Daily.Entra.News
A cross-product view of Microsoft Entra changes related to Microsoft identity platform.
User.ReadBasic.All will no longer provide access to user app role assignments and license details starting mid-September 2026 to fix a security issue. Applications needing this data must switch to User.Read.All or LicenseAssignment.Read.All permissions and update accordingly to avoid disruptions.
The Node.js Express and web application entries in the sample code documentation were updated, including their linked sample resources.
The documentation now uses revised Application (client) ID examples in the endpoint URI and `resourceId` configuration sample.
The documentation now consistently uses a different application client ID in the endpoint URI, calling application claim, and `resourceId` examples.
The best-practices documentation now uses the full “Microsoft Entra Agent ID” and “Microsoft Entra ID” names in two recommendations. The guidance itself is unchanged.
The n8n integration page now consistently calls the pattern “Microsoft Entra ID Auth SDK (sidecar)” instead of “Microsoft Entra Auth SDK.”
The page’s bullet describing platforms and services that create agents retains the same wording and examples, including Copilot Studio, AWS Bedrock, and n8n. No substantive content change is shown.
The documentation now explains how to configure granular AMR values for SAML applications through the manifest or Microsoft Graph, since the admin center has no UI option for `include_granular_amr`. It also documents adding the `amr` claim to OIDC token types and clarifies that `include_granular_amr` applies only to SAML.
Replace `<application-object-id>` with the object ID of your app registration. Create one credential for each subject the workflow presents, such as a different branch or environment.
Replace `{appRegistrationObjectId}` with the application registration's object ID. You can find this value in the Microsoft Entra admin center under **Identity** > **Applications** > **App registrations** by selecting the app registration for your Global Secure Access application and copying the **Object ID** from the **Overview** page. To return to the default behavior, set `trafficRoutingMethod` to `random`. For more information, see [Update application](/graph/api/application-update?view=graph-rest-beta&preserve-view=true).
- GitHub Actions. First, configure a trust relationship between your [user-assigned managed identity](workload-identity-federation-create-trust-user-assigned-managed-identity.md) or [application](workload-identity-federation-create-trust.md) in Microsoft Entra ID and a GitHub repo in the [Microsoft Entra admin center](https://entra.microsoft.com) or using Microsoft Graph. Then [configure a GitHub Actions workflow](/azure/developer/github/connect-from-azure) to get an access token from Microsoft identity provider and access Azure resources.
Claims reference with details on the claims included in access tokens issued by the Microsoft identity platform.
Learn about access tokens used in the Microsoft identity platform.
Learn how to acquire a token in a single-page app and call a web API using the Microsoft identity platform.
Learn about the process of registering your application so it can integrate with the Microsoft identity platform.
The types of apps and scenarios supported by the Microsoft identity platform.
Learn about the basics of authorization in the Microsoft identity platform.
Learn about best practices, recommendations, and common oversights when integrating with the Microsoft identity platform.
Learn how to build a web app that calls protected web APIs using the Microsoft identity platform. Explore options for ASP.NET Core, ASP.NET, Java, Node.js, and Python.
Learn how to call a protected ASP.NET Core web API using the Microsoft identity platform with cURL.
Learn how to call a protected ASP.NET Core web API using the Microsoft identity platform and Insomnia.
Explanation of claims challenges, claims requests, and client capabilities in the Microsoft identity platform.
Learn about the custom claims policy and claims mapping policy types, which are used to modify the claims emitted in tokens in the Microsoft identity platform.
Include file that explains the common steps you need to take for all public client apps when it comes to migration from ADAL to MSAL.
Learn how to configure optional claims and attributes in access tokens issued by Microsoft identity platform; optional claims can add useful user information for your app.
Learn how to create an agent identity blueprint that serves as a template for multiple agent identities using Microsoft Graph APIs and PowerShell.
Learn about what custom RBAC is and why it's important to implement in applications.
Compare solutions for using Microsoft Entra External ID to work with people outside your organization, including B2B collaboration and Azure AD B2C.
Learn how to customize the claims issued by Microsoft identity platform in the JSON web token (JWT) token for enterprise applications.
Learn how developers can request for permissions through consent in the Microsoft identity platform endpoint.
