đź“‹ Microsoft Entra Documentation Changes

Daily summary for changes since April 6th 2026, 9:44 PM PDT

Report generated on April 7th 2026, 9:44 PM PDT

📊 Summary

41
Total Commits
0
New Files
24
Modified Files
0
Deleted Files
14
Contributors

📝 Modified Documentation Files

+128 / -128 lines changed
Commit: Revert "Wrap app names in code tags to resolve spell checker flags"
Changes:
Before
After
 
## Included applications
 
- `App Studio for Microsoft Teams`
- `Augmentation Loop`
- `Call Recorder`
- `Connectors`
- `Copilot Data Platform`
- `DataSecurityInvestigation`
- `Device Management Service`
- `EDU Assignments`
- `EnrichmentSvc`
- `Enterprise Copilot Platform`
- `Groups Service`
- `IC3 Gateway`
- `IC3 Gateway Non Cae`
- `Insights Services`
- `INT Augmentation Loop 1P`
- `Legacy Smart Compose`
- `Loop`
 
## Included applications
 
- App Studio for Microsoft Teams
- Augmentation Loop
- Call Recorder
- Connectors
- Copilot Data Platform
- DataSecurityInvestigation
- Device Management Service
- EDU Assignments
- EnrichmentSvc
- Enterprise Copilot Platform
- Groups Service
- IC3 Gateway
- IC3 Gateway Non Cae
- Insights Services
- INT Augmentation Loop 1P
- Legacy Smart Compose
- Loop
+21 / -10 lines changed
Commit: Updating table
Changes:
Before
After
---
title: Services and integration partners for External ID
description: Learn about partners who can help with deployment and integration of customer identity and access management (CIAM) scenarios using Microsoft Entra External ID.
ms.topic: partner-tools
ms.date: 03/26/2026
 
## Services and integration partners for Microsoft Entra External ID
 
Partners can help your organization with planning and deployment of Microsoft Entra External ID scenarios, including customer identity and access management (CIAM). Customers can engage partners listed in the [Microsoft Solution Partner finder](https://appsource.microsoft.com/marketplace/partner-dir) or can choose from the services partners listed in the following table. The descriptions and linked pages are provided by the partners themselves. You can use the description to identify a partner that you might want to contact and learn more about.
 
