Brivo Onair Identity Connector Provisioning Tutorial
Provisioning
The tutorial now links to Brivo’s contact page instead of its quote page for obtaining a Brivo Onair Identity Connector tenant.
Product
Microsoft Entra ID
Track documentation and Message Center changes for Microsoft Entra ID.
Microsoft Learn documentation ↗Latest Microsoft Entra ID changes
Combined registration for SSPR and Microsoft Entra multifactor authentication
Authentication
Organizations can allow users to change cloud passwords after authenticating with a registered FIDO2 passkey or Windows Hello for Business credential, without knowing the current password or using SSPR. Temporary Access Pass isn't supported unless the user knows the existing password.
Configure AD user and group enforcement in Microsoft Entra Cloud Sync
Provisioning
The documentation now requires all writable domain controllers to meet specified Windows Server update levels and requires ADSyncTools version 2.6.0 or later. It also adds a warning that enforcement cannot be configured if any writable domain controller is unsupported.
Microsoft Authenticator: Usability improvements for iOS and Android
Authentication
Microsoft Authenticator for iOS and Android will receive usability updates starting November 2026, including a refreshed home experience, clearer account restoration guidance, improved sign-in flows, and platform-specific prompts. Android improvements for restoration and battery optimization prompts will follow in January 2027. No action required.
Microsoft Entra AD object enforcement
Provisioning
The title no longer includes “(Preview),” and the publication date changed from August 11, 2026, to October 29, 2026.
Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication
Authentication
Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.
Registration Mfa Sspr Combined
Authentication
The documentation section describing password changes after sign-in with CBA, FIDO2 passkeys, or Authenticator passwordless notifications was revised.
Registration Mfa Sspr Combined
Authentication
The documentation now uses the exact name of the secure sign-in setting related to changing cloud passwords after passwordless sign-in.
Registration Mfa Sspr Combined
Authentication
The documentation updates the name of the password-change flow available after CBA, passkey, or Authenticator passwordless sign-in.
Registration Mfa Sspr Combined
Authentication
The combined MFA and SSPR registration documentation updates its passwordless sign-in reference with a link to the relevant passwordless documentation.
Registration Mfa Sspr Combined
Authentication
The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.
Self-service password reset deep dive
Authentication
The documentation now explains how users can change Microsoft Entra cloud passwords with FIDO2 passkeys or Windows Hello for Business, including the tenant-wide setting required to enable the experience and its limitation for on-premises password writeback.
Sspr Howitworks
Authentication
The documentation now states that rollout across all clouds begins in late October 2026 and is expected to finish by the end of November 2026.
Sspr Howitworks
Authentication
The page now labels the section “Allow password change after secure sign-in” and its subsection “Enable the setting,” replacing the previous “Passwordless authentication” heading.
Sspr Howitworks
Authentication
The heading “Allow password change after secure sign-in” now ends with a period.
Sspr Howitworks
Authentication
The documentation updates the section heading and setting label to “Allow password change after secure sign-in.”
Sspr Howitworks
Authentication
The documentation now states that users need a Microsoft Entra ID P1 or P2 license to use this feature.
Sspr Howitworks
Authentication
The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.
Sspr Howitworks
Authentication
In hybrid environments, password changes made with passwordless authentication can be written to an on-premises directory when password writeback is configured.
Sspr Howitworks
Authentication
The documentation now lists Microsoft Entra CBA, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change a cloud password without entering the current password.
Usage and insights report
Fundamentals
The documentation now explains that reported last activity can include incomplete sign-ins absent from sign-in logs. A timestamp does not confirm successful authentication or token issuance, and some partial activity may be misclassified as app-only during preview.
Configure Puzzel for automatic user provisioning with Microsoft Entra ID
Provisioning
The documentation states that OAuth 2.0 Authorization Code Grant is being retired for Puzzel provisioning. Affected jobs should use OAuth 2.0 Client Credentials Grant; otherwise provisioning may stop working after the deadline.
Configure Vonage for automatic user provisioning with Microsoft Entra ID
Provisioning
Vonage provisioning will stop supporting OAuth 2.0 Authorization Code Grant after March 31, 2027. The updated procedure generates and uses client credentials; SSO is unaffected.
Enable Authenticator Passkey
Conditional Access
The documentation now states that the Microsoft Authenticator Credential Registration resource will be available in November 2026. It also retains the prerequisite to provision the enterprise application before excluding the resource from a Conditional Access policy.