As a developer, I want to learn how to acquire tokens for web APIs so that I can enable secure API calls in my application.
In this how-to guide, register a web API with the Microsoft identity platform and configure its scopes, exposing it to clients for permissions-based access to the API's resources.
In this how-to, you configure an application registered with the Microsoft identity platform to change who, or what accounts, can access the application.
Learn how to remove an application registered with the Microsoft identity platform.
In this how-to, you learn how to restore or permanently delete a recently deleted application registered with the Microsoft identity platform.
Learn the details of the claims included in ID tokens issued by the Microsoft identity platform.
Learn about ID tokens used in the Microsoft identity platform.
manager: pmwongera
manager: pmwongera
manager: pmwongera
Learn how using Zero Trust principles can help increase the security of your application and its data.
Learn how to log errors and exceptions in MSAL.js
Describes how to mark an app as publisher verified. When an application is marked as publisher verified, it means that the publisher (application developer) verified the authenticity of their organization using a Cloud Partner Program (CPP) account that completed the verification process and associated this CPP account with that application registration.
An overview of the Microsoft identity platform accounts for Android
A description of authorization in the Microsoft identity platform, including scopes, permissions, and consent.
Learn about when and how to use app-only access in the Microsoft identity platform endpoint.
Learn about when and how to use delegated access in the Microsoft identity platform endpoint.
Learn about the components of the Microsoft identity platform and how they can help you build identity and access management (IAM) support into your applications.
Learn about the UserInfo endpoint on the Microsoft identity platform.
How to update a JavaScript SPA using MSAL.js 2.x and the authorization code flow with PKCE and CORS support.
Claims reference with details on the optional claims that can be included in tokens in the Microsoft identity platform.
Learn the foundational concepts and scenarios around consent and permissions in the Microsoft identity platform
Learn about benefits, program requirements, and frequently asked questions in the publisher verification program for the Microsoft identity platform.
A daemon app code sample quickstart that shows how to acquire an access token to call a protected web API by using Microsoft identity platform
In this quickstart, learn how Android applications can call an API that requires access tokens issued by the Microsoft identity platform.
In this quickstart, learn how an iOS or macOS app can sign in users, get an access token from the Microsoft identity platform, and call the Microsoft Graph API.
In this quickstart, learn how an iOS or macOS app can sign in users, get an access token from the Microsoft identity platform, and call the Microsoft Graph API.
In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET web API by using the Microsoft identity platform for authorization.
In this quickstart, learn how to call an ASP.NET web API that's protected by the Microsoft identity platform from a Windows Desktop (WPF) application.
In this quickstart, learn how to call an ASP.NET web API that's protected by the Microsoft identity platform from a Windows Desktop (WPF) application.
In this quickstart, you learn how a Java app can get an access token and call an API protected by Microsoft identity platform endpoint, using the app's own identity
In this quickstart, you learn how a Java app can get an access token and call an API protected by Microsoft identity platform endpoint, using the app's own identity
In this quickstart, you download and run a code sample that shows how a Node.js console application can get an access token and call an API protected by a Microsoft identity platform endpoint, using the app's own identity
In this quickstart, you download and run a code sample that shows how a Node.js console application can get an access token and call an API protected by a Microsoft identity platform endpoint, using the app's own identity
In this quickstart, you learn how a Python process can get an access token and call an API protected by Microsoft identity platform, using the app's own identity
In this quickstart, you learn how a Python process can get an access token and call an API protected by Microsoft identity platform, using the app's own identity
In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET Core web API by using the Microsoft identity platform for authorization.
In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET Core web API by using the Microsoft identity platform for authorization.
In this quickstart, you learn how to register an application with the Microsoft identity platform.
In this quickstart, learn how Android applications can call an API that requires access tokens issued by the Microsoft identity platform.
In this quickstart, learn how a Universal Windows Platform (UWP) application can get an access token and call an API protected by Microsoft identity platform.
In this quickstart, learn how a Windows Presentation Foundation (WPF) application can get an access token and call an API protected by the Microsoft identity platform.
In this quickstart, learn how a Windows Presentation Foundation (WPF) app can get an access token and call an API protected by the Microsoft identity platform.
A description of the best practices and limitations of redirect URIs in the Microsoft identity platform.
