Analyze Azure AD B2C custom policies for Microsoft Entra External ID migration
General
The custom policies guidance now includes a screenshot of the Migration Policy Analyzer UI and updated author metadata.
Cross-product topic
General
A cross-product view of Microsoft Entra changes related to General.
Latest General changes
How to configure custom headers
General
The article title and preview notice for configuring custom headers were removed.
Configure Cloud Firewall Clients
General
The documentation now states that Internet Access traffic forwarding does not acquire DNS traffic in preview, including with wildcard rules. Cloud Firewall cannot filter DNS queries; FQDN rules apply to connections to named destinations.
Configure cloud firewall for Global Secure Access clients (preview)
General
A new article explains configuring traffic acquisition, Allow and Block firewall rules, security profiles, and enforcement verification for client traffic in Microsoft Entra Internet Access. It also lists required roles, licensing, forwarding profiles, and client prerequisites.
How to manage the Internet Access profile
General
The documentation now states that the Internet Access traffic forwarding profile does not acquire DNS traffic in preview. Wildcard acquisition rules and FQDN destinations do not enable DNS acquisition, so cloud firewall policies do not filter DNS traffic.
How to manage the Internet Access profile
General
The documentation now explains that acquisition rules determine which traffic is forwarded, while cloud firewall policies allow or block it. It adds client and remote-network configuration links, wildcard acquisition examples for TCP and UDP, bypass and routing precedence details, and QUIC limitations.
Snowflake Tutorial
General
The tutorial now uses single quotes in the Snowflake ALTER SECURITY INTEGRATION commands and links to Snowflake’s SAML2 security integration guide.
Snowflake Tutorial
General
The tutorial now uses the Account Administrator role, reorganizes the SQL setup steps, updates Snowflake URL parameters, and links to automated user provisioning and deprovisioning.
Operate Private Access
General
The Private Access operations page no longer includes the row describing a connector offline condition, related Sentinel analytics guidance, or the Windows service check.
Configure Explicit Forward Proxy
General
The configuration instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy instead of Session management.
Configure Explicit Forward Proxy Headers
General
The documented path changed from Global Secure Access > Session management > Explicit Forward Proxy to Global Secure Access > Connect > Explicit Forward Proxy.
Disable Agent Identities
General
The documented procedure now uses **Disable** > **Disable in all tenants** and specifies that the impact applies to multi-tenant blueprints.
Disable Agent Identities
General
The documentation now explains that globally disabling a blueprint can cause related agents in other tenants to fail or lose functionality. It also adds steps for disabling a blueprint in the Microsoft Entra admin center.
Prerequisites for Microsoft Entra Cloud Sync
General
The prerequisites now explain how incorrect DNS, subnet-to-site mappings, or site configuration can cause provisioning synchronization failures, performance issues, and intermittent connectivity. It directs administrators to correctly map agent server subnets in Active Directory Sites and Services.
Partners for Azure AD B2C to Microsoft Entra External ID migrations
General
The migration partners page now lists Fortytwo and updates its publication date.
Services Integration Partners
General
The Edgile listing now links to its Microsoft Entra External ID page instead of its previous blog post.
Device Sync
General
The article now explains that it covers configuring Device Sync in Microsoft Entra Cloud Sync, not transferring Device Sync with the guided migration tool. It links to the tool’s prerequisites.
Migrate Connect Sync Cloud Sync Tool
General
The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.
Tutorial - Migrate to Microsoft Entra Cloud Sync for a Synced Active Directory Forest
General
The tutorial now emphasizes manual migration for test or pilot environments, directs eligible customers to the guided migration tool, adds scope-removal and source-anchor guidance, clarifies device migration coverage, and links related migration resources.
Manage Private Access Profile
General
The documentation now notes that switching to v2 is non-reversible, while previous configurations carry over without changes to end-user traffic.
Global Secure Access Client Release Notes
General
The release notes now document Web sign-in support, Conditional Access sign-in frequency for Private Access applications, updated firewall behavior, clearer forwarding-profile names, private-network bypass changes, and other improvements.
Entra Id Federation Customers
General
The user-creation example replaces the source tenant ID with its primary domain name in the issuer value and defines the new placeholder with an example domain.
