Saturday, 4 July 2026

Entra ID documentation reinforces the move away from implicit grant

This was a quiet Entra ID documentation day: all three reported changes were updates to Microsoft Learn pages, with no new feature, preview, general-availability change, retirement event, or Message Center notice. The most consequential update clarifies that implicit-flow ID tokens are disabled by default in the app-manifest guidance and that Microsoft recommends authorization code flow with PKCE for browser-based apps. The remaining updates clarify OIDC redirect-URI setup and the documented location of the legacy app-manifest logoUrl property.

• Entra ID · Standards

  App Manifest guidance explicitly discourages implicit grant

  The updated App Manifest documentation states that the flag allowing a web app to request OAuth 2.0 implicit-flow ID tokens defaults to false, applies to browser-based apps such as JavaScript SPAs, and recommends authorization code flow with PKCE instead. This is security guidance and documentation clarification, not evidence that the platform default itself changed during the period.

• Entra ID · Developer

  OIDC redirect-URI setup instructions clarified

  The V2 Protocols OIDC page now instructs readers to add the application's redirect URI and provides https://localhost:8080/ as an example. This is an ordinary setup-documentation clarification; the supplied evidence does not indicate a change to OIDC protocol behavior.

• Entra ID · Monitoring

  The documented app-manifest location of logoUrl was relocated

  The Azure Active Directory Graph app-manifest deprecation reference now lists logoUrl as a property of the info attribute. This may matter to administrators maintaining manifest documentation or tooling, but the update provides no evidence of a new deprecation milestone or runtime change.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.