Netskope Coexistence
Developer
The fifth Netskope coexistence scenario is now correctly numbered as item 5.
Cross-product topic
Developer
A cross-product view of Microsoft Entra changes related to Developer.
Latest Developer changes
Application Properties
Developer
The documentation now states that tenant administrators cannot reverse Microsoft disablement by enabling tenant-local sign-in or reactivating the app registration.
Application Properties
Developer
The documentation now explains that Deactivated can result from tenant-local sign-in disablement, app registration deactivation, or Microsoft disablement. It also documents the related properties and clarifies that these conditions can overlap and must be remediated independently.
Delegate App Roles
Developer
The documentation now links to the “Restricting who can create applications and agents” section in two references, including the application registration error guidance.
Delegate application and agent management administrator permissions
Developer
The article now covers application and agent creation and management. It documents the **Users can create agent blueprints** setting, which administrators can turn off to restrict agent blueprint creation to administrators and Agent ID Developers.
Acquire a token to call a web API interactively (desktop app)
Developer
The page no longer includes the `manager` and `ms.author` metadata fields.
Acquire tokens to call a web API using a daemon application
Developer
The daemon token acquisition documentation no longer includes the `manager` and `ms.author` fields.
Assign User Or Group Access Portal
Developer
The enterprise application page received spelling corrections in its user, group, and app-role assignment guidance.
Call Api Azure Services
Developer
The documentation corrects spelling errors, including “credentials,” and adds missing punctuation to a step describing token credentials and Azure SDK clients.
How to configure daemon apps that call web APIs
Developer
The page no longer includes the author, manager, and ms.author metadata fields.
Palo Alto Coexistence
Developer
The service connection link text now uses “configuring” instead of the misspelled “configurating.”
Samples and guides for integrating apps with External ID
Developer
The page now links to a sample for listing and registering passkeys and documents delegated permissions for those operations. It also warns that deletion uses high-privilege application permissions and a client secret in browser code.
Authorization Agent Id
Developer
The documentation now describes blocked highly privileged directory roles for agent identities without the obsolete custom-role restriction wording.
Create content policies for network content filtering
Developer
The documentation now clarifies Basic content filtering and Scan with Purview descriptions, including that scanning can audit or block selected file and text content based on conditions.
Add app roles and get them from a token
Developer
The page now documents a shared default limit of 700 app roles and exposed delegated permission scopes per application or service principal, including counting rules, existing objects above the limit, and design guidance.
App Manifest
Developer
The documentation now states that app roles and exposed delegated permission scopes share a default limit of 700 permission definitions per application or service principal. Disabled definitions count, and this limit is separate from the aggregate manifest limit.
Create content policies for network content filtering
Developer
The documentation now describes real-time controls for content shared with generative AI applications, unmanaged cloud apps, and other internet destinations. It adds details about Basic content filtering and Purview-based inspection of files and text.
Microsoft Graph App Manifest
Developer
The documentation now states that app roles and exposed delegated permission scopes share a default limit of 700 definitions per application or service principal. Disabled definitions count, and this limit is separate from the aggregate manifest limit.
Microsoft Entra cloud-first identity guidance
Developer
The guide now focuses on phased transitions of user and group source of authority to Microsoft Entra ID while maintaining application access. It also updates readiness content and LDAP-binding application guidance, including provisioning cloud-managed users and groups back to on-premises AD or using Microsoft Entra Domain Services.
End-user experiences for applications
Developer
The documentation now states that these legacy preview and experience settings no longer affect app launchers or user behavior and are being removed from the Microsoft Entra admin center.
Publish App Gallery
Developer
The app gallery publishing documentation now refers to the Microsoft Partner One ID and identifies Microsoft Partner Network (MPN) ID as its former name.
Prerequisites to validate and publish your app
Developer
The documentation now instructs app publishers to provide a Partner One ID associated with their Microsoft AI Cloud Partner Program organization and explains how to find help if they do not know it.