Configure home network support for Microsoft Entra Private Access
General
A new guide explains how directly connected local resources can remain reachable while Private Access is enabled, including routing behavior, prerequisites, and configuration steps.
Create Blueprint
General
The documentation now states that when **Users can create agent blueprints** is set to **Yes**, any tenant user can create an agent identity blueprint and its principal. Otherwise, the Agent ID Developer and Agent ID Administrator roles can create them.
Permissions Reference
General
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
Manage Device Identities
General
The documentation now states that any user can use **Download devices** to export a CSV of devices, with optional filters; without filters, all devices are included.
Microsoft Entra Verified ID - IDV partner gallery
General
The Entra Verified ID identity verification partners page now lists HYPR, with a link to HYPR documentation and a description of its integration for workforce identity verification.
What's new for Microsoft Entra Verified ID
General
The Microsoft Entra Verified ID updates page now lists HYPR as an API-based integration partner.
Agent Id
General
The documentation clarifies that policies scoped through the Users assignment do not apply to agent user accounts, regardless of whether they target all users, selected users, groups, directory roles, or external users. To protect agents, select Agents under Users, agents, or workload identities.
Agent Id
General
The documentation now identifies the agent identity, rather than the application or autonomous agent, as the subject in application-only access.
Agent Id
General
The Conditional Access Agent ID page now links to Microsoft Agent 365 plans and pricing instead of the Agent ID getting-started information.
Howto Target Agent Identities
General
The agent identity targeting documentation now links to the relevant section on Conditional Access policies and agent identity blueprints.
Policy Agent User
General
The guidance now links to the Windows 365 Cloud PC for Agents introduction and the Entra Global Secure Access overview.
Policy Agent User
General
The documentation adds links and clarifies that relevant agents run on Intune-managed Windows 365 Cloud PCs, with Global Secure Access for compliant network policies. It also refines targeting, assignment, and risk-level guidance.
Policy Agent User
General
The documentation now lists Microsoft 365 E7, or Microsoft Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3, instead of a general Entra ID P1 or P2 requirement.
Policy Autonomous Agents
General
The documentation now specifies Microsoft Entra ID P1 or Microsoft 365 E3 for Conditional Access, and Microsoft Entra ID P2 or Microsoft 365 E5 when using agent risk-based Conditional Access with Microsoft Agent 365.
Policy Autonomous Agents
General
The documentation now says Microsoft 365 E7 protects access for both users and agents, replacing wording about governance of user and agent identities.
Policy Autonomous Agents
General
The documentation now lists two licensing options: Microsoft 365 E7, or Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3. It also states that Agent 365 will soon be required.
Policy Autonomous Agents
General
The documentation now uses corrected step numbering and clearer instructions for excluding agent blueprints or identities and creating custom attributes and predefined values.
Agent Access Packages
General
The documentation now states more clearly that an agent needs assigned OAuth delegated permissions to assist a user when accessing a target resource’s APIs.
Agent Access Packages
General
The documentation now states that agent identities need delegated OAuth permissions for target resources, such as Microsoft Graph or an application, to assist users with API access.
Analyze Azure AD B2C custom policies for Microsoft Entra External ID migration
General
The custom policy analysis article no longer includes the `author` and `ms.author` metadata fields.
Connect Version History
General
The version history page was updated with spelling fixes in existing release and feature descriptions.
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Atlassian Cloud so that I can…
General
The tutorial received spelling and wording corrections across its SAML attribute mapping, authentication policy, testing, and account discovery sections.
Get started integrating with Microsoft Entra ID
General
The guide now covers selecting Cloud Sync or Connect Sync and configuring Cloud Sync to synchronize Active Directory computer objects for Microsoft Entra hybrid join.
Global Secure Access egress IP ranges
General
The page no longer includes the `author` and `ms.author` metadata fields.
Integrate N8n Agent
General
The n8n agent integration page no longer includes the `author` and `ms.author` metadata fields.
Managed Identities Faq
General
The FAQ now uses “towards” instead of the misspelled “torwards” in its soft-deleted objects quota guidance.