Microsoft Entra ID: Final reminder to replace MemberOf rule operator configurations by November 3, 2026
Conditional Access
Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations using MemberOf in dynamic groups, administrative units, or entitlement policies must replace it to avoid outdated memberships, access, and licensing issues. Action is required before this date to maintain proper functionality.
Microsoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in
Authentication
Microsoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September to November 2026. SMS for MFA and password reset remains unaffected. Admins should review usage, notify users, and ensure alternate sign-in methods.
Snowflake Provisioning Tutorial
Standards
The tutorial’s task lists were changed from numbered items to bullet points; the instructions and screenshots remain the same.
Snowflake Provisioning Tutorial
Standards
The tutorial now links to Snowflake SCIM documentation, specifies using an account administrator, explains the SQL script, emphasizes that `AAD_PROVISIONER` is case-sensitive and uppercase, and adds related authentication links.
Support passkeys in Authenticator in your Microsoft Entra ID tenant
Authentication
The guidance now documents provisioning the Microsoft Authenticator Credential Registration enterprise application and excluding it from Conditional Access policies scoped to All resources to unblock passkey registration.
Microsoft Authenticator: Improved backup and restore experience for Android
Authentication
Microsoft Authenticator for Android will improve backup and restore with clearer setup guidance and support for passkeys starting mid-January 2027. Users must enable Google One backup and screen lock. Work/school accounts aren’t backed up, and backup works only in the Android personal profile. No admin action needed.
Microsoft Entra ID: Reminder to migrate from Microsoft-provided SMS and voice authentication
Authentication
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.
Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors
Conditional Access
Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting early November 2026, allowing users to satisfy MFA without additional passkeys. No configuration changes are needed, but organizations should update onboarding and MFA registration guidance accordingly.
Snowflake Tutorial
General
The tutorial now uses single quotes in the Snowflake ALTER SECURITY INTEGRATION commands and links to Snowflake’s SAML2 security integration guide.
Snowflake Tutorial
General
The tutorial now uses the Account Administrator role, reorganizes the SQL setup steps, updates Snowflake URL parameters, and links to automated user provisioning and deprovisioning.
Configure Secure Cloud User Integration for automatic user provisioning with Microsoft Entra ID
Provisioning
Microsoft added a step-by-step tutorial for configuring automatic user and group provisioning, updates, synchronization, and deprovisioning between Microsoft Entra ID and Secure Cloud using SCIM 2.0.
Configure Secure Cloud User Integration for single sign-on with Microsoft Entra ID
Standards
A new article explains how to configure Secure Cloud User Integration with Microsoft Entra ID using OIDC, including prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification.
Create a Conditional Access policy plan (preview)
Conditional Access
A new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method
Conditional Access
Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins November 2026, aiming to simplify strong authentication adoption and reduce registration friction.
Migrate Conditional Access policies to a policy plan (preview)
Conditional Access
A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
What are Microsoft Entra Conditional Access policy plans? (preview)
Conditional Access
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
Manage Object Connections - Microsoft Graph
Provisioning
New documentation explains how to inspect or remove stored source-to-target connections for provisioning jobs, including required identifiers, permissions, and recovery steps. The API is available through Microsoft Graph beta and deleting a connection does not delete either object.
Microsoft Entra HR provisioning timeouts
Troubleshooting
A new article explains how to diagnose intermittent timeouts and slow provisioning from Workday, SAP SuccessFactors, and API-driven HR integrations to on-premises Active Directory. It covers job status, provisioning agents, matching attributes, domain controllers, DNS, connectivity, and relevant logs.
Object Connection IDs - Microsoft Entra ID
Provisioning
A new reference lists source and target identifiers for provisioning scenarios, their required formats, and how to use them with Microsoft Graph to inspect or delete connections.
Prerequisites for Microsoft Entra Cloud Sync
General
The prerequisites now explain how incorrect DNS, subnet-to-site mappings, or site configuration can cause provisioning synchronization failures, performance issues, and intermittent connectivity. It directs administrators to correctly map agent server subnets in Active Directory Sites and Services.
System-preferred authentication in Microsoft Entra ID
Authentication
The article now explains that system-preferred authentication considers the user’s current device and browser, prioritizes accessible local passkeys, and handles device-bound credentials such as Windows Hello for Business and macOS Platform SSO by platform.
