and platform conditions are evaluated together and that the highest-priority applicable profile is used.
Create a Microsoft Entra Private Access traffic forwarding profile
General
The documentation explains how to create up to 10 custom profiles, configure application acquisition rules, assign users and devices, and set profile priority.
Delete a Microsoft Entra Private Access traffic forwarding profile
General
The documentation explains how Global Secure Access Administrators can delete custom Private Access traffic forwarding profiles. Default profiles cannot be deleted, and deleted custom profiles cannot be restored.
Manage Private Access traffic forwarding profiles
General
Documentation now describes default and custom profiles, including profile settings, assignments, prerequisites, and a preview limit of 10 custom profiles.
Connect Health Adfs
General
The documentation now describes the AD FS service overview, updated alert filtering and details, and the revised Usage Analytics experience with time-range controls. Screenshots and metadata were also refreshed.
Connect Health Data Retrieval
General
The guide now uses the Microsoft Entra Connect Health Sync errors area to access notification settings, review Global Administrator and custom recipients, and export recorded sync errors as a CSV from the command bar.
Health service data isn't up to date alert
General
The page now explains selecting an alert row to view its details, including detection times, affected servers, resolution guidance, and related documentation. It also replaces the alert screenshot and improves image descriptions.
Microsoft Entra Connect Health operations
General
The article updates navigation and steps for email notifications, server or service deletion, and role-based access control, with new screenshots.
How to configure custom HTTP headers in Global Secure Access
General
The documentation now states that custom headers are available only with Web Filtering (v2) policies and links to the related guidance.
Connect Version History
General
The documentation metadata and release entries now show September 16, 2026 instead of September 15, 2026 for version 2.6.91.0 and its related timeline.
Connect Version History
General
The documentation now requires importing `ADSync.psd1` before `AzureADSSO.psd1` when configuring Seamless Single Sign-On with the standalone module.
Connect Version History
General
The version history table adds a Release date column for listed Microsoft Entra Connect versions while retaining end-of-support dates.
Connect Version History
General
The entry now uses “phishing-resistant authentication” instead of “passwordless authentication” and updates the page date to September 14, 2026.
Connect Version History
General
The documentation now records a fix for an issue where reopening the wizard and expanding a fully deselected domain could reselect it and enable synchronization for the entire domain.
Connect Version History
General
Four references to version 2.6.91.0 now point to the correct documentation section, #26910, instead of #26900.
Connect Version History
General
The documentation replaces version 2.6.90.0 with 2.6.91.0 and updates related guidance, including the 2.6.84.0 support timeline and fixes for existing-database upgrades and Synchronization Service Manager crashes.
Connect Version History
General
The documentation replaces references to version 2.6.90.0 with 2.6.91.0, updates related fix guidance, and identifies 2.6.91.0 as the latest available version.
Connect Version History
General
The 2.6.90.0 release adds a guided migration workflow from Microsoft Entra Connect Sync to Cloud Sync, including assessment, agent setup, staged activation, validation, and rollback. It is available only in the Azure public cloud.
Connect Version History
General
The documentation now states that the Select Containers dialog remains available for viewing selections, while changes should be made through Customize synchronization options in the Microsoft Entra Connect wizard.
Connect Version History
General
The documentation adds release notes for an upcoming version with Delos sovereign cloud support, authentication and connector behavior changes, bug fixes, and security improvements. The version and release date remain TBD.
Using single sign-on with cloud sync
General
The article’s publication date changed from April 9, 2025, to September 15, 2026, and an AI-assisted usage marker was added.
Dataverse - Assign non-Power Platform licensed Entra users to Dataverse Activities
General
We are announcing the ability to assign non-Power Platform licensed Entra users to Dataverse Activities in Dataverse. This feature will reach public preview on September 30, 2026.
Configure
General
The configuration guide no longer includes the note about synchronization service account creation and possible errors involving multifactor or interactive authentication.
Migrate Microsoft Entra Enterprise State Roaming
General
As of July 2026, ESR can no longer be managed in the Microsoft Entra admin center. Administrators must use Windows settings backup and restore policies; the supported settings remain unchanged.
Validate Oidc Multitenant App Gallery
General
The documentation now states that applications using Microsoft identity platform v1 endpoints cannot be validated through self-service App Gallery onboarding. It recommends migrating to v2 endpoints.
