The new tutorial explains how to provision cloud-managed users, a security group, and its membership into AD DS so members can access an on-premises Kerberos application. User provisioning is identified as being in preview.

The page updates diagram descriptions and explains that provisioned group members must have an AD account. Eligible members include synchronized users, cloud-managed users in scope for user provisioning, and cloud-created security groups. The provisioning example link was also updated.

The article documents how Cloud Sync scopes, matches, creates, updates, and deletes users, groups, and memberships in Active Directory, including matching with msDS-ExternalDirectoryObjectId and user source-of-authority scenarios.

The article expands beyond group-only provisioning to explain provisioning users, groups, or both from Microsoft Entra ID to on-premises AD DS. It adds prerequisites, deployment options, scoping filters, target containers, and attribute-mapping guidance; user-related options are marked Preview.

A new preview how-to explains on-demand testing for users and groups, default accidental-delete and email settings, enabling configurations, handling quarantines, restarting sync, and removing configurations.

A new article documents prerequisites and license requirements for provisioning users and groups from Microsoft Entra ID to on-premises AD DS using Cloud Sync. It also links to configuration, testing, deployment, and agent setup guidance.

The tutorial now covers provisioning both users and groups from Microsoft Entra ID to Active Directory. It adds examples for filtering groups by an extension value and mapping a user extension into an Active Directory attribute, along with updated prerequisites and guidance.

The guide now documents testing individual users or groups when provisioning from Microsoft Entra ID to Active Directory. It adds steps for selecting objects, selecting up to five group members, and reviewing detailed results, retries, and additional tests.

The article now covers directory extensions for both users and groups, clarifies the supported application identifier and Tenant Schema Extension App prerequisite, and updates examples, links, and related content.

The documentation warns that ChatWork will discontinue SCIM-based provisioning on October 1, 2026, retiring the Entra Enterprise App Gallery integration.

The page’s subservice metadata was updated, and its attribute-mapping link now points to the renamed configuration guide.

The article now states that it covers on-demand provisioning from Active Directory to Microsoft Entra ID and links to a separate article for provisioning in the reverse direction.

The tutorial for provisioning groups to AD DS with Microsoft Entra Cloud Sync was deleted, including its setup guidance, scoping recommendation, and group/user synchronization scenarios.

The article title no longer includes “(preview)” for custom call-outs using LCW extensibility workflows.

The documented Tenant URL changed from `https://docs.rootly.com/integrations/scim` to `https://rootly.com/scim`.

The tutorial now specifies `https://rootly.com/scim` as the Tenant URL instead of `https://docs.rootly.com/integrations/scim`.

The tutorial now uses a new screenshot and updated alternative text for the Netskope User Authentication results list.

The group writeback migration documentation now links to the guidance for changing other attribute mappings.

New preview documentation explains how to capture a group's distinguished name in a GroupDN extension before converting its Source of Authority to Microsoft Entra ID.

Version 2.6.92.0 was released on September 18, 2026, fixing a 2.6.91.0 issue that could prevent Pass-through Authentication setup through the Microsoft Entra Connect wizard.

New applications will be subject to Microsoft Entra COOP policy across web protocols after January 31, 2027. Popup-based sign-in may fail unless apps use a COOP-compatible flow, such as MSAL.js v5.

The page metadata was updated, and its references now link to the revised “Provision users and groups from Microsoft Entra ID to Active Directory” article.

The version history no longer states that the 09/23/2026 hotfix will be deployed through phased auto-upgrade. The Microsoft Graph permissions notice was repositioned.

The version history now lists release 2.6.92.0 as September 23, 2026, and the related 2.6.91.0 support date as September 23, 2027. The page metadata date was also updated.

The page’s subservice changed from hybrid to hybrid-cloud-sync, and its reviewer changed from dhanyak to dhanyahk.

The page’s subservice metadata changed from hybrid to hybrid-cloud-sync, and its reviewer metadata was updated.