Application Properties
Developer
The documentation now states that tenant administrators cannot reverse Microsoft disablement by enabling tenant-local sign-in or reactivating the app registration.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
Device Sync
General
The article now explains that it covers configuring Device Sync in Microsoft Entra Cloud Sync, not transferring Device Sync with the guided migration tool. It links to the tool’s prerequisites.
Macos Platform Sso Architecture
Authentication
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
Mfa Number Match
Authentication
The documentation now shows an updated Android screenshot and describes selecting Approve or Deny instead of Yes or No for relevant number-matching prompts in Authenticator, Teams, and Outlook.
Microsoft Entra Cloud Sync migration decision guide
Provisioning
The guide now distinguishes platform capability comparisons from what the guided migration tool can transfer. It identifies device synchronization as a current guided-tool blocker and adds separate guidance for guided, manual, or deferred migration paths.
Microsoft Entra: Choose your own telephony provider for SMS and voice authentication
Authentication
Starting October 30, 2026, Microsoft Entra ID allows organizations to choose a supported third-party telephony provider for SMS and voice authentication via Microsoft Security Store. Microsoft-provided SMS/voice authentication retires by February 1, 2027, except for some users until July 1, 2027. Organizations manage provider relationships directly.
Migrate Connect Sync Cloud Sync Tool
General
The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.
Migrate to Microsoft Entra Cloud Sync
Provisioning
The documentation now directs administrators to a migration decision guide, guided-tool eligibility checks, or manual phased migration guidance. It also clarifies scope protection, reference validation, and migration-result verification.
Plan Cloud Sync Topologies
Monitoring
The documentation now explains that Connect Sync and Cloud Sync may coexist during a phased migration, but must not simultaneously export normal changes for the same object and attribute set. It adds links to manual migration steps and scope-removal planning.
Protect against consent phishing
Security
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
Tutorial - Migrate to Microsoft Entra Cloud Sync for a Synced Active Directory Forest
General
The tutorial now emphasizes manual migration for test or pilot environments, directs eligible customers to the guided migration tool, adds scope-removal and source-anchor guidance, clarifies device migration coverage, and links related migration resources.
What Is Cloud Sync
Fundamentals
The page now directs Connect Sync users to review the decision guide, validate guided-tool prerequisites, and choose a supported guided or manual migration path. It also links the migration FAQ and separates Device Sync review from guided-tool eligibility.
Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles
Governance
Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.
Validate an OIDC app for Microsoft Entra App Gallery onboarding
Standards
The document author was changed from hkinyunyu to HildaK-pm.
Validate an OIDC app for Microsoft Entra App Gallery onboarding
Standards
The documentation now describes validation for both single-tenant and multitenant OIDC applications, including configuration-specific endpoint requirements and eligibility guidance.
Validate an OIDC multitenant app for Microsoft Entra App Gallery onboarding
Standards
The page author and manager metadata were changed.
Device Join Macos Platform Single Sign On Kerberos Configuration
Authentication
The documentation expands access from limited availability and updates setup links. It also clarifies that the storage account app registration must use a lowercase `cifs` identifier URI for SMB mounting on macOS.
Architecture and authentication flow for macOS Platform SSO with Microsoft Entra ID
Authentication
The page title was simplified, and the role descriptions now state that the Microsoft Enterprise SSO plug-in performs device and user registration with Microsoft Entra ID. Microsoft Entra ID is described as verifying credentials and proofs and issuing the PRT.
Add Microsoft Entra ID for customer sign-in
Authentication
The FAQ now states that identity provider buttons cannot be hidden. Removing a provider from a user flow prevents users from signing up or redeeming invitations with that provider, and `domain_hint` does not change this.
Security Defaults
Fundamentals
The Security Defaults article no longer includes the section describing individual protections, their preview availability, roles, behavior, and management steps.
Application Properties
Developer
The documentation now explains that Deactivated can result from tenant-local sign-in disablement, app registration deactivation, or Microsoft disablement. It also documents the related properties and clarifies that these conditions can overlap and must be remediated independently.
Architecture and authentication flow for macOS Platform SSO (Apple) with Microsoft Entra ID
Authentication
Microsoft added a conceptual guide describing macOS Platform SSO registration, Secure Enclave device keys, the Platform SSO PRT, app SSO, and the roles of MDM, macOS, the Microsoft Enterprise SSO plug-in, and Microsoft Entra ID.