Learn about refresh tokens that are used in the Microsoft identity platform.
Learn how to set up a Microsoft Entra test environment so you can test your application integrated with Microsoft identity platform. Evaluate whether you need a separate tenant for testing or if you can use your production tenant.
Learn how Microsoft Entra ID's shared device mode feature enables device sharing for your frontline workers.
In this tutorial, you add support for signing-in users in a web app.
Set up an Android app project that signs in users into customer facing app by in an external tenant or employees in a workforce tenant
This article discusses the best practices for signing key rollover in Microsoft Entra ID.
Learn where to get help and find answers to your questions as you build identity and access management (IAM) solutions that integrate with Microsoft Entra ID and other components of the Microsoft identity platform.
Explanation and overview of building mobile applications that support single sign-on and app protection policies using the Microsoft identity platform and integrating with Microsoft Entra ID.
Conceptual documentation about audiences and supported account types in in the Microsoft identity platform
Describes how to troubleshoot publisher verification for the Microsoft identity platform by calling Microsoft Graph APIs.
Learn how to acquire an access token in a Node/Express.js web to read user's profile detail from Microsoft Graph API
Protect the endpoint of an API, then run it to ensure it's listening for HTTP requests.
Learn how to call a web API whose endpoints are protected using the Microsoft identity platform
Call Microsoft Graph API from a Python Flask web app
Learn about how to call a protected web API from your .NET client daemon app. In this tutorial, we call Microsoft Graph API.
In this tutorial, you build an Electron desktop app that can sign in users and use the auth code flow to obtain an access token from the Microsoft identity platform and call the Microsoft Graph API.
This tutorial demonstrates how to add app roles to .NET Multi-platform App UI (.NET MAUI) shell and receive them in the ID token.
This tutorial demonstrates how to add app roles to .NET Multi-platform App UI (.NET MAUI) and receive them in the ID token.
Learn how developers can stop applications from requesting unnecessary permissions and also add new permissions for applications in the Microsoft identity platform.
Learn about changes to the Microsoft identity platform that can impact your application.
Learn about the validation differences of various properties for different supported account types when registering your app with the Microsoft identity platform.
In this quickstart, you learn how to configure app registration and API permissions for a Web API, and how to grant admin consent to these permissions.
Build a web API that calls other APIs using the Microsoft identity platform. Learn how to acquire tokens and make secure API calls.
New and updated articles in the Microsoft identity platform documentation.
To complete the scenario in this quickstart, you need:
author: kenwith
author: kenwith
We’re introducing a new feature in public preview, Dataverse Agent users, powered by Microsoft Entra Agent ID. Rollout of this feature will start on May 4, 2026, and is expected to reach North America by May 22, 2026.
Learn how to create an agent identity blueprint that serves as a template for multiple agent identities using Microsoft Graph APIs and PowerShell.
Learn about the Microsoft Entra recommendation to migrate from Azure Active Directory Graph APIs to Microsoft Graph APIs.
author: garrodonnell
Learn how to reset the redemption status for a guest user in Microsoft Entra External ID. This guide covers using the admin center, PowerShell, and Microsoft Graph API.
Assign remote networks to traffic forwarding profiles through the Microsoft Entra admin center or Microsoft Graph API to route branch office traffic through Global Secure Access.
Starting May 1, 2026, Microsoft is retiring the Agent registry and Agent collections blades in the Microsoft Entra admin center. Agent 365 will be the unified platform for agent management, with a new API replacing the existing one. No immediate admin action is required.
ai-usage: ai-assisted
ai-usage: ai-assisted
ai-usage: ai-assisted
This article explains how to call a Microsoft Graph API from an agent using agent identities or an agent's user account.
Create and manage a multitenant organization using Microsoft Graph PowerShell or Microsoft Graph API. Covers creating the organization, adding tenants, joining, and managing roles.
Configure cross-tenant synchronization using Microsoft Graph PowerShell or Microsoft Graph API. Includes enabling synchronization, setting up automatic redemption, creating provisioning jobs, and testing on-demand provisioning.
Configure cross-tenant access and identity synchronization policy templates for multitenant organizations using the Microsoft Graph API. Covers automatic redemption, inbound sync, and template management.
