The documentation now covers prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, and trust removal.

The documentation states that generally available key rotation improves reliability for incoming trust referral flows and addresses authentication failures caused when referral tickets used a secondary key.

The health scenario alerts guide now links to guidance for Agent ID interactive sign-ins and autonomous sign-ins.

The standalone article describing Kerberos server-key rotation, prerequisites, dual-key behavior, and the Set-AzureADKerberosServer procedure was deleted.

The article date was updated to October 7, 2026, and the note about gradual Microsoft-managed deployment through September 2026 was removed.

The article no longer states that the registration campaign rollout is expected to finish by the end of September 2026 or that tenant experiences may differ during the rollout.

The documentation now references MDS version 285 instead of 279 and adds five FIDO2 security key models with their AAGUIDs and capability indicators.

The article was edited for spelling, headings, and presentation while retaining its documented enforcement phases, dates, affected applications, account scope, and break-glass guidance.

The guidance now states that Microsoft Authenticator, software OATH tokens, and hardware OATH tokens count as one authentication method for SSPR, regardless of Authentication methods policy migration status.

The native authentication API reference was updated with spelling corrections. The supplied examples, links, endpoints, error details, and configuration guidance remain unchanged.

The tutorial’s code comment was corrected from “Thge” to “The” and from “rquired” to “required.”

The article fixes the spelling of “OpenID Connect” and replaces an empty .NET NuGet link with an Azure Functions API link, along with other wording corrections.

The page no longer includes the `ms.author: justinha` metadata entry.

The passwordless authentication documentation no longer includes the `author` and `ms.author` fields.

The documentation fixes minor formatting in the scope notes and corrects the image text from `HKEY_LOCAL_MACHIEN` to `HKEY_LOCAL_MACHINE`.

The username/password token acquisition article no longer includes the author, manager, and ms.author fields.

The documentation now states that any user can use **Download devices** to export a CSV of devices, with optional filters; without filters, all devices are included.

The documentation now specifies Microsoft Entra ID P1 or Microsoft 365 E3 for Conditional Access, and Microsoft Entra ID P2 or Microsoft 365 E5 when using agent risk-based Conditional Access with Microsoft Agent 365.

The documentation adds links and clarifies that relevant agents run on Intune-managed Windows 365 Cloud PCs, with Global Secure Access for compliant network policies. It also refines targeting, assignment, and risk-level guidance.

The documentation now uses corrected step numbering and clearer instructions for excluding agent blueprints or identities and creating custom attributes and predefined values.

The documentation now lists Microsoft 365 E7, or Microsoft Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3, instead of a general Entra ID P1 or P2 requirement.

The documentation now lists two licensing options: Microsoft 365 E7, or Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3. It also states that Agent 365 will soon be required.

The guidance now links to the Windows 365 Cloud PC for Agents introduction and the Entra Global Secure Access overview.

The documentation now says Microsoft 365 E7 protects access for both users and agents, replacing wording about governance of user and agent identities.

The tutorial received spelling and wording corrections across its SAML attribute mapping, authentication policy, testing, and account discovery sections.

The version history page was updated with spelling fixes in existing release and feature descriptions.

The guide now covers selecting Cloud Sync or Connect Sync and configuring Cloud Sync to synchronize Active Directory computer objects for Microsoft Entra hybrid join.

Changed “cancelation” to “cancellation” in the recovery job instructions.

The page no longer includes the author, manager, and ms.author metadata fields.

The decision guide now states that Cloud Sync supports device synchronization for Microsoft Entra hybrid join. Device synchronization must be enabled separately, with updated migration guidance and configuration steps.

The guide now describes phased migration planning, including Cloud Sync device synchronization for Microsoft Entra hybrid join and prerequisite checks.

The article now helps administrators check their Microsoft Entra Connect version, evaluate Microsoft Entra Cloud Sync—including device synchronization—and find the latest upgrade guidance.

The tutorial now refers to Zscaler instead of Zscaler Authentication Service Provisioning throughout its title, prerequisites, configuration steps, and Microsoft Entra app-gallery instructions.

The tutorial now consistently refers to Zscaler ZSNet instead of Zscaler ZNet, including the title, prerequisites, gallery search instructions, and provisioning steps.

The comparison table now lists Microsoft Entra Cloud Sync as supporting Microsoft Entra hybrid join and links to Cloud Sync device synchronization instructions. The article also expands comparisons across Cloud Sync, Connect Sync, MIM, and ECMA Host.

The guide now covers configuring Microsoft Entra Cloud Sync and Connect Sync, including synchronizing Active Directory computer objects to Microsoft Entra ID for hybrid join.

The article now explains Cloud Sync as synchronizing users, groups, contacts, and devices, and links to device synchronization configuration guidance.