Deactivate an app registration
Microsoft identity platform
The article now distinguishes deactivating an app registration from disabling sign-in on a tenant-local service principal. It also explains that activation status includes tenant-local and Microsoft disablement, and that reactivating the app registration does not automatically restore tenant-local sign-in.
Disable user sign-in for application
Authentication
The article now explains that disabling sign-in sets the service principal’s `accountEnabled` property to `false` and changes Activation status to Deactivated. It also adds steps to restore tenant-local sign-in and notes that other deactivation conditions can still apply.
Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in
Authentication
The documentation explains when users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls, including user experience, network requirements, and help-desk guidance.
Add Microsoft Entra ID for customer sign-in
Authentication
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
Delegate App Roles
Developer
The documentation now links to the “Restricting who can create applications and agents” section in two references, including the application registration error guidance.
Delegate application and agent management administrator permissions
Developer
The article now covers application and agent creation and management. It documents the **Users can create agent blueprints** setting, which administrators can turn off to restrict agent blueprint creation to administrators and Agent ID Developers.
Microsoft Purview | Information Protection: Sensitivity labels for Microsoft Entra security groups
Governance
Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026, allowing administrators to apply and enforce governance policies on these groups. Labels can be assigned via multiple platforms, cannot yet be changed once applied, and require separate tenant configuration from Microsoft 365 groups.
Permissions Reference
General
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
Provision On Demand
Fundamentals
Step 1 now links to the permissions reference anchor without the `.md` suffix.
Security Defaults
Authentication
The documentation describes four separately manageable protections—administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking—for selected Microsoft Entra ID Free tenants. It also explains how these protections work with Conditional Access and which roles can manage them.
Microsoft Entra: Allow password change after secure sign-in with My Sign-Ins
Authentication
Microsoft Entra will enable users to change passwords after secure sign-in using strong credentials (passkey, FIDO2, Windows Hello) without knowing the current password or using SSPR. This feature, disabled by default, requires admin activation and will roll out globally from October to November 2026.
Enable Authenticator Passkey
Authentication
The documentation now states that iOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.
Enable Authenticator Passkey
Authentication
The documentation now states that Android users can register attested passkeys directly in the Authenticator app or through a cross-device registration flow. iOS registration remains direct through the Authenticator app.
Enable Authenticator Passkey
Authentication
The documentation now separately states that Android users can register attested passkeys through a cross-device registration flow, while iOS users register them directly in the Authenticator app.
Enable Authenticator Passkey
Authentication
The documentation now states that iOS cross-device registration does not support attestation, while Android does. Attested passkeys can also be registered through Android cross-device flows.
Mfa Registration Campaign
Authentication
The example now specifies a device-bound profile with attestation enforced and an eligible attested passkey. It states that the nudge is suppressed across operating systems and browsers, without using the platform table.
Mfa Registration Campaign
Authentication
The example now explicitly states that User 1 signs in on macOS with Chrome and is nudged to register a compatible passkey.
Mfa Registration Campaign
Authentication
The example now specifies that the user’s only registered passkey is Windows Hello for Business; the nudge is suppressed when they sign in on Windows with Chrome.
Mfa Registration Campaign
Authentication
The documentation now refers to registered passkeys and available passkey types instead of credentials in the platform-specific nudge suppression guidance and table.
Mfa Registration Campaign
Authentication
The documentation now states that Windows Hello for Business registration doesn’t follow passkey profile restrictions.
Mfa Registration Campaign
Authentication
The documentation now states that Windows Hello for Business registration behavior is separate from passkey profile restrictions.
Mfa Registration Campaign
Authentication
The MFA registration campaign documentation now links directly to the passkey profile eligibility guidance for the Microsoft managed registration campaign.
Mfa Registration Campaign
Authentication
The documentation explains how unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation, while AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
Mfa Registration Campaign
Authentication
The documentation now states that eligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, such as refresh token redemption, do not display nudges.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now covers prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, and trust removal.
Enforcement Resource Exclusions
Conditional Access
The documentation now states that baseline-scope enforcement rollout began June 15, 2026. It adds a Microsoft Graph query for finding affected Conditional Access policies and clarifies customization and sign-in review guidance.