Grant Admin Consent
Developer
The documentation examples now show revised object IDs for Microsoft Graph and other resource APIs while retaining the same consent scenarios and permissions.
Grant Admin Consent
Developer
The guide now uses different Microsoft Graph resource API object IDs in delegated- and application-permission consent examples; the documented permissions and consent type remain unchanged.
Manage App Consent Policies
Developer
The consent policy documentation now lists revised application IDs for Apple Mail, Spark Email, eM Client, Android-Samsung, Android-Mail, and Thunderbird.
Manage App Consent Policies
Developer
The consent-policy documentation now lists new application IDs for Apple Mail, Spark Email, eM Client, Android-Samsung, Android-Mail, and Thunderbird.
What If Tool
Developer
The Conditional Access What If tool table now uses a different sample UserId in all four examples.
Workload Identity Federation Config App Trust Managed Identity
Developer
The PowerShell example now uses a different Subject value for the managed identity federated credential.
Workload Identity Federation Config App Trust Managed Identity
Developer
The documentation changes the example `-Subject` value in the `New-AzADAppFederatedCredential` command.
Grant Admin Consent
Developer
The grant-admin-consent documentation updates the resource API object IDs shown in delegated- and application-permission examples.
Manage App Consent Policies
Developer
The documented application IDs for Apple Mail, Spark Email, eM Client, Android-Samsung, Android-Mail, and Thunderbird were replaced.
What If Tool
Developer
The Conditional Access What If tool documentation replaces the sample UserId in four example rows with a new sample identifier.
Howto Update Permissions
Developer
The permission-addition and permission-removal examples now use different sample object and client IDs.
Howto Update Permissions
Developer
The add and remove permission examples now use app registration ID `ffffffff-eeee-dddd-cccc-bbbbbbbbbbb0` instead of `00001111-aaaa-2222-bbbb-3333cccc4444`.
Howto Update Permissions
Developer
The Microsoft Graph Update application example now uses a different app registration object ID when adding the documented delegated permissions.
Howto Update Permissions
Developer
The examples for adding and removing Microsoft Graph permissions now use app registration identifier `00001111-aaaa-2222-bbbb-3333cccc4444` instead of the previous sample identifier.
Prerequisites to validate and publish your app
Developer
The article now covers prerequisites for validating and publishing apps, with updated wording and links. Detailed portal submission, request tracking, implementation, and update/removal instructions were removed.
Prerequisites to validate and publish your app
Developer
The documentation separates shared prerequisites from SSO and SCIM requirements, with dedicated guidance for each capability. Applications supporting both must complete validation for both.
Update or remove your app from the Microsoft Entra App Gallery
Developer
The documentation explains how to access the Microsoft Application Network portal and submit requests to update SSO, MDM, or user provisioning details, upgrade SSO, or remove an application listing.
Howto Update Permissions
Developer
The permission-management examples now use app registration identifier `ffffffff-eeee-dddd-cccc-bbbbbbbbbbb0` instead of `00001111-aaaa-2222-bbbb-3333cccc4444` when adding or removing Microsoft Graph permissions.
Agent Tokens
Developer
The user delegation section now spells out “on-behalf-of (OBO)” on first use. No feature behavior or requirements changed in the supplied diff.
Call Api Azure Services
Developer
The code sample now uses `<your-tenant-id>` instead of `<your-tenant>` for the `TenantId` value.
Call Api Custom
Developer
The documentation updates its C# examples, including distinct method names for UPN and object ID calls, a revised controller constructor signature, and clearer user-data method names.
Call Api Custom
Developer
The documentation now spells out “on-behalf-of (OBO)” on first use in the token scenario guidance. The referenced method is unchanged.
Call Api Microsoft Graph
Developer
The Agent ID Microsoft Graph documentation now labels sample variables as `usersAppOnly` and `usersOnBehalfOfUser`, clarifying the scenarios they represent.