The comparison article now includes devices among supported synchronization scenarios and notes that Cloud Sync can synchronize computer objects for Microsoft Entra hybrid join when device sync is enabled. It also adds a comparison table and selection wizard.

The documentation now states that baseline-scope enforcement rollout began June 15, 2026. It adds a Microsoft Graph query for finding affected Conditional Access policies and clarifies customization and sign-in review guidance.

Microsoft Entra ID will support passkey registration and sign-in for B2B users, enabling phishing-resistant MFA in resource tenants starting late October 2026. Internal guest users get Microsoft Authenticator app passkeys; external users do not. The feature is enabled by default, intersecting with SMS/voice retirement policies. No action required, but administrators should review policies.

A new guide explains how to apply Conditional Access to agents using their own user accounts, including policies for agent risk, compliant devices, and compliant networks. It also documents agent-specific targeting and prerequisites.

Added a missing space between “authentication” and “and” in the documentation.

Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations must replace MemberOf in dynamic groups, administrative units, and entitlement policies to avoid outdated memberships, access, and licensing issues. After this date, MemberOf-based updates will stop, impacting Conditional Access and related services.

The page no longer includes the author, manager, and ms.author metadata fields.

Removed the `manager` and `ms.author` metadata fields from the OIDC protocol documentation.

The document no longer includes the author, manager, and ms.author metadata fields.

The page no longer includes the author, manager, and ms.author metadata fields.

The single sign-on documentation no longer includes the author, manager, and ms.author metadata fields.

The enterprise application page received spelling corrections in its user, group, and app-role assignment guidance.

The page no longer includes the `manager` and `ms.author` metadata fields.

The daemon token acquisition documentation no longer includes the `manager` and `ms.author` fields.

The page no longer includes the author, manager, and ms.author metadata fields.

The article now explains that enabled device synchronization can sync Active Directory computer objects to Microsoft Entra ID so devices can become hybrid joined, and links to configuration steps.

The article now explains that Microsoft Entra Cloud Sync can synchronize Active Directory computer objects to Microsoft Entra ID for hybrid join and links to configuration guidance.

Corrected a spelling error and updated punctuation in the Microsoft Entra Health article.

The page no longer includes the ms.author, author, or manager metadata fields.

The article now links to a sample app demonstrating passkey listing and registration with delegated permissions and warns that its deletion flow uses high-privilege application permissions and a client secret in browser code.

The Microsoft Entra External ID credential management API reference was deleted, including guidance for passkey listing and registration, delegated permissions, authentication, and sample usage.

Corrected a spelling error in the explanation of “Report-only: Failure” results for the “Require app protection policy” control.

The documentation corrects wording and spacing in guidance about cross-tenant access policies, guest self-service sign-up, Conditional Access sign-in frequency, and governance.

The September row now includes an additional 99.999% value in the performance reference table.

The Windows hybrid-join troubleshooting page received spelling and copy edits covering TPM errors, PRT checks, and Event Viewer guidance.

The page now covers agent identities and additional policy options, including custom security attributes, agent execution environments, device compliance, network locations, and agent risk. It also updates policy creation steps and links.

The documentation now refers to real-time risk information, rather than session risk information, among the signals used to determine access.

The autonomous agents policy documentation now includes a section for custom security attributes in policies.

The Agent ID documentation now uses the correct anchor for the “Allow approved agents by using custom security attributes” policy example.

The policy example link now points to the `use-custom-security-attributes` section.

The article now focuses on Conditional Access for agents using their own identities, adds prerequisites, clarifies that policies target agent identities rather than users, and recommends report-only block policies for unapproved agents.

The article now documents the enhanced object picker for selecting agent identities and blueprints, updates policy-creation steps, and notes that an Agent 365 license will soon be required.

The overview now explains policy decisions, evaluation timing, token subjects and audiences, and supported agent access patterns. It also adds links to related identity-management and policy guidance.

The overview now explains how Conditional Access evaluates the token subject and resource, and distinguishes delegated, agent-identity, and agent-user-account scenarios. Licensing and network-control requirements remain documented.

The article now covers selecting agent identities or agent user accounts, explains that conditions and controls depend on the token subject, and updates related links and terminology.

The documentation now states that Microsoft Entra ID Conditional Access for agents requires an eligible license plan, including Microsoft 365 E7 with Agent 365 and Microsoft Entra Suite. The explanatory governance phrase was removed.

The documentation now states that Conditional Access evaluates the signed-in user who is the token subject, including users targeted directly or through groups. Selecting an agent identity does not cover OBO traffic.

The documentation clarifies that Conditional Access policies targeting agent identities do not apply to on-behalf-of (OBO) traffic, because the user is the subject of that flow.

The licensing requirements now list Microsoft 365 E7, or Microsoft Agent 365 paired with at least Microsoft Entra P1 or Microsoft 365 E3.