The page now identifies the subservice as hybrid-cloud-sync instead of hybrid and corrects the reviewer attribution.

The page’s Microsoft Entra ID-to-AD attribute mapping section was removed and its introductory link now points to the dedicated configuration guide.

The version history now states that auto-upgrade will move existing installations to the September 18, 2026 hotfix through multiple phases.

The guide for provisioning from Microsoft Entra ID to Active Directory was removed. It covered attribute mappings, scoping filters, sAMAccountName customization, and target-container configuration.

The guide now provides explicit Rootly fields for the Entra identifier, login and logout URLs, PEM certificate, and domain, followed by enabling and saving the SSO configuration.

The tutorial now lists the Rootly fields to populate with the copied URLs and PEM certificate, then instructs administrators to enable and save required SSO. The previous instruction to send these details to Rootly support was removed.

Administrators configuring notification email addresses through Microsoft Graph or PowerShell should re-confirm the address under SAML Certificates and select Save in the Microsoft Entra admin center.

The Microsoft Entra FIDO2 hardware vendor documentation now references MDS version 279 instead of 275 and adds the FEITIAN FT-JCOS BioCard, including its AAGUID and feature capabilities. The page date was also updated.

The documentation now identifies affected accounts as cloud-managed users and explains that password writeback is unavailable for them. It also states that they can access Kerberos-based applications through passwordless authentication using the AD account created by provisioning.

The documentation now specifies that password writeback isn't available for users created in Microsoft Entra. These users can authenticate to Kerberos-based applications only through passwordless authentication using the provisioned AD account.

The documentation identifies Soprano and Telesign as initial private-preview providers for SMS and voice authentication. It also states that provider selection and configuration through Microsoft Security Store will begin October 30, 2026.

The documentation now identifies Soprano and Telesign as initial providers and links to their commercial offers. Configuration begins October 30, 2026.

The page now refers to customer-managed telephony providers as Choose Your Own Telephony Provider and updates related headings and descriptions. The availability dates remain September 18, 2026, for provider information and October 30, 2026, for configuration.

The documentation now refers to selected providers as “telephony providers” instead of “telecommunications providers.”

The documentation no longer includes recommendations to pilot with a limited group or prepare a fallback authentication method and support process for delivery interruptions.

A new article explains groups-only, users-only, and users-and-groups provisioning from Microsoft Entra ID to AD DS. User provisioning is in preview, while group provisioning is generally available; it also documents per-domain configuration limits and performance guidance.

The new overview describes how Cloud Sync provisions users, groups, and memberships from Microsoft Entra ID to AD, including supported configurations, user types, attribute updates, enforcement, and provisioning flow. User provisioning is in preview, while group provisioning is generally available; password writeback isn't supported.

The article now describes provisioning Microsoft Entra-managed users back to Active Directory with Cloud Sync so they can access Kerberos-based on-premises applications while their lifecycle is governed from the cloud. It also updates passwordless authentication guidance and diagrams.

The guidance now specifies that password-based apps, including LDAP-authenticated apps, must be updated to Kerberos for cloud-managed users to use passwordless authentication.

The guidance now links to updated Microsoft Entra Cloud Sync documentation for provisioning groups to Active Directory and nested-group membership behavior. Page metadata was also refreshed.

The article’s introductory wording and references were updated, including the link to cloud-first identity management guidance. The described Group SOA and group replication steps remain unchanged.

The documentation now states that password writeback isn't supported for applications that collect passwords, including applications that authenticate users through an LDAP bind.

The Continuous Access Evaluation documentation no longer includes the note that SharePoint Online doesn't support user risk events.

The page now documents a shared default limit of 700 app roles and exposed delegated permission scopes per application or service principal, including counting rules, existing objects above the limit, and design guidance.

The guide now focuses on phased transitions of user and group source of authority to Microsoft Entra ID while maintaining application access. It also updates readiness content and LDAP-binding application guidance, including provisioning cloud-managed users and groups back to on-premises AD or using Microsoft Entra Domain Services.

