Authentication changes

Source history: extracted from the page's source file at a commit; shared includes are not expanded

1. Enforced15 Nov 2018 Now: Enforced; the override no longer helps
2. Enforced2 Sep 2019 Published timing is qualified; effectiveness is not confirmed.
3. EnforcedJune 2020 Published timing is qualified; effectiveness is not confirmed.
4. Enforced by defaultafter 15 Oct 2021 Published timing is qualified; effectiveness is not confirmed.

1. 1 May 2018 8 years agoafterbefore
   • ID tokens can't be used for the OBO flowRecommendation
2. 1 Jun 2018 8 years ago
   • Azure Government endpoints are changingRequirementException1 condition
3. 15 Nov 2018 7 years agoEnforced
   • Authorization codes can no longer be reusedMilestoneRequirement
4. 26 Jul 2019 7 years ago
   • App-only tokens for single-tenant applications are only issued if the client app exists in the resource tenantMilestoneRequirementExceptionScopeRecommendationTentative3 conditions
5. 2 Sep 2019 7 years agoEnforced · unconfirmed
   • POST form semantics will be enforced more strictly - spaces and quotes will be ignoredMilestoneRequirementExceptionScopeTentative
6. 5 May 2020 6 years ago
   • Azure Government endpoints are changingMilestone2 conditions
7. June 2020 6 years agomonth windowEnforced · unconfirmed
   • Azure Government endpoints are changingMilestoneTentative
8. 15 Oct 2021 5 years agoafterEnforced by default · unconfirmed
   • AppId Uri in single tenant applications will require use of default scheme or verified domainsMilestoneExceptionScope4 conditions
9. June 2023 3 years agomonth windowstarting
   • The Power BI administrator role will be renamed to Fabric Administrator.MilestoneScope
10. June 2024 2 years agomonth windowstarting
    • Applications must be registered in a directoryMilestoneRequirementExceptionScope1 condition

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• AcquireTokenByAuthorizationCodeAsync
• AcquireTokenSilentAsync
• WS-Fed

Requirements, exceptions and scope

• What's new for authentication?Exception1 condition1 passage
• Federated Identity Credentials now use case-sensitive matchingRequirement1 passage
• Applications must be registered in a directoryRequirementExceptionScope3 conditions6 passages
• Omission of email claims with an unverified domain ownerRecommendation1 passage
  WS-Fed
• AD FS users will see more login prompts to ensure that the correct user is signed in.Scope2 conditions1 passage
• Error 50105 has been fixed to not return interaction_required during interactive authenticationRequirementException2 conditions2 passages
• AppId Uri in single tenant applications will require use of default scheme or verified domainsException1 condition1 passage
• Conditional Access will only trigger for explicitly requested scopesRequirementExceptionScope16 conditions7 passages
• Bug fix: Microsoft Entra ID will no longer URL-encode the state parameter twiceRequirement2 passages
• User passwords will be restricted to 256 characters.Recommendation1 condition1 passage
• Empty fragments will be appended to every HTTP redirect from the login endpoint.ScopeRecommendation1 condition1 passage
• App-only tokens for single-tenant applications are only issued if the client app exists in the resource tenantException4 conditions3 passages
• Redirect URIs can now contain query string parametersScope2 conditions1 passage
• Looping clients will be interruptedExceptionRecommendation1 condition3 passages
• Authorization codes can no longer be reusedRequirementExceptionRecommendation3 conditions2 passages
  AcquireTokenByAuthorizationCodeAsyncAcquireTokenSilentAsync
• ID tokens can't be used for the OBO flowRecommendation2 conditions1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.