Explains requirements to prepare FIDO2 hardware for attestation with Microsoft Entra ID
Day in brief
17 July 2025: Entra guidance sharpened OAuth security and External ID migration practices
This was a documentation-maintenance day rather than a feature-release day. The clearest security guidance says not to use the OAuth implicit grant and to use authorization code with PKCE instead. Entra External ID documentation also points Azure AD B2C customers to a seamless user-migration sample. Other substantive clarifications cover FIDO2 attestation preparation, mobile SSO security patterns, and Conditional Access authentication context. The supplied changes provide no evidence of a new feature, preview, general availability release, retirement, or changed service behavior.
- MSAL guidance explicitly rejects the implicit grant
Entra ID · AuthenticationThe Microsoft identity platform authentication-flows guidance now states “Do not use” for the implicit grant and directs developers to authorization code with PKCE. This is explicit security guidance for application implementations, not evidence that the flow was retired or that existing tenants changed behavior.
- External ID documentation adds a concrete B2C migration reference
External ID · DeveloperThe Migrate Users page identifies a seamless user-migration sample for Azure AD B2C migrations, including a custom policy and REST API example for moving to Entra External ID for customers. The supplied text does not establish a new migration service or a required cutover.
- FIDO2 attestation guidance clarifies vendor preparationEntra ID · Authentication
The Entra ID attestation page explains requirements for preparing FIDO2 hardware for attestation with Microsoft Entra ID. This is implementation and vendor guidance; the evidence does not say that attestation requirements or acceptance criteria changed.
- Mobile SSO guidance connects SSO with stronger authentication controls
Entra ID · Conditional AccessThe mobile SSO overview highlights that enabling SSO can support passwordless authentication, Conditional Access enforcement, and single sign-out, including scenarios involving shared devices. This clarifies security and sign-out design considerations rather than announcing a new mobile SSO capability.
- Conditional Access authentication-context guidance includes compliant-device contextEntra ID · Conditional Access
The developer guide's updated content includes “C2 – Require compliant devices” within its authentication-context guidance. The evidence supports a documentation clarification for developers using context-based access, not a new Conditional Access control or changed enforcement behavior.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
8 updates
Microsoft Entra ID
7 updatesAuthorization Basics
UpdatedAuthorization logic is often implemented within the applications or solutions where access control is required. In many cases, application development platforms offer middleware or other API solutions that simplify the implementation of authorization. Examples include use of the [AuthorizeAttribute](/aspnet/core/security/authorization/simple?view=aspnetcore-5.0&preserve-view=true) in ASP.NET or [Route Guards](./scenario-spa-sign-in.md?tabs=angular2#sign-in-with-a-pop-up-window) in Angular.
Msal Authentication Flows
Updated| [Implicit grant](#implicit-grant) | User sign-in and access to web APIs on behalf of the user. *Do not use this flow - use authorization code with PKCE instead.* | * [Single-page app (SPA)](scenario-spa-app-registration.md) <br /> * [Web](scenario-web-api-call-api-app-registration.md) |
Mobile Sso Support Overview
UpdatedIn addition, enabling single sign-on in your app unlocks new authentication mechanisms that come with modern authentication, like [passwordless logins](~/identity/authentication/concept-authentication-passwordless.md). Usernames and passwords are one of the most popular attack vectors against applications, and enabling SSO allows you to mitigate this risk by enforcing Conditional Access or passwordless logins that add extra security or rely on more secure authentication mechanisms. Finally, enabling single sign-on also enables [single sign-out](v2-protocols-oidc.md#single-sign-out). This is useful in situations like work applications that will be used on shared devices.
- **C2** – Require compliant devices
Microsoft Entra ID returns an HTTP response with some interesting data:
- [Manage Microsoft 365 for iOS and Android with Microsoft Intune](/intune/intune-service/apps/manage-microsoft-office#copilot-with-enterprise-data-protection)
Microsoft Entra External ID
1 updateMigrate Users
Updated- If you are migrating from Azure AD B2C, the [seamless user migration sample](https://github.com/azure-ad-b2c/samples/tree/master/policies/migrate-to-entra-external-id-for-customers) repository on GitHub contains a seamless migration custom policy example and REST API code sample.