Connect Health Operations
Feature updateThe documentation now identifies Microsoft Entra Global Administrators, rather than Hybrid Identity Administrators, in the default Connect Health RBAC guidance and Owner role description.
Day in brief
App instance property-lock guidance broadens as External ID documents passkey API setup
Updated Entra ID guidance now describes app instance property locks for both single-tenant and multitenant applications, including the stated default for new applications since June 2026. A new Microsoft Entra External ID credential-management API reference covers signed-in customer passkey listing and registration, while Connect Health installation guidance identifies Global Administrator as the default account with agent-registration permission. Sponsors are also directed from My Access to My Account for guest management. Most remaining edits are narrower documentation corrections.
- App instance property-lock guidance covers single-tenant apps
Entra ID · SecurityThe configuration article now says locks apply to an application's service principal for both single-tenant and multitenant applications. It also states that `Enable property lock` is enabled by default for new applications since June 2026 and points administrators to `servicePrincipalLockConfiguration`.
- External ID documents customer passkey credential-management API
External ID · AuthenticationThe new reference explains how signed-in customers can list and register passkeys through the credential-management API, covering delegated authentication, permissions, and setup. Using the API requires manually provisioning its service principal and granting the appropriate delegated permission.
The installation page now states that, by default, a Global Administrator account has permission to register the agent, replacing Hybrid Identity Administrator in the documented default.
- Sponsored-guest instructions now point to My Account
ID Governance · GovernanceThe instructions now direct sponsors to `myaccount.microsoft.com` and the `Sponsored guests` item in the left navigation instead of My Access.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
14 updates
Microsoft Entra ID
9 updatesThe documentation now lists the module under `C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\ADSyncConfig.psm1`.
Connect Health Agent Install
Doc updateThe documentation now states that, by default, a Global Administrator account has permission to register the agent, replacing Hybrid Identity Administrator.
Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.
The documentation now emphasizes app instance lock for multitenant applications and also mentions single-tenant applications.
The documentation now states that locks apply to an application's service principal for both single-tenant and multitenant applications. Since June 2026, Enable property lock is enabled by default for new applications.
The documentation now says app instance property lock can be enabled for both single-tenant and multitenant apps.
Zero Trust Protect Tenants
Doc updateThe documentation now says the lock is configured for all applications, rather than all multitenant applications.
Connect Health User Privacy
Doc updateThe documentation changes the recommended acknowledgment role from Hybrid Identity Administrators to Global Administrators before stopping data collection for all registered services.
Microsoft Entra ID Governance
2 updatesConfigure Security
Doc updateThe documentation link was updated from guidance for all multitenant applications to guidance for all applications.
Manage sponsored guests in My Account
Feature updateThe documentation now directs sponsors to manage guests in My Account at myaccount.microsoft.com, using the Sponsored guests item in the left navigation instead of My Access.
Microsoft Entra External ID
2 updatesMicrosoft Entra External ID credential management API reference
New featureAction requiredMicrosoft Entra External ID applications can use the credential management API to let signed-in customers list and register passkeys. The reference covers delegated authentication, permissions, and setup.
Sign In With Passkey
New featureThe documentation now directs applications to use the credential management API, with low-privilege delegated permissions, so signed-in customers can list and register their own passkeys.
Microsoft Entra Workload ID
1 updateExample 3 now clearly describes creating the `JoinedData` claim by joining `extensionattribute1` with `-ext` for JWTs issued to linked service principals.