Call Api Microsoft Graph
Developer
The documentation adds Microsoft Graph and Microsoft.Identity.Web imports, changes sample calls from Applications to Users, and clarifies that configured scopes must match the Graph resources used. Examples use User.Read and User.ReadBasic.All.
Call Api Microsoft Graph
Developer
The documentation adds an OpenID Connect using directive and renames two C# sample variables: `applications` to `applicationsForUser` and `me` to `meByOid`.
Call Api Microsoft Graph
Developer
The `TenantId` example value changed from `<my-test-tenant>` to `<your-tenant-id>` for clearer documentation.
Configure Third Party Agents
Developer
The third-party agents documentation now labels the sidecar setup link “Configure Microsoft Entra ID Auth SDK for agent identities” instead of “Configure Entra ID Auth SDK.”
Create Delete Agent Identities
Developer
The documentation updates the C# sample’s imports, endpoint structure, downstream API call, and model declarations to provide valid create-agent-identity code.
Microsoft Entra Sdk For Agent Identities
Developer
The documentation now identifies app-only tokens as using client credentials, expands on-behalf-of to OBO, and consistently uses the `agent-identity-client-id` placeholder in request examples.
Microsoft Entra Sdk For Agent Identities
Developer
The documentation replaces “Entra ID Auth SDK” with “Microsoft Entra ID Auth SDK” in two descriptions. The endpoint formats and behavior are unchanged.
Secure an Amazon Bedrock agent with Microsoft Entra Agent ID
Developer
The Amazon Bedrock integration guide now consistently uses “Microsoft Entra ID Auth SDK (sidecar)” in its description, explanations, container reference, and links. No behavior or availability change is described.
Grant Agent Access Microsoft 365
Developer
The documentation now lists how an agent with its own identity can communicate through Outlook email, OneDrive and SharePoint comments, Teams chats, and Teams channels, including the permissions required for inbound and outbound communication.
Configure How Users Consent to Applications
Developer
The page title capitalization and image alt text were revised. No configuration or product behavior changes are shown.
Product names and service plan identifiers for licensing
Developer
The reference now links to license management in the Azure portal, updates the table as of August 3, 2026, adds Agent 365, and revises service and plan identifier entries.
Configure Microsoft Edge with Explicit Forward Proxy by using an Intune application management policy
Developer
You can automatically deliver proxy settings and certificate authority trust settings in Microsoft Edge by using an Intune mobile application management (MAM) policy. The policy can take advantage of the Explicit Forward Proxy feature of Global Secure Access.
Connect with the required scope
Developer
After creating a new application proxy application, grant admin consent for the **User.Read** delegated permission in the Microsoft Entra admin center or using the Microsoft Graph PowerShell.
V2 Protocols Oidc
Developer
1. Under Redirect URIs, add the redirect URI of your application. For example, `https://localhost:8080/`.
What's new in Microsoft Entra application management
Developer
This article shows the new and updated documentation for the Microsoft Entra application management.
Recover application secrets using Microsoft Entra Backup and Recovery (Preview)
Developer
ai-usage: ai-assisted
V2 Howto App Gallery Listing
Developer
Learn how to publish your application in Microsoft Entra application gallery.
Secure an Amazon Bedrock agent with Microsoft Entra Agent ID
Developer
Learn how to use the Microsoft Entra Auth SDK (sidecar) to secure an Amazon Bedrock AI agent with its own identity for calling downstream APIs.
Validate Agent Tokens Downstream Api
Developer
Learn how to validate Microsoft Entra Agent ID tokens in a downstream API by checking the signature, issuer, audience, and agent identity marker claim.
Acquire tokens and call downstream APIs with Microsoft Entra ID Auth SDK (sidecar)
Developer
Learn how autonomous agents acquire tokens using the Microsoft Entra ID Auth SDK (sidecar) to call downstream APIs independently.