Multi-Geo for Microsoft Entra Private Access
General
The guide now consistently spells “Multi-Geo,” including correcting a typo in the Japan region limitation.
Plan your SSO integration with Microsoft Entra ID (ISVs)
General
The page no longer includes the author, manager, and ms.author metadata fields.
Private Access Sensor Release History
General
Version 2.2.79, released September 29, 2026, adds over-the-air sensor updates, enhanced Kerberos security and diagnostics, SID-based service matching, and corrected wildcard matching.
Claims Customization Custom Claims Policy
General
Example 3 now clearly describes creating the `JoinedData` claim by joining `extensionattribute1` with `-ext` for JWTs issued to linked service principals.
Connect Configure Ad Ds Connector Account
General
The documentation now lists the module under `C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\ADSyncConfig.psm1`.
Connect Health Agent Install
General
The documentation now states that, by default, a Global Administrator account has permission to register the agent, replacing Hybrid Identity Administrator.
Connect Health Operations
General
The documentation now identifies Microsoft Entra Global Administrators, rather than Hybrid Identity Administrators, in the default Connect Health RBAC guidance and Owner role description.
Bulk create users in the Azure portal
General
The documentation now requires preserving downloaded column headings, allows the examples row to remain, and identifies only Name, User name, and Initial password as required fields. The sample CSV was simplified.
Bulk delete users in Microsoft Entra ID
General
The instructions now require the exact downloaded column header and allow each user row to contain either a user principal name or object ID. The examples row may remain, and User Administrator is listed as the minimum role.
Bulk restore deleted users in the Azure portal
General
The article now requires the downloaded `Object ID [objectId] Required` header to remain unchanged and says the examples row can be retained. It also documents the User Administrator prerequisite.
Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Cisco Secure Firewall - Secur…
General
The article now uses a Cisco FQDN placeholder for the SAML metadata URL and emphasizes that Identifier and Reply URL examples must be verified against the intended Cisco endpoints and trusted domains.
Service limits and restrictions
General
The page’s publication date and custom metadata tags were updated.
Authorization Agent Id
General
The authorization documentation now states that custom roles can be assigned to agents.
Known limitations for Global Secure Access
General
The known limitations article now states that the client doesn't support Secure DNS variants such as DoH, DoT, or DNSSEC, and that the macOS client bypasses Secure DNS to enforce FQDN-based tunneling.
Configure Samsung Knox and Business Services for Single sign-on with Microsoft Entra ID
General
The tutorial now uses `https://account.samsung.com/` instead of `https://accounts.samsung.com/` and includes updated documentation metadata.
Connect Install Prerequisites
General
The required minimum version changed from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.
Connect Install Prerequisites
General
The prerequisites page now bolds the warning to upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.
Connect Install Prerequisites
General
The documentation now requires Microsoft Entra Connect Sync version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are unmet.
Connect Version History
General
The required Microsoft Entra Connect Sync version is now 2.6.84.0 or later, with application-based authentication configured by April 7, 2027. Legacy authentication retirement will stop synchronization services after that date if requirements are unmet.
Connect Version History
General
The documentation now bolds the warning that Microsoft Entra Connect Sync must be upgraded to version 2.5.79.0 or later and configured for application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.
Connect Version History
General
The documented deadline changed to April 7, 2027. Synchronization services require version 2.5.79.0 or later and application-based authentication after legacy authentication ends.
Licensing Service Plan Reference
General
The Viva Glint entry now includes WORKPLACE_ANALYTICS_INSIGHTS_BACKEND and its associated identifier.
Managed Identities Status
General
The managed identities status table now links to permissions and identity guidance for Chaos Studio Workspaces, while retaining a separate link for Azure Chaos Studio (classic).
Scopes Oidc
General
The documentation now uses clearer wording to describe fine-grained permissions, scopes, and how apps request them through the `scope` parameter.
Tutorial Manage Certificates For Federated Single Sign On
General
The instructions now say to verify notification email addresses configured through Microsoft Graph or PowerShell in the Microsoft Entra admin center. Opening the SAML certificate experience can initialize notification registration for custom signing certificates.