Howto Investigate Health Scenario Alerts
Authentication
The health scenario alerts guide now links to guidance for Agent ID interactive sign-ins and autonomous sign-ins.
Kerberos Server Key Rotation
Authentication
The standalone article describing Kerberos server-key rotation, prerequisites, dual-key behavior, and the Set-AzureADKerberosServer procedure was deleted.
Manage Device Identities
General
The documentation now states that any user can use **Download devices** to export a CSV of devices, with optional filters; without filters, all devices are included.
Whats New
Authentication
The documentation states that generally available key rotation improves reliability for incoming trust referral flows and addresses authentication failures caused when referral tickets used a secondary key.
Microsoft Entra ID: Passkey support for B2B users
Conditional Access
Microsoft Entra ID will support passkey registration and sign-in for B2B users, enabling phishing-resistant MFA in resource tenants starting late October 2026. Internal guest users get Microsoft Authenticator app passkeys; external users do not. The feature is enabled by default, intersecting with SMS/voice retirement policies. No action required, but administrators should review policies.
Run a registration campaign to set up a passkey or Microsoft Authenticator
Authentication
The article no longer states that the registration campaign rollout is expected to finish by the end of September 2026 or that tenant experiences may differ during the rollout.
System-preferred authentication in Microsoft Entra ID
Authentication
The article date was updated to October 7, 2026, and the note about gradual Microsoft-managed deployment through September 2026 was removed.
Microsoft Entra ID attestation for FIDO2 security key vendors
Authentication
The documentation now references MDS version 285 instead of 279 and adds five FIDO2 security key models with their AAGUIDs and capability indicators.
Policy Agent User
General
The guidance now links to the Windows 365 Cloud PC for Agents introduction and the Entra Global Secure Access overview.
Policy Agent User
General
The documentation adds links and clarifies that relevant agents run on Intune-managed Windows 365 Cloud PCs, with Global Secure Access for compliant network policies. It also refines targeting, assignment, and risk-level guidance.
Policy Agent User
General
The documentation now lists Microsoft 365 E7, or Microsoft Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3, instead of a general Entra ID P1 or P2 requirement.
Policy Autonomous Agents
General
The documentation now specifies Microsoft Entra ID P1 or Microsoft 365 E3 for Conditional Access, and Microsoft Entra ID P2 or Microsoft 365 E5 when using agent risk-based Conditional Access with Microsoft Agent 365.
Policy Autonomous Agents
General
The documentation now says Microsoft 365 E7 protects access for both users and agents, replacing wording about governance of user and agent identities.
Policy Autonomous Agents
General
The documentation now lists two licensing options: Microsoft 365 E7, or Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3. It also states that Agent 365 will soon be required.
Policy Autonomous Agents
General
The documentation now uses corrected step numbering and clearer instructions for excluding agent blueprints or identities and creating custom attributes and predefined values.
Secure agent users with Microsoft Entra Conditional Access
Conditional Access
A new guide explains how to apply Conditional Access to agents using their own user accounts, including policies for agent risk, compliant devices, and compliant networks. It also documents agent-specific targeting and prerequisites.
Sla Performance
Monitoring
The September row now includes an additional 99.999% value in the performance reference table.
Acquire a token to call a web API interactively (desktop app)
Developer
The page no longer includes the `manager` and `ms.author` metadata fields.
Acquire a token to call a web API using username and password (desktop app)
Authentication
The username/password token acquisition article no longer includes the author, manager, and ms.author fields.
Acquire tokens to call a web API using a daemon application
Developer
The daemon token acquisition documentation no longer includes the `manager` and `ms.author` fields.
Assign User Or Group Access Portal
Developer
The enterprise application page received spelling corrections in its user, group, and app-role assignment guidance.
Authentication Entra Passkeys On Windows
Authentication
The page no longer includes the `ms.author: justinha` metadata entry.
Common hybrid scenarios with Microsoft Entra ID
Provisioning
The comparison table now lists Microsoft Entra Cloud Sync as supporting Microsoft Entra hybrid join and links to Cloud Sync device synchronization instructions. The article also expands comparisons across Cloud Sync, Connect Sync, MIM, and ECMA Host.
Configure your integration with Active Directory
Provisioning
The guide now covers configuring Microsoft Entra Cloud Sync and Connect Sync, including synchronizing Active Directory computer objects to Microsoft Entra ID for hybrid join.