The on-premises access guidance now links to a Microsoft Entra Cloud Sync how-to page for provisioning groups to Active Directory.

Microsoft Defender for Cloud Apps is updating App Governance permissions for select Microsoft Entra roles to align with Defender XDR Unified RBAC. Changes affect Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles starting mid-October 2026. Admins should review and adjust role assignments accordingly.

The documentation now lists a default limit of 700 shared permission definitions for app roles and exposed delegated scopes, plus an aggregate manifest limit of 1,200 collection entries.

The page’s subservice metadata changed to hybrid-cloud-sync, and the listed reviewer changed.

The guide now states that users without a registered or enrolled device are prompted to register it, and documents a different message for users who have not installed the latest September 2026 Windows update.

On August 24, 2026, we initiated the gradual roll out of self-service migrations to Microsoft Entra Agent IDs for Copilot Studio agents in Power Platform Advisor. Beginning on September 2026, automatic migrations of agents without Entra Agent ID to Microsoft Entra Agent ID were also initiated.

To strengthen your organization's security posture, Microsoft will create a new Microsoft-managed Conditional Access (CA) policy—Require risk remediation for high-risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self-remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.

The documentation now states that credential protection covers group members and owners, including eligible members and owners who have not yet activated.

The role-assignable groups description now includes members and owners, including eligible members and owners who have not activated their assignments.

The guidance now links to a different Microsoft Entra Cloud Sync configuration page for provisioning groups to Active Directory Domain Services.

The licensing table now covers guests disabled or deleted by lifecycle policies, sponsor attestations, and users sponsoring new guests. It also lists the related beta API endpoints for attestation and sponsorship.

Security Copilot is now included with Microsoft 365 E5/E7 plans, integrating agents across Defender, Entra, Intune, Purview, and its portal. No purchase or action is needed. Organizations get monthly Security Compute Units, developer tools, and can explore additional paid features or opt out by contacting support.

Documentation now describes default and custom profiles, including profile settings, assignments, prerequisites, and a preview limit of 10 custom profiles.

The documentation explains how to create up to 10 custom profiles, configure application acquisition rules, assign users and devices, and set profile priority.

The documentation explains how Global Secure Access Administrators can delete custom Private Access traffic forwarding profiles. Default profiles cannot be deleted, and deleted custom profiles cannot be restored.

Global Secure Access now documents a default Private Access profile plus up to 10 custom profiles during preview. Profiles can target users, groups, devices, and device platforms, with priority determining which applicable profile the client uses.

The documentation now states that app roles and exposed delegated permission scopes share a default limit of 700 permission definitions per application or service principal. Disabled definitions count, and this limit is separate from the aggregate manifest limit.

The documentation now states that app roles and exposed delegated permission scopes share a default limit of 700 definitions per application or service principal. Disabled definitions count, and this limit is separate from the aggregate manifest limit.

The documentation now explains setup for applications and user-assigned managed identities, using Microsoft Graph for applications and Azure Resource Manager for managed identities. It also adds details about credential properties, including claimsMatchingExpression.

The guidance now covers applications and user-assigned managed identities, including Azure Resource Manager setup instructions and updated GitLab claim-matching requirements.

The documentation now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It adds a warning that blocking HTML or JSON can disrupt normal web and API traffic, and updates the stated coverage from HTTP/1.1 to HTTP/S.

The documentation replaces the Source type condition with Session type, adds a known internet access limitations reference, and revises guidance for WebSocket filtering, API rate limiting, and Purview inspection failures.

The documentation now describes real-time controls for content shared with generative AI applications, unmanaged cloud apps, and other internet destinations. It adds details about Basic content filtering and Purview-based inspection of files and text.

The article now documents assigning users, groups, devices, and device platforms to traffic forwarding profiles, including custom Private Access profiles. It also explains that user/device and platform conditions are evaluated together and that the highest-priority applicable profile is used.