Workload Identity Federation Config App Trust Managed Identity
General
The workload identity federation documentation now uses Microsoft Graph Bicep extension version 1.0.0 instead of 0.1.8-preview.
Policy All Users Device Unknown Unsupported
General
The documentation now highlights that device platform conditions rely on user agent strings and recommends pairing them with policies requiring device compliance or app protection to reduce risk.
Attribute Mapping
General
The page’s Microsoft Entra ID-to-AD attribute mapping section was removed and its introductory link now points to the dedicated configuration guide.
Attribute Mapping Entra To Active Directory
General
The guide for provisioning from Microsoft Entra ID to Active Directory was removed. It covered attribute mappings, scoping filters, sAMAccountName customization, and target-container configuration.
Configure Group Source of Authority (SOA) in Microsoft Entra ID
General
The page metadata was updated, and its references now link to the revised “Provision users and groups from Microsoft Entra ID to Active Directory” article.
Configure user Source of Authority (SOA) in Microsoft Entra ID
General
The page’s subservice changed from hybrid to hybrid-cloud-sync, and its reviewer changed from dhanyak to dhanyahk.
Connect Version History
General
The version history no longer states that the 09/23/2026 hotfix will be deployed through phased auto-upgrade. The Microsoft Graph permissions notice was repositioned.
Connect Version History
General
The version history now lists release 2.6.92.0 as September 23, 2026, and the related 2.6.91.0 support date as September 23, 2027. The page metadata date was also updated.
Connect Version History
General
The version history now states that auto-upgrade will move existing installations to the September 18, 2026 hotfix through multiple phases.
Connect Version History
General
Version 2.6.92.0 was released on September 18, 2026, fixing a 2.6.91.0 issue that could prevent Pass-through Authentication setup through the Microsoft Entra Connect wizard.
Migrate Group Writeback
General
The group writeback migration documentation now links to the guidance for changing other attribute mappings.
Prepare apps for Microsoft Entra COOP policy
General
New applications will be subject to Microsoft Entra COOP policy across web protocols after January 31, 2027. Popup-based sign-in may fail unless apps use a COOP-compatible flow, such as MSAL.js v5.
Prepare Your Environment for User SOA
General
The page’s subservice metadata changed from hybrid to hybrid-cloud-sync, and its reviewer metadata was updated.
Preserve a group's organizational unit (Preview)
General
New preview documentation explains how to capture a group's distinguished name in a GroupDN extension before converting its Source of Authority to Microsoft Entra ID.
User Source Of Authority Guidance
General
The page now identifies the subservice as hybrid-cloud-sync instead of hybrid and corrects the reviewer attribution.
Rootly Tutorial
General
The guide now provides explicit Rootly fields for the Entra identifier, login and logout URLs, PEM certificate, and domain, followed by enabling and saving the SSO configuration.
Rootly Tutorial
General
The tutorial now lists the Rootly fields to populate with the copied URLs and PEM certificate, then instructs administrators to enable and save required SSO. The previous instruction to send these details to Rootly support was removed.
Tutorial Manage Certificates For Federated Single Sign On
General
Administrators configuring notification email addresses through Microsoft Graph or PowerShell should re-confirm the address under SAML Certificates and select Save in the Microsoft Entra admin center.
Assign users and devices to traffic forwarding profiles
General
The article now documents assigning users, groups, devices, and device platforms to traffic forwarding profiles, including custom Private Access profiles. It also explains that user/device and platform conditions are evaluated together and that the highest-priority applicable profile is used.
Create a Microsoft Entra Private Access traffic forwarding profile
General
The documentation explains how to create up to 10 custom profiles, configure application acquisition rules, assign users and devices, and set profile priority.
Delete a Microsoft Entra Private Access traffic forwarding profile
General
The documentation explains how Global Secure Access Administrators can delete custom Private Access traffic forwarding profiles. Default profiles cannot be deleted, and deleted custom profiles cannot be restored.
Manage Private Access traffic forwarding profiles
General
Documentation now describes default and custom profiles, including profile settings, assignments, prerequisites, and a preview limit of 10 custom profiles.