| Name | Description | Contact |
| ------- | --------------------- | ------- |
|[Avanade](https://www.avanade.com) |"Avanade is excited to be a launch partner with Microsoft for migrating clients from Entra B2C to Entra External ID. Our deep expertise on both Entra B2C and Entra External ID has led to the development of unique assets that accelerate the migration to Entra External ID, reducing migration risk and improving the end user experience. Avanade provides both greenfield deployment and migration services for Entra External ID and works hand in hand with our clients to tailor the service to meet their needs and provide the best possible experience for consumer sign-in, without compromising on security." | identity@avanade.com |
|[Edgile, a Wipro company](https://edgile.com) |"Edgile, a Wipro company is excited to be a Microsoft Migration Partner for Microsoft Entra External ID. We have spent many years helping customers deploy and manage their customer identity environments including with Azure AD B2C. Our deep and broad experience in customer identity management, Azure AD B2C, and Microsoft's successor Entra External ID makes us uniquely positioned to ensure your program is a success. Our project accelerators will reduce your risk and deliver results faster." | info@edgile.com |
|[EY](https://www.ey.com/en_us/alliances/microsoft) |"The EY organization applies deep industry insight and a refined, human-centered approach to help enterprises reimagine external identity with Microsoft Entra External ID. Through the EY-Microsoft Alliance, proven accelerators and delivery methods streamline transitions from Azure AD B2C and simplify complex integrations, enabling a secure, scalable identity foundation that enhances trust across customer, partner, and developer communities." | Nitin Lalit, nitin.lalit@ey.com; americasmicrosoftallianceteam@ey.com |
|[Grit](https://www.gritiam.com/migration.html) |"Grit Software has deep expertise in consumer identity and access management, with a strong track record of helping Fortune 500 and mid-market companies execute complex transformation projects successfully and on time. For Azure AD B2C to Microsoft Entra External ID migrations, Grit's AI-powered migration service uses advanced coding agents to deliver accurate migrations in days, while ensuring customer data isn't sent to the underlying AI models." | info@gritsoftwaresystems.com |
|[Modern 42](https://www.modern42.com) |"Modern 42 is a specialist identity consultancy delivering enterprise-grade identity advisory and engineering services across Australia. With Microsoft Entra External ID experience for government and private sector customers, Modern 42 has both the technical expertise and experience required to assist any organization to transition from Azure AD B2C to Microsoft Entra External ID, no matter how complex or simple. Modern 42's approach combines strategic consulting with hands-on technical implementation, ensuring CIAM solutions align with your business objectives, regulatory requirements, customer experience expectations, and security best practices." | hello@modern42.com |
|[PlanB.](https://www.plan-b-gmbh.com) |"PlanB. combines deep identity and security expertise with a strong focus on measurable business outcomes. As an experienced partner within the Microsoft Entra ecosystem, we help organizations securely integrate and manage external identities at scale—customers, agents, partners, and suppliers—across their digital platforms. From identity strategy and architecture through hands-on implementation of Microsoft Entra External ID, we ensure security, governance, compliance, and user experience work seamlessly together. Our mission is to simplify complex identity scenarios, reduce risk, and enable sustainable digital growth built on trusted identity foundations." | Felix Rohmeier (Solution Expert for Identity), Identity@plan-b-gmbh.com |
|[Slalom](https://www.slalom.com) |"Slalom is a trusted Microsoft partner that helps organizations modernize identity systems at scale. As an integration partner for Entra External ID migrations, Slalom offers practical experience in identity migrations, organizational change management, and secure customer access. Their B2C to Entra External ID migration approach combines strategic planning, architectural expertise, and proven delivery tools to simplify complex migrations and reduce risk. This empowers organizations to provide secure, scalable customer identity solutions and fully leverage the Microsoft Entra platform." | Tim Van Liew, tim.vanliew@slalom.com |
|[WhoIAM](https://www.whoiam.ai) |"WhoIAM is a trusted specialist in Microsoft customer identity, uniquely positioned to guide organizations through the transition from Azure AD B2C to Microsoft Entra External ID. Founded by former Microsoft identity engineering leaders, WhoIAM brings deep, hands-on expertise across Azure AD B2C, Entra, and large-scale CIAM platforms. Through purpose-built migration tooling, proven just-in-time and bulk migration patterns, and close collaboration with customer engineering and security teams, WhoIAM helps organizations modernize identity with minimal disruption—ensuring continuity today while building a future-ready external identity foundation on Microsoft Entra." | Info@whoiam.ai |
---
title: Partners for Azure AD B2C to Microsoft Entra External ID migrations
description: Learn about partners who can help with deployment and integration of customer identity and access management (CIAM) scenarios using Microsoft Entra External ID.
ms.topic: partner-tools
ms.date: 03/26/2026
 
## Services and integration partners for Microsoft Entra External ID
 
Partners listed below can help you plan and execute migrations from Azure AD B2C to Microsoft Entra External ID.
Use this page to identify and contact partners based on your migration needs, including advisory, implementation, and engineering support. Each partner has published additional content outlining their approach and capabilities.
 
**How to use this list**
- Identify partners aligned to your needs (for example: advisory, implementation, or engineering-led delivery)
- Review partner descriptions and linked resources
- Contact partners directly to begin migration planning and execution
 
| Name | Description | Contact |
| ------- | --------------------- | ------- |
|[Avanade](https://statics.teams.cdn.office.net/evergreen-assets/safelinks/2/atp-safelinks.html) |"Avanade is excited to be a launch partner with Microsoft for migrating clients from Entra B2C to Entra External ID. Our deep expertise on both Entra B2C and Entra External ID has led to the development of unique assets that accelerate the migration to Entra External ID, reducing migration risk and improving the end user experience. Avanade provides both greenfield deployment and migration services for Entra External ID and works hand in hand with our clients to tailor the service to meet their needs and provide the best possible experience for consumer sign-in, without compromising on security." | identity@avanade.com |
|[Edgile, a Wipro company]( https://edgile.com/blog/edgile-a-wipro-company-announced-as-eeid-migration-partner-by-microsoft/) |"Edgile, a Wipro company is excited to be a Microsoft Migration Partner for Microsoft Entra External ID. We have spent many years helping customers deploy and manage their customer identity environments including with Azure AD B2C. Our deep and broad experience in customer identity management, Azure AD B2C, and Microsoft's successor Entra External ID makes us uniquely positioned to ensure your program is a success. Our project accelerators will reduce your risk and deliver results faster." | info@edgile.com |
Modified by Ortagus Winfrey on Apr 7, 2026 2:50 PM
đź“– View on learn.microsoft.com
+24 / -0 lines changed
Commit: Add what's new entry for Agent Registry consolidation into Microsoft Agent 365
Changes:
Before
After
 
## March 2026
 
### Plan for change – Conditional Access enforcement during credential registration for Windows Hello for Business and macOS Platform SSO
 
**Type:** Plan for Change
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
## March 2026
 
### Plan for change – Agent Registry consolidation into Microsoft Agent 365
 
**Type:** Plan for change
**Service category:** Other
**Product capability:** Directory
 
We’re consolidating agent management experiences to make it easier to observe, govern, and secure all agents in your tenant. Agent 365 will be the single source of truth, offering a unified catalog, consistent visibility, and simplified management.
 