How to configure custom headers (preview)
General
The page now explains how to find modified-header transactions in Global Secure Access traffic logs and add the Custom Headers column. During the September 2026 rollout, a special Entra Admin Center link may be needed to view these details.
Licensing Service Plan Reference
General
Several licensing entries now use updated Microsoft 365 Copilot product names, including Education, Finance, and Sales offerings.
Licensing Service Plan Reference
General
Several entries now use Microsoft Copilot branding instead of Microsoft 365 Copilot branding. Their service plan identifiers and mappings remain unchanged in the documented rows.
My Staff Configure
General
The page no longer identifies the legacy My Apps and My Staff settings as being under Manage user feature settings. It states that these settings are unused, do not affect behavior, and are being removed from the admin center.
Use My Staff to delegate user management
General
My Staff access is now determined by administrative role assignments and their administrative unit scope. The legacy settings under Manage user feature settings no longer affect behavior and are being removed.
Set up B2B direct connect
General
The documentation now explains how Microsoft Entra ID accepts compliant-device claims from an external user’s home tenant and how Conditional Access evaluates those claims. It also describes the trust implications and behavior when the setting is disabled.
Configure Managed Identities Assignment Restriction
General
The documentation now clarifies that Azure CLI commands and IaC templates must use the provider namespace Microsoft.Storage, while Microsoft.Storage/* is only an Azure portal display convention.
Managed Identities Assignment Restriction
General
The documentation now clarifies that Azure CLI commands and IaC templates must use Microsoft.Storage. The Microsoft.Storage/* format shown in the portal is only a display convention and is not accepted by the API.
Delegate By Task
General
The documentation now lists Security Administrator, alongside Helpdesk Administrator and User Administrator, for invalidating non-admin users’ refresh tokens.
Least privileged roles by task
General
The task delegation table now maps identity containment actions for SOC incident response to the Entra SOC Identity Responder role.
Manage Agent Identities End User
General
The documentation now states that sponsors cannot re-enable disabled agents; an owner or administrator must help re-enable them.
Permissions Reference
General
The permissions reference now documents the Entra SOC Identity Responder role and its identity-containment actions, including disabling users, revoking active sign-in sessions, and resetting passwords.
Whats New
General
The June 2026 update adds the Entra SOC Identity Responder role and updates the Security Operator and AI Administrator roles.
Managed Identities Faq
General
The documentation now states that creating a managed identity is blocked when the resulting directory usage reaches or exceeds 98% of the tenant quota. This applies to new or recreated service principals; existing identities and assignments continue to work.
Publish App Gallery
General
The documentation now describes submission states from Draft through Published, with example review and publishing timelines measured in business days. It notes that actual times vary based on submission completeness and validation.
V2 Howto App Gallery Listing
General
The app gallery listing documentation now uses the Partner Program URL without the `/en-US` locale segment.
V2 Howto App Gallery Listing
General
The app gallery listing guide now uses shorter link text for the Microsoft AI Cloud Partner Program; the destination URL is unchanged.
Configure Custom Headers
General
Consistent spacing was added to domain lists for Claude, GitHub, Slack, Dropbox, and YouTube entries. Header names and descriptions are unchanged.
Connect Install Roadmap
General
The roadmap now links to download ID 108777 for both the AD FS and AD DS Connect Health agents, replacing download ID 108565.
How to configure custom headers (preview)
General
The page title now marks custom headers as preview and notes that rollout is expected to complete by September 10, 2026.
Validate Oidc Multitenant App Gallery
General
The documentation now links to “Publish your app to Microsoft Entra App Gallery” instead of the “Submit your validation results” section.
Validate Oidc Multitenant App Gallery
General
The article adds lightbox links to four screenshots, adds a next-step link to submit validation results, and removes the app gallery publication request link.
Agent Access Packages
General
The documentation now provides step-by-step My Access portal instructions for authorized users to request an access package for another user, including the US Government portal URL.
Group Source Of Authority Configure
General
The documentation now points administrators to the Microsoft Entra Cloud Sync tutorial for provisioning groups to Active Directory Domain Services, replacing the previous provisioning overview and on-premises app governance links.