Connect Health Adfs
General
The documentation now describes the AD FS service overview, updated alert filtering and details, and the revised Usage Analytics experience with time-range controls. Screenshots and metadata were also refreshed.
Connect Health Data Retrieval
General
The guide now uses the Microsoft Entra Connect Health Sync errors area to access notification settings, review Global Administrator and custom recipients, and export recorded sync errors as a CSV from the command bar.
Health service data isn't up to date alert
General
The page now explains selecting an alert row to view its details, including detection times, affected servers, resolution guidance, and related documentation. It also replaces the alert screenshot and improves image descriptions.
Microsoft Entra Connect Health operations
General
The article updates navigation and steps for email notifications, server or service deletion, and role-based access control, with new screenshots.
How to configure custom HTTP headers in Global Secure Access
General
The documentation now states that custom headers are available only with Web Filtering (v2) policies and links to the related guidance.
Connect Version History
General
The documentation metadata and release entries now show September 16, 2026 instead of September 15, 2026 for version 2.6.91.0 and its related timeline.
Connect Version History
General
The documentation now requires importing `ADSync.psd1` before `AzureADSSO.psd1` when configuring Seamless Single Sign-On with the standalone module.
Connect Version History
General
The version history table adds a Release date column for listed Microsoft Entra Connect versions while retaining end-of-support dates.
Connect Version History
General
The entry now uses “phishing-resistant authentication” instead of “passwordless authentication” and updates the page date to September 14, 2026.
Connect Version History
General
The documentation now records a fix for an issue where reopening the wizard and expanding a fully deselected domain could reselect it and enable synchronization for the entire domain.
Connect Version History
General
Four references to version 2.6.91.0 now point to the correct documentation section, #26910, instead of #26900.
Connect Version History
General
The documentation replaces version 2.6.90.0 with 2.6.91.0 and updates related guidance, including the 2.6.84.0 support timeline and fixes for existing-database upgrades and Synchronization Service Manager crashes.
Connect Version History
General
The documentation replaces references to version 2.6.90.0 with 2.6.91.0, updates related fix guidance, and identifies 2.6.91.0 as the latest available version.
Connect Version History
General
The 2.6.90.0 release adds a guided migration workflow from Microsoft Entra Connect Sync to Cloud Sync, including assessment, agent setup, staged activation, validation, and rollback. It is available only in the Azure public cloud.
Connect Version History
General
The documentation now states that the Select Containers dialog remains available for viewing selections, while changes should be made through Customize synchronization options in the Microsoft Entra Connect wizard.
Connect Version History
General
The documentation adds release notes for an upcoming version with Delos sovereign cloud support, authentication and connector behavior changes, bug fixes, and security improvements. The version and release date remain TBD.
Using single sign-on with cloud sync
General
The article’s publication date changed from April 9, 2025, to September 15, 2026, and an AI-assisted usage marker was added.
Dataverse - Assign non-Power Platform licensed Entra users to Dataverse Activities
General
We are announcing the ability to assign non-Power Platform licensed Entra users to Dataverse Activities in Dataverse. This feature will reach public preview on September 30, 2026.
Configure
General
The configuration guide no longer includes the note about synchronization service account creation and possible errors involving multifactor or interactive authentication.
Migrate Microsoft Entra Enterprise State Roaming
General
As of July 2026, ESR can no longer be managed in the Microsoft Entra admin center. Administrators must use Windows settings backup and restore policies; the supported settings remain unchanged.
Validate Oidc Multitenant App Gallery
General
The documentation now states that applications using Microsoft identity platform v1 endpoints cannot be validated through self-service App Gallery onboarding. It recommends migrating to v2 endpoints.
How to configure custom headers (preview)
General
The page now explains how to find modified-header transactions in Global Secure Access traffic logs and add the Custom Headers column. During the September 2026 rollout, a special Entra Admin Center link may be needed to view these details.
Licensing Service Plan Reference
General
Several licensing entries now use updated Microsoft 365 Copilot product names, including Education, Finance, and Sales offerings.
Licensing Service Plan Reference
General
Several entries now use Microsoft Copilot branding instead of Microsoft 365 Copilot branding. Their service plan identifiers and mappings remain unchanged in the documented rows.