**What’s changing**
 
* The Agent registry and Agent collections blades in the [Entra admin center](https://entra.microsoft.com/) will be retired on May 1, 2026.  
* No action is required by administrators. Agent functionality and management remain unaffected. You can still access the agent inventory in the [All agents view within the Microsoft 365 admin center (MAC)](https://admin.microsoft.com/Adminportal/Home#/homepage).  
 
**With this change:**
 
* Agent 365 becomes the unified registry and control plane for agents.  
* Microsoft Entra continues to provide the identity foundation through Agent ID.  
+5 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Related Content
 
- [App protection policies overview](/mem/intune/apps/app-protection-policy)
- [Conditional Access common policies](concept-conditional-access-policy-common.md)
 
 
 
 
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## User exclusions
 
[!INCLUDE [active-directory-policy-exclusions](~/includes/entra-policy-exclude-user.md)]
 
## Related content
 
- [App protection policies overview](/mem/intune/apps/app-protection-policy)
- [Conditional Access common policies](concept-conditional-access-policy-common.md)
+5 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Related Content
 
- [Conditional Access templates](concept-conditional-access-policy-common.md)
- [Determine effect using Conditional Access report-only mode](howto-conditional-access-insights-reporting.md)
 
 
 
 
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## User exclusions
 
[!INCLUDE [active-directory-policy-exclusions](~/includes/entra-policy-exclude-user.md)]
 
## Related content
 
- [Conditional Access templates](concept-conditional-access-policy-common.md)
- [Determine effect using Conditional Access report-only mode](howto-conditional-access-insights-reporting.md)
+2 / -2 lines changed
Commit: Clarify password addition report timeframe and guidance
Changes:
Before
After
 
1. Go to the admin center and select Org settings.
1. Select Restricted Mode, find the **Block addition of new password credentials to apps** setting.
1. Select **download report** to view recent password additions in your organization.
 
## Remove existing passwords
 
1. Select Restricted Mode, find the **Block addition of new password credentials to apps** setting.
1. Select **download report** to view existing apps with passwords.
 
Apps using passwords should be modernized before their existing passwords are removed. Passwords on existing applications can be removed using the [Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType~/null/sourceType/Microsoft_AAD_IAM), [Microsoft Graph PowerShell](/powershell/module/microsoft.graph.applications/remove-mgapplicationpassword), or the [Microsoft Graph API](/graph/api/application-removepassword?tabs=http).
 
1. Go to the admin center and select Org settings.
1. Select Restricted Mode, find the **Block addition of new password credentials to apps** setting.
1. Select **download report** to view password additions in your organization in the last 30 days.
 
## Remove existing passwords
 
1. Select Restricted Mode, find the **Block addition of new password credentials to apps** setting.
1. Select **download report** to view existing apps with passwords.
 
Apps using passwords should be modernized before their existing passwords are removed. Developers should follow the [credential guidance](/entra/identity-platform/security-best-practices-for-app-registration#credentials-including-certificates-and-secrets) to modernize the apps they own. Passwords on existing applications can be removed using the [Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType~/null/sourceType/Microsoft_AAD_IAM), [Microsoft Graph PowerShell](/powershell/module/microsoft.graph.applications/remove-mgapplicationpassword), or the [Microsoft Graph API](/graph/api/application-removepassword?tabs=http).
+4 / -0 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
To test your policy, try to sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using a test account. You should see a dialog that requires you to accept your terms of use.
 
## Related content
 
[Microsoft Entra terms of use](terms-of-use.md)
 
 
 
 
 
To test your policy, try to sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using a test account. You should see a dialog that requires you to accept your terms of use.
 
## User exclusions
 
[!INCLUDE [active-directory-policy-exclusions](~/includes/entra-policy-exclude-user.md)]
 
## Related content
 
[Microsoft Entra terms of use](terms-of-use.md)
+4 / -0 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
1. Confirm your settings and set **Enable policy** to **Enabled**.
1. Select **Create** to enable your policy.
 
