Authentication changes

This page's changes and edits · All guidance changes

Microsoft's edit · 21 Oct 2024 19:29 UTC

Update reference-breaking-changes.md

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 0bd8b97 · +5 −2 lines · also on GitHub

⋯ 45 unchanged lines

4646

4747 These two subject values don't case-sensitively match, so validation fails. The same mechanism is applied to `issuer` and `audience` validation.

4848

49 −This change will be applied initially to applications or managed identities created after `August 14th, 2024`. Inactive applications or managed identities, determined by there being zero Workload Identity Federation requests made by said application or managed identity between the period `August 1st, 2024` to `August 31st, 2024`, are required to use case-sensitive matching starting `September 27th, 2024`. For active applications, case-sensitive matching comes at a later date to be communicated.

49 +This change will be applied initially to applications or managed identities created after `August 14th, 2024`. Inactive applications or managed identities, determined by there being zero Workload Identity Federation requests made by said application or managed identity between the period `August 1st, 2024` to `August 31st, 2024`, are required to use case-sensitive matching starting `September 27th, 2024`. For active applications, case-insensitive matching comes at a later date to be communicated.

5050

51 −To better highlight failures due to case-sensitivity, we're revamping the error message for `AADSTS700213`. It will now state;

51 +To better highlight failures due to case-insensitivity, we're revamping the error message for `AADSTS700213`. It will now state;

5252

5353 ```

5454 `AADSTS700213: No matching federated identity record found for presented assertion subject '{subject}'. Please note that matching is done using a case-sensitive comparison. Check your federated identity credential Subject, Audience, and Issuer against the presented assertion.`

5555 ```

5656

5757 The placeholder `'{subject}'` provides the value of the subject claim contained in the token being sent from the external IdP to Microsoft Entra ID. This error template is also used for case-insensitive failures surrounding `issuer` and `audience` validation. If you encounter this error, you should find the Federated Identity Credential that corresponds to the `issuer`, `subject`, or `audience` listed in the error and confirm that the corresponding values are equivalent from a case-sensitive perspective. If there's a mismatch, you need to replace the current `issuer`, `subject`, or `audience` value in the FIC with the `issuer`, `subject`, or `audience` value that was contained in the error message.

58 +

59 +>[!NOTE]

60 +> For **Azure App Service** customers using GitHub Actions and running into this error, an option for addressing to this is to go to your workflow file under `/.github/workflows` in your GitHub repository and update the environment `name` property from `"Production"` to `"production"`. This guidance is applicable only for Azure App Service scenarios. If you are encountering this error in a different scenario, please refer to the guidance above.

5861

5962 ## June 2024

6063

⋯ 371 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:09 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.