The documentation now identifies Microsoft Entra Global Administrators, rather than Hybrid Identity Administrators, in the default Connect Health RBAC guidance and Owner role description.

The documentation now lists the module under `C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\ADSyncConfig.psm1`.

The documentation now states that, by default, a Global Administrator account has permission to register the agent, replacing Hybrid Identity Administrator.

The documentation now requires preserving downloaded column headings, allows the examples row to remain, and identifies only Name, User name, and Initial password as required fields. The sample CSV was simplified.

The instructions now require the exact downloaded column header and allow each user row to contain either a user principal name or object ID. The examples row may remain, and User Administrator is listed as the minimum role.

The article now requires the downloaded `Object ID [objectId] Required` header to remain unchanged and says the examples row can be retained. It also documents the User Administrator prerequisite.

The article now uses a Cisco FQDN placeholder for the SAML metadata URL and emphasizes that Identifier and Reply URL examples must be verified against the intended Cisco endpoints and trusted domains.

The page’s publication date and custom metadata tags were updated.

The documented deadline changed to April 7, 2027. Synchronization services require version 2.5.79.0 or later and application-based authentication after legacy authentication ends.

The required Microsoft Entra Connect Sync version is now 2.6.84.0 or later, with application-based authentication configured by April 7, 2027. Legacy authentication retirement will stop synchronization services after that date if requirements are unmet.

The documentation now requires Microsoft Entra Connect Sync version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are unmet.

The required minimum version changed from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.

The prerequisites page now bolds the warning to upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.

The documentation now bolds the warning that Microsoft Entra Connect Sync must be upgraded to version 2.5.79.0 or later and configured for application-based authentication by April 7, 2027. Synchronization services will stop afterward if requirements are unmet.

The tutorial now uses `https://account.samsung.com/` instead of `https://accounts.samsung.com/` and includes updated documentation metadata.

The instructions now say to verify notification email addresses configured through Microsoft Graph or PowerShell in the Microsoft Entra admin center. Opening the SAML certificate experience can initialize notification registration for custom signing certificates.

The documentation now uses clearer wording to describe fine-grained permissions, scopes, and how apps request them through the `scope` parameter.

The Viva Glint entry now includes WORKPLACE_ANALYTICS_INSIGHTS_BACKEND and its associated identifier.

The documentation now highlights that device platform conditions rely on user agent strings and recommends pairing them with policies requiring device compliance or app protection to reduce risk.

Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.

The documentation now emphasizes app instance lock for multitenant applications and also mentions single-tenant applications.

The documentation now states that locks apply to an application's service principal for both single-tenant and multitenant applications. Since June 2026, Enable property lock is enabled by default for new applications.

The required Microsoft Entra Connect Sync version changed from 2.5.79.0 to 2.6.84.0 or later. Application-based authentication must still be configured by April 7, 2027.

The deadline changed to April 7, 2027. Administrators must upgrade to version 2.5.79.0 or later and configure application-based authentication; synchronization stops after the deadline if requirements are unmet.

The warning is bolded: upgrade Microsoft Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are not met.

The documentation now bolds the mandatory upgrade warning: upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Legacy authentication will be retired, and synchronization will stop after that date if requirements are unmet.

The documentation now requires version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop afterward if these requirements are unmet.

The required Microsoft Entra Connect Sync version increased from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.

The tutorial replaces references to Zidentity and Zscaler Provisioning with Zscaler Authentication Service and updates related titles, prerequisites, app-role guidance, and provisioning steps. The page date was also updated.

The documentation corrects an internal section link and improves grammar, spelling, punctuation, and wording throughout the rollout guidance.

The page now describes how Windows Hello for Business cloud Kerberos trust uses Microsoft Entra Kerberos to provide passwordless access to Active Directory resources and links to a deployment guide.

The documentation now states that users accessing Active Directory-protected resources need corresponding Active Directory accounts. Cloud-managed users should be provisioned from Microsoft Entra ID, including required group memberships.

The SSPR documentation now refers to a “Microsoft Entra administrator role” instead of an “Azure administrator role” when describing enforcement of the strong two-gate password policy.

The backup authentication system documentation no longer lists Workplace from Facebook in its integration table.

The provision-on-demand article no longer includes references to Meta Workplace. The displayed guidance about stopping provisioning for OAuth-based applications remains unchanged.

The documentation now says app instance property lock can be enabled for both single-tenant and multitenant apps.

The documentation now says the lock is configured for all applications, rather than all multitenant applications.

The table now explicitly labels Group Managed Service Account (gMSA) and Standalone Managed Service Account (sMSA), with corresponding installation guidance.

The sign-in step now lists Application Owners alongside Application Administrators as acceptable roles for accessing the Microsoft Entra admin center.

The guidance now directs administrators to the Exchange admin center for role assignments through dynamic membership groups. If the old Exchange admin center is required, assign the eligible role directly to the user rather than through role-assignable groups; Exchange PowerShell cmdlets work as expected.

The documentation adds `NormalizeDiacriticsByCulture(source, culture)`, supporting German (`de`) transliteration such as `ä` to `ae` and `ß` to `ss`.

The minimum-version deadline for Microsoft Entra Connect Sync is extended from September 30, 2026, to April 7, 2027. Version 2.5.79.0 or later is required.

The guide now consistently refers to the application, tenant, SCIM API, and gallery entry as Zscaler ZNet.