## Related content
 
- [Conditional Access: Authentication flows](concept-authentication-flows.md)
 
 
 
 
1. Confirm your settings and set **Enable policy** to **Enabled**.
1. Select **Create** to enable your policy.
 
## User exclusions
 
[!INCLUDE [active-directory-policy-exclusions](~/includes/entra-policy-exclude-user.md)]
 
## Related content
 
- [Conditional Access: Authentication flows](concept-authentication-flows.md)
+2 / -2 lines changed
Commit: app-prov-scim-api-cursor-based-pagination
Changes:
Before
After
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: how-to
ms.date: 03/26/2026
ms.author: jfields
ms.reviewer: chmutali
ai-usage: ai-assisted
- [RFC 7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements](https://www.rfc-editor.org/rfc/rfc7642)
- [RFC 7643: System for Cross-domain Identity Management: Core Schema](https://www.rfc-editor.org/rfc/rfc7643)
- [RFC 7644: System for Cross-domain Identity Management: Protocol](https://www.rfc-editor.org/rfc/rfc7644)
- [Cursor-based Pagination of SCIM Resources](https://www.ietf.org/archive/id/draft-ietf-scim-cursor-pagination-05.html)
 
All SCIM API endpoints are under the base URL: `https://graph.microsoft.com/rp/scim`
 
ms.service: entra-id
ms.subservice: app-provisioning
ms.topic: how-to
ms.date: 04/07/2026
ms.author: jfields
ms.reviewer: chmutali
ai-usage: ai-assisted
- [RFC 7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements](https://www.rfc-editor.org/rfc/rfc7642)
- [RFC 7643: System for Cross-domain Identity Management: Core Schema](https://www.rfc-editor.org/rfc/rfc7643)
- [RFC 7644: System for Cross-domain Identity Management: Protocol](https://www.rfc-editor.org/rfc/rfc7644)
- [RFC 9865: Cursor-based pagination of SCIM resources](https://datatracker.ietf.org/doc/rfc9865/)
 
All SCIM API endpoints are under the base URL: `https://graph.microsoft.com/rp/scim`
 
+1 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Next steps
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Related content
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
+1 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Next steps
 
- [Conditional Access templates](concept-conditional-access-policy-common.md)
 
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Related content
 
- [Conditional Access templates](concept-conditional-access-policy-common.md)
 
+1 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Next steps
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
 
[!INCLUDE [conditional-access-report-only-mode](../../includes/conditional-access-report-only-mode.md)]
 
## Related content
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
+1 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
There's a known issue where there's a pre-existing, unregistered account, like `user@contoso.com` in Microsoft Edge, or if a user signs in without registering using the Heads Up Page, then the account isn't properly enrolled in MAM. This configuration blocks the user from being properly enrolled in MAM.
 
## Next steps
 
- [What is Microsoft Intune app management?](/mem/intune/apps/app-management)
- [App protection policies overview](/mem/intune/apps/app-protection-policy)
 
There's a known issue where there's a pre-existing, unregistered account, like `user@contoso.com` in Microsoft Edge, or if a user signs in without registering using the Heads Up Page, then the account isn't properly enrolled in MAM. This configuration blocks the user from being properly enrolled in MAM.
 
## Related content
 
- [What is Microsoft Intune app management?](/mem/intune/apps/app-management)
- [App protection policies overview](/mem/intune/apps/app-protection-policy)
+1 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
 
The prompt for authentication usually occurs when a device is offline for an extended period of time. This change eliminates the need for an exclusion in the Conditional Access policy for Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later. A Conditional Access policy can still be used with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later if the prompt for user authentication via a toast notification isn't desired.
 
## Next steps
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
 
The prompt for authentication usually occurs when a device is offline for an extended period of time. This change eliminates the need for an exclusion in the Conditional Access policy for Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later. A Conditional Access policy can still be used with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later if the prompt for user authentication via a toast notification isn't desired.
 
## Related content
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
+1 / -1 lines changed
Commit: Standardize CA policy article headers and add missing boilerplate
Changes:
Before
After
> [!NOTE]
> Conditional Access policies are enforced after first-factor authentication is completed. Conditional Access isn't intended to be an organization's first line of defense for scenarios like denial-of-service (DoS) attacks, but it can use signals from these events to determine access.
 
## Next steps
 
[Conditional Access templates](concept-conditional-access-policy-common.md)
 
> [!NOTE]
> Conditional Access policies are enforced after first-factor authentication is completed. Conditional Access isn't intended to be an organization's first line of defense for scenarios like denial-of-service (DoS) attacks, but it can use signals from these events to determine access.
 
## Related content
 
[Conditional Access templates](concept-conditional-access-policy-common.md)