Conditional Access grant controls
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
Entra · Official Microsoft guidance23 Oct 09:39 UTC → 5 Nov 15:42 UTC
What changed
May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant.
[added: Microsoft Authenticator requires UserAuthenticationMethod.ReadWrite access to register credentials. When this permission is used in a delegated context by Microsoft Authenticator, access required for credential registration isn't blocked by the Require device to be marked as compliant grant control. This exception doesn't apply to application permissions. Requests using the UserAuthenticationMethod.ReadWrite application permission remain subject to the Require device to be marked as compliant check.]
[removed: Similarly, the Require device to be marked as compliant doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the Require device to be marked as compliant check.]
Source: Microsoft source · © Microsoft · MIT.
Read the current Microsoft source
Compares the selected versions; edits made and undone between them do not appear.