The documentation standardizes the product name to “Chatwork” and states that SCIM provisioning support will end on October 1, 2026. The Entra Enterprise App Gallery integration will then stop provisioning users.

The article no longer labels Microsoft Entra Cloud Sync device sync as preview and removes the preview legal notice. Its publication date was also updated.

The guidance explains prerequisites, policy targeting, risk controls, device and network conditions, and blocking risky agent user accounts. It notes that all-user and group targeting don't include agent users.

The documentation now warns that device platform information, such as user agent strings, can be modified and isn't verified. It recommends using device platform with Microsoft Intune device compliance policies or in a block statement.

Microsoft Entra App Gallery introduces self-service onboarding for new applications, allowing ISVs to validate SSO and provisioning integrations, manage submissions, and track status via the Microsoft Entra admin center. Public preview is available now; general availability begins mid-November 2026. No action required.

The partner-driven integrations documentation now lists Dropbox and Snowflake as examples and no longer references Workplace by Facebook.

The employee lifecycle documentation no longer links to the Workplace by Facebook provisioning tutorial.

The documentation changes the recommended acknowledgment role from Hybrid Identity Administrators to Global Administrators before stopping data collection for all registered services.

The article now presents Conditional Access for autonomous agents as a scenario-based pattern, adds prerequisites, and recommends starting block policies in report-only mode. It also notes that an Agent 365 license will soon be required.

The documentation now distinguishes agents acting for signed-in users, using their own identity, or using an agent user account. It adds separate guidance links for autonomous agents and agent users and updates the listed licensing combinations.

The article now uses a scenario-based structure, explains that conditions and controls depend on the token subject, and links separately to guidance for agent identities and agent user accounts. Terminology, metadata, and related links were also updated.

The documentation now states that agent user accounts can be assigned custom roles, while privileged administrator roles remain restricted.

The documentation now describes blocked highly privileged directory roles for agent identities without the obsolete custom-role restriction wording.

The authorization documentation now states that custom roles can be assigned to agents.

The documentation now directs sponsors to manage guests in My Account at myaccount.microsoft.com, using the Sponsored guests item in the left navigation instead of My Access.

The new page documents the preview experience for reviewing guests, extending or ending sponsorship, and sponsoring eligible unsponsored guests. It also explains policy-driven lifecycle behavior.

The documentation describes configuring guest scopes, lifecycle rules, notifications, precedence, and automated disable or deletion actions for external users.

The documentation now explains that `duration: P365D` makes an eligible assignment expire after 365 days. Permanent eligibility requires the target scope’s role management policy to allow it.

The Entra ID Governance apps page no longer lists Workplace from Meta in its application table.

The documentation link was updated from guidance for all multitenant applications to guidance for all applications.

Microsoft Entra External ID applications can use the credential management API to let signed-in customers list and register passkeys. The reference covers delegated authentication, permissions, and setup.

The documentation now directs applications to use the credential management API, with low-privilege delegated permissions, so signed-in customers can list and register their own passkeys.

Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026. Only trusted Microsoft scripts will run, affecting organizations using script-injecting tools on login.microsoftonline.com. No action needed if such tools aren't used.

SharePoint One-Time Passcode (SPO OTP) authentication will retire starting mid-October 2026, transitioning external sharing and authentication to Microsoft Entra B2B. This change affects all Microsoft 365 tenants, requiring guest accounts for external users and enabling consistent governance and Conditional Access across SharePoint and OneDrive.

Example 3 now clearly describes creating the `JoinedData` claim by joining `extensionattribute1` with `-ext` for JWTs issued to linked service principals.

The workload identity federation documentation now uses Microsoft Graph Bicep extension version 1.0.0 instead of 0.1.8-preview.

The managed identities status table now links to permissions and identity guidance for Chaos Studio Workspaces, while retaining a separate link for Azure Chaos Studio (classic).

The guide removes the Preview label and documents that workload identities are reusable only when their Application API host matches the provisioning app’s SAP SuccessFactors API host. It also adds the Application ID URI format and compatibility details for the September 15, 2026 update.

The page now explains how Microsoft Entra ID users and groups provisioned to Active Directory with Cloud Sync can access Kerberos-protected resources through Microsoft Entra Kerberos, Windows Hello for Business, or FIDO2. It also clarifies that provisioning alone does not enable Kerberos or passwordless access.

The required Microsoft Entra Connect version changed from 2.5.79.0 to 2.6.84.0 or later. The documentation also now requires application-based authentication to maintain directory synchronization and avoid service disruptions.

The page now notes that, starting July 15, 2026, GitHub will automatically use immutable subject claims for newly created, renamed, or transferred repositories. Existing repositories will retain name-based claims unless opted in.

The documentation now clarifies Basic content filtering and Scan with Purview descriptions, including that scanning can audit or block selected file and text content based on conditions.

The documentation specifies non-overlapping dynamic TCP ports 49152–65535 and AutoReuse TCP ports 10000–49151, with new configuration and verification commands. It also adds Windows Server 2016+ prerequisites and clarifies that AutoReuse applies only to TCP.

The known limitations article now states that the client doesn't support Secure DNS variants such as DoH, DoT, or DNSSEC, and that the macOS client bypasses Secure DNS to enforce FQDN-based tunneling.

The connector configuration guidance now refers to configuring dynamic and AutoReuse TCP port ranges instead of extending TCP and UDP ephemeral ports.