Authentication changes

This page's changes and edits · All guidance changes

Microsoft's edit · 29 Aug 2024 00:02 UTC

acrolynx

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 44a0fde · +3 −3 lines · also on GitHub

⋯ 37 unchanged lines

3838

3939 **Change**

4040

41 −Previously, when matching the Federated Identity Credential (FIC) `issuer`, `subject`, and `audience` values against the corresponding `issuer`, `subject`, and `audience` values contained in the token sent to Microsoft Entra ID by an external IdP, case-insensitive matching was used. To provide more fine-grained control to customers, we will be switching to enforcing case-sensitive matching.

41 +Previously, when matching the Federated Identity Credential (FIC) `issuer`, `subject`, and `audience` values against the corresponding `issuer`, `subject`, and `audience` values contained in the token sent to Microsoft Entra ID by an external IdP, case-insensitive matching was used. To provide more fine-grained control to customers, we are switching to enforcing case-sensitive matching.

4242

4343 Invalid example:

4444 - Token subject: `repo:contoso/contoso-org:ref:refs/heads/main`

4545 - FIC subject: `repo:Contoso/Contoso-Org:ref:refs/heads/main`

4646

47 −These two subject values do not case-sensitively match, so validation will fail. The same mechanism will be applied to `issuer` and `audience` validation.

47 +These two subject values do not case-sensitively match, so validation fails. The same mechanism is applied to `issuer` and `audience` validation.

4848

49 −This change will be applied initially to applications or managed identities created after `August 14th, 2024`. Inactive applications or managed identities, determined by there being zero Workload Identity Federation requests made by said application or managed identity between the period `August 1st, 2024` to `August 31st, 2024`, will be required to use case-sensitive matching starting `September 27th, 2024`. For active applications, case-insensitive matching will come at a later date to be communicated.

49 +This change will be applied initially to applications or managed identities created after `August 14th, 2024`. Inactive applications or managed identities, determined by there being zero Workload Identity Federation requests made by said application or managed identity between the period `August 1st, 2024` to `August 31st, 2024`, will be required to use case-sensitive matching starting `September 27th, 2024`. For active applications, case-insensitive matching comes at a later date to be communicated.

5050

5151 To better highlight failures due to case-insensitivity, we are revamping the error message for `AADSTS700213`. It will now state `AADSTS700213: No matching federated identity record found for presented assertion subject '{subject}'. Please note that matching is done using a case-sensitive comparison. Check your federated identity credential Subject, Audience, and Issuer against the presented assertion.`, where `'{subject}'` provides the value of the subject claim contained in the token being sent from the external IdP to Microsoft Entra ID. This error template will also be used for case-insensitive failures surrounding `issuer` and `audience` validation. If you encounter this error, you should find the Federated Identity Credential that corresponds to the `issuer`, `subject`, or `audience` listed in the error and confirm that the corresponding values are equivalent from a case-sensitive perspective. If there is a mismatch, you need to replace the current `issuer`, `subject`, or `audience` value in the FIC with the `issuer`, `subject`, or `audience` value that was contained in the error message.

5252

⋯ 373 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:56 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.