Configure Third Party Agents
Developer
- [Configure Entra ID Auth SDK (sidecar) for agent identities](microsoft-entra-sdk-for-agent-identities.md)
How to configure daemon apps that call web APIs
Developer
Learn how to configure daemon apps that call web APIs using secrets, certificates, or client assertions.
What's new in Microsoft Entra application management
Developer
This article shows the new and updated documentation for the Microsoft Entra application management.
Acquire a token to call a web API (desktop app)
Developer
Learn how to build a desktop app that calls web APIs to acquire a token for the app
Acquire a token to call a web API (mobile apps)
Developer
Learn how to build a mobile app that calls web APIs. (Get a token for the app.)
Acquire a token to call a web API by using Web Account Manager (desktop app)
Developer
Learn how to build a desktop app that calls web APIs to acquire a token for the app by using Web Account Manager.
Acquire a token to call a web API interactively (desktop app)
Developer
Learn how to build a desktop app that calls web APIs to acquire a token for the app interactively.
Acquire a token to call a web API using device code flow (desktop app)
Developer
Learn how to build a desktop app that calls web APIs to acquire a token for the app using device code flow
Acquire tokens to call a web API using a daemon application
Developer
Learn how to build a daemon app that calls web APIs (acquiring tokens)
Add app roles and get them from a token
Developer
Learn how to add app roles to an application registered in Microsoft Entra ID. Assign users and groups to these roles, and receive them in the 'roles' claim in the token.
Add linked single sign-on to an application
Developer
Add linked single sign-on to an application in Microsoft Entra ID.
Application Discovery
Developer
Use Application discovery to detect the applications accessed by users and create separate private applications.
Application Management certificates frequently asked questions
Developer
Learn answers to frequently asked questions (FAQ) about managing certificates for apps using Microsoft Entra ID as an Identity Provider (IdP).
Apps & service principals in Microsoft Entra ID
Developer
Learn about the relationship between application and service principal objects in Microsoft Entra ID.
Build single-page app calling a web API
Developer
Learn how to build a single-page application that calls a web API
Call a web API from a mobile app
Developer
Learn how to build a mobile app that calls web APIs. (Call a web API.)
Configure a custom email provider for one time passcode send events
Developer
Learn how to configure and set up a custom email provider with the One Time Passcode Send event type.
Configure a web API that calls web APIs
Developer
Learn how to build a web API that calls web APIs (app's code configuration)
Configure a web app that calls web APIs
Developer
Learn how to configure the code of a web app that calls web APIs
Configure an application to trust a managed identity
Developer
Learn how to configure an application to trust a managed identity in Microsoft Entra ID.
Configure app multi-instancing
Developer
Learn about multi-instancing, which is needed for configuring multiple instances of the same application within a tenant.
Configure desktop apps that call web APIs
Developer
Learn how to configure the code of a desktop app that calls web APIs
Configure F5 BIG-IP Access Policy Manager for form-based SSO
Developer
Learn how to configure F5 BIG-IP Access Policy Manager and Microsoft Entra ID for secure hybrid access (SHA) to form-based applications.
Configure F5 BIG-IP Easy Button for Header-based SSO
Developer
Learn to implement secure hybrid access (SHA) with single sign-on (SSO) to header-based applications using F5 BIG-IP Easy Button Guided Configuration.
Configure F5 BIG-IP Easy Button for Kerberos single sign-on
Developer
Learn to implement secure hybrid access (SHA) with single sign-on (SSO) to Kerberos applications using F5 BIG-IP Easy Button guided configuration.
Configure how users consent to applications
Developer
Configure user consent settings in Microsoft Entra ID to control when and how users grant permissions to your organization's data. Secure your environment with step‑by‑step guidance.
Configure Microsoft Edge with Explicit Forward Proxy (preview) by using an Intune application management policy
Developer
A Microsoft Entra documentation page was updated: Configure Microsoft Edge with Explicit Forward Proxy (preview) by using an Intune application management policy.