The Microsoft Agent 365 licensing prerequisite bullet was reformatted for consistency.

The Conditional Access Agent ID page now links to Microsoft Agent 365 plans and pricing instead of the Agent ID getting-started information.

The agent identity targeting documentation now links to the relevant section on Conditional Access policies and agent identity blueprints.

The documentation clarifies that policies scoped through the Users assignment do not apply to agent user accounts, regardless of whether they target all users, selected users, groups, directory roles, or external users. To protect agents, select Agents under Users, agents, or workload identities.

The documentation now identifies the agent identity, rather than the application or autonomous agent, as the subject in application-only access.

The documentation now states more clearly that an agent needs assigned OAuth delegated permissions to assist a user when accessing a target resource’s APIs.

The documentation now states that agent identities need delegated OAuth permissions for target resources, such as Microsoft Graph or an application, to assist users with API access.

The n8n agent integration page no longer includes the `author` and `ms.author` metadata fields.

Adds a how-to article explaining Health Monitoring signals and alerts, log correlation, impact criteria, troubleshooting, and prerequisites for autonomous agent sign-ins. The monitoring and alerts are documented as being in preview.

A new how-to explains how to interpret Health Monitoring signals, correlate agent properties with sign-in and audit logs, and mitigate common failures. It also identifies the relevant non-interactive sign-in logs and documents licensing and role prerequisites.

The article explains how to create policies for agent identities, including periodic reconfirmation, minimum sponsor requirements, inactivity monitoring, notifications, grace periods, and enforcement actions. The capability is in preview.

The documentation now identifies the resource role as applying to an AI agent’s service principal or agent ID and adds numbered steps for selecting API permissions, permission type, required permissions, and updating the configuration.

The documentation corrects spelling errors, including “credentials,” and adds missing punctuation to a step describing token credentials and Azure SDK clients.

The documentation now describes the linked guidance as covering delegated and application permissions for Microsoft Graph and applications.

The page no longer includes the `ms.author` and `author` metadata fields.

The documentation now clarifies that multiple automatic assignment policies for one access package are supported only when users do not match multiple policies simultaneously.

Corrected spelling in the guest user licensing and governance documentation, including “governance-related.”

The entitlement management dynamic approval article received spelling corrections covering custom extensions, Logic Apps, approval setup, and HTTP trigger configuration.

Added a missing space after the bold “Prerequisite roles:” label. The linked role requirements are unchanged.

The documentation no longer includes the `author` and `ms.author` metadata fields.

The documentation updates wording across deployment scenarios, entitlement management, access reviews, separation of duties, birthright assignment, and Logic Apps guidance without changing the described capabilities or procedures.

The page title and description now use Microsoft Entra External ID terminology. Passkey sample links were updated from listing and registration to sign-in and management, and the sample table was revised.

The page now describes administrator-controlled passkey provisioning with the FIDO2 provisioning APIs and identifies the sample as testing-only with high-privilege permissions.

The documentation now describes a sample where signed-in customers list and register their own passkeys. It warns that the deletion flow uses high-privilege permissions and a client secret, so the sample is for test tenants only.

The documentation now states that SMS is unavailable only for first-factor authentication in external tenants, indicating availability for self-service password reset. SMS remains available for second-factor verification at additional cost.

The Android custom headers tutorial no longer includes the author, manager, and ms.author metadata fields.

The page now links to a sample for listing and registering passkeys and documents delegated permissions for those operations. It also warns that deletion uses high-privilege application permissions and a client secret in browser code.

The custom policy analysis article no longer includes the `author` and `ms.author` metadata fields.

The service connection link text now uses “configuring” instead of the misspelled “configurating.”

Version 2.2.79, released September 29, 2026, adds over-the-air sensor updates, enhanced Kerberos security and diagnostics, SID-based service matching, and corrected wildcard matching.

The guide now consistently spells “Multi-Geo,” including correcting a typo in the Japan region limitation.

The Microsoft Entra Verified ID updates page now lists HYPR as an API-based integration partner.

The Entra Verified ID identity verification partners page now lists HYPR, with a link to HYPR documentation and a description of its integration for workforce identity verification.

The FAQ now uses “towards” instead of the misspelled “torwards” in its soft-deleted objects quota guidance.

The page no longer includes the `author` and `ms.author` metadata fields.

The documentation no longer includes the `author` and `ms.author` fields.

The PowerShell prompt now correctly refers to the `IPv4Preferred` registry key instead of `IPv4Preffered`.

The article metadata field was corrected from `ms.reviwer` to `ms.reviewer`; the topic classification remains unchanged.

The page no longer includes the `author` and `ms.author` metadata fields.

The page’s `author` and `ms.author` metadata fields were removed.

The documentation corrects “Web respositories” to “Web repositories” in an example of security rules.