Authentication changes

This page's changes and edits · All guidance changes

Microsoft's edit · 10 Oct 2024 20:46 UTC

even more acrolynx

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 9db9784 · +7 −7 lines · also on GitHub

⋯ 37 unchanged lines

3838

3939 **Change**

4040

41 −Previously, when matching the Federated Identity Credential (FIC) `issuer`, `subject`, and `audience` values against the corresponding `issuer`, `subject`, and `audience` values contained in the token sent to Microsoft Entra ID by an external IdP, case-insensitive matching was used. To provide more fine-grained control to customers, we are switching to enforcing case-sensitive matching.

41 +Previously, when matching the Federated Identity Credential (FIC) `issuer`, `subject`, and `audience` values against the corresponding `issuer`, `subject`, and `audience` values contained in the token sent to Microsoft Entra ID by an external IdP, case-insensitive matching was used. To provide more fine-grained control to customers, we're switching to enforcing case-sensitive matching.

4242

4343 Invalid example:

4444 - Token subject: `repo:contoso/contoso-org:ref:refs/heads/main`

4545 - FIC subject: `repo:Contoso/Contoso-Org:ref:refs/heads/main`

4646

47 −These two subject values do not case-sensitively match, so validation fails. The same mechanism is applied to `issuer` and `audience` validation.

47 +These two subject values don't case-sensitively match, so validation fails. The same mechanism is applied to `issuer` and `audience` validation.

4848

4949 This change will be applied initially to applications or managed identities created after `August 14th, 2024`. Inactive applications or managed identities, determined by there being zero Workload Identity Federation requests made by said application or managed identity between the period `August 1st, 2024` to `August 31st, 2024`, are required to use case-sensitive matching starting `September 27th, 2024`. For active applications, case-insensitive matching comes at a later date to be communicated.

5050

51 −To better highlight failures due to case-insensitivity, we are revamping the error message for `AADSTS700213`. It will now state;

51 +To better highlight failures due to case-insensitivity, we're revamping the error message for `AADSTS700213`. It will now state;

5252

5353 ```

5454 `AADSTS700213: No matching federated identity record found for presented assertion subject '{subject}'. Please note that matching is done using a case-sensitive comparison. Check your federated identity credential Subject, Audience, and Issuer against the presented assertion.`

5555 ```

5656

57 −The placeholder `'{subject}'` provides the value of the subject claim contained in the token being sent from the external IdP to Microsoft Entra ID. This error template is also used for case-insensitive failures surrounding `issuer` and `audience` validation. If you encounter this error, you should find the Federated Identity Credential that corresponds to the `issuer`, `subject`, or `audience` listed in the error and confirm that the corresponding values are equivalent from a case-sensitive perspective. If there is a mismatch, you need to replace the current `issuer`, `subject`, or `audience` value in the FIC with the `issuer`, `subject`, or `audience` value that was contained in the error message.

57 +The placeholder `'{subject}'` provides the value of the subject claim contained in the token being sent from the external IdP to Microsoft Entra ID. This error template is also used for case-insensitive failures surrounding `issuer` and `audience` validation. If you encounter this error, you should find the Federated Identity Credential that corresponds to the `issuer`, `subject`, or `audience` listed in the error and confirm that the corresponding values are equivalent from a case-sensitive perspective. If there's a mismatch, you need to replace the current `issuer`, `subject`, or `audience` value in the FIC with the `issuer`, `subject`, or `audience` value that was contained in the error message.

5858

5959 ## June 2024

6060

⋯ 7 unchanged lines

6868

6969 **Change**

7070

71 −Previously, when registering an application using the [Entra app registrations experience](https://aka.ms/ra/prod), if the user was signed in with their personal Microsoft account (MSA), they could choose to only associate the application with their personal account. That means the application would not be associated with or contained in any directory (also referred to as 'tenant' or 'organization'). However, starting June 2024, all applications must be registered in a directory. This could be an existing directory, or a new one that the personal Microsoft account user creates to house their Entra applications and other Microsoft resources. Users can easily create a new directory to use for this purpose by [joining the M365 Developer Program](https://aka.ms/joinM365DeveloperProgram) or [signing up for Azure](https://aka.ms/signUpForAzure).

71 +Previously, when registering an application using the [Microsoft Entra app registrations experience](https://aka.ms/ra/prod), if the user was signed in with their personal Microsoft account (MSA), they could choose to only associate the application with their personal account. That means the application wouldn't be associated with or contained in any directory (also referred to as 'tenant' or 'organization'). However, starting June 2024, all applications must be registered in a directory. This could be an existing directory, or a new one that the personal Microsoft account user creates to house their Microsoft Entra applications and other Microsoft resources. Users can easily create a new directory to use for this purpose by [joining the Microsoft 365 Developer Program](https://aka.ms/joinM365DeveloperProgram) or [signing up for Azure](https://aka.ms/signUpForAzure).

7272

7373 Registering an application in a directory, instead of only associating it with a personal account, has various benefits. These include:

7474 - Applications registered in a directory have more features available to them, such as the ability to add more than one owner to the app, and the ability to [publisher verify](publisher-verification-overview.md) the app.

7575 - The application is located in the same place as other Microsoft resources the developer uses, such as Azure resources.

7676 - The application receives improved resiliency benefits.

7777

78 −This will not affect any existing applications, including existing applications that are only associated with a personal account. Only the ability to register new applications will be affected.

78 +This won't affect any existing applications, including existing applications that are only associated with a personal account. Only the ability to register new applications will be affected.

7979

8080 ## October 2023

8181

⋯ 30 unchanged lines

112112 1. The email is from a Google account.

113113 1. The email was used for authentication using the one-time passcode (OTP) flow.

114114

115 −It should also be noted that Facebook and SAML/WS-Fed accounts do not have verified domains.

115 +It should also be noted that Facebook and SAML/WS-Fed accounts don't have verified domains.

116116

117117 ## May 2023

118118

⋯ 313 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:09 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.