Configure Microsoft Entra External ID with Azure Web Application Firewall
Developer
Learn how to configure Microsoft Entra External ID with Azure Web Application Firewall.
Configure mobile apps that call web APIs
Developer
Learn how to configure your mobile app's code to call a web API
Configure restrictions on how applications can be configured
Developer
Configure app management policies in Microsoft Entra ID to set restrictions on how apps and service principals in your tenant can be configured. Secure your environment with step‑by‑step guidance.
Configure single-page app
Developer
Learn how to build a single-page application (app's code configuration)
Configure the F5 BIG-IP Easy Button for Header-based and LDAP SSO
Developer
Learn to configure the F5 BIG-IP Access Policy Manager (APM) and Microsoft Entra ID for secure hybrid access to header-based applications that also require session augmentation through Lightweight Directory Access Protocol (LDAP) sourced attributes.
Configure Workday Mobile Application for Single sign-on with Microsoft Entra ID
Developer
A Microsoft Entra documentation page was updated: Configure Workday Mobile Application for Single sign-on with Microsoft Entra ID.
Consent experience for applications in Microsoft Entra ID
Developer
Learn more about the Microsoft Entra consent experiences to see how you can use it when managing and developing applications on Microsoft Entra ID
Create Service Principal Cross Tenant
Developer
Create an enterprise application using the client ID for a multitenant application.
Customer intent: As an organization administrator, I want to customize the invitation process for external users using the Microsoft Graph REST API,…
Developer
A Microsoft Entra documentation page was updated: Customer intent: As an organization administrator, I want to customize the invitation process for external users using the Microsoft Graph REST API, so that I can tailor the onboarding experience and control the notifications sent to the users..
Directory extension attributes in claims
Developer
Describes directory extension attributes that are used for sending user data to applications in token claims.
Don't validate access tokens for Microsoft Graph
Developer
Include file warning that access tokens for Microsoft Graph should be considered opaque and should never be validated by customer code. Only Microsoft Graph validates Microsoft Graph access tokens.
End-user experiences for applications
Developer
Learn about the customizable ways to deploy applications to end users in your organization with Microsoft Entra ID.
Get a token in a web app that calls web APIs
Developer
Learn how to acquire a token for a web app that calls web APIs
Get started integrating Microsoft Entra ID with apps
Developer
This article is a getting started guide for integrating Microsoft Entra ID with on-premises applications, and cloud applications.
Grant tenant-wide admin consent to an application
Developer
Learn how to grant tenant-wide consent to an application so that end-users aren't prompted for consent when signing in to an application.
How and why apps are added to Microsoft Entra ID
Developer
What does it mean for an application to be added to Microsoft Entra ID and how do they get there?
How to call a downstream web API from a daemon app
Developer
Learn how to build a daemon app that calls a web API.
How to configure daemon apps that call web APIs
Developer
Learn how to configure the code for your daemon application that calls web APIs (app configuration)
How to use managed identities for Azure resources on an Azure VM with Azure SDKs
Developer
A Microsoft Entra documentation page was updated: How to use managed identities for Azure resources on an Azure VM with Azure SDKs .
Implement role-based access control in applications
Developer
Learn how to implement role-based access control in your applications.
Include file - Add a platform and redirect URI for a single-page application
Developer
manager: pmwongera
Include file - Add a platform and redirect URI for a single-page application
Developer
manager: pmwongera
Include file - Add a platform and redirect URI for a single-page application
Developer
manager: pmwongera
Manage assignment of agent identities to an application
Developer
Discover how to configure agent identities for enterprise applications in Microsoft Entra ID. Assign roles, manage permissions, and streamline app interactions.
Microsoft Entra ID Windows Account Manager API reference
Developer
Comprehensive guide for the Microsoft Entra ID Windows Account Manager (WAM) API, detailing its usage, parameters, and integration in Windows applications.