Guidance changes

Observed changes to selected Microsoft guidance. Review in My radar · Timelines and exceptions

Summaries identify wording to review. “May need admin action” is reserved for dates, prerequisites, endpoints, permissions and defaults; a match does not confirm a policy change or availability in your environment.

How this works

Checks start a history on this installation. Observation time is not Microsoft's edit time, and edits made before collection or reverted between checks are unknown. History is limited to 20 source revisions per page.

Where a page's source is in a public Microsoft documentation repository on GitHub, its page also lists Microsoft's commits, and a change shows Microsoft's newest commit message between the two checks. That commit is the likeliest explanation, not a confirmed one: several commits can land between checks, shared include files change pages too, and commit dates are when the source changed, which can precede publication.

Changes sharing a sole source-commit candidate fold together. Other busy days fold by UTC observation date; they do not imply one upstream edit. Expand an entry to read every page. Article references show literal targets and labels, including relative addresses; image bytes are not captured or compared.

Where Microsoft publishes a page's source under an open license (CC BY 4.0, or MIT for Entra), a change shows the changed passages in Microsoft's wording, with removed and added words marked. Other pages show short quotes of the changed words only. Full document copies are not published here.

469 of 469 selected pages have a baseline. 401 pages have an observed change; the newest was seen today.

Coverage and checks

469 of 469 selected pages have a baseline · 401 with observed changes · 469 current checks

Observed changes

RSS

‹ July 2027 ›

MonTueWedThuFriSatSun12345678910111213141516171819202122232425262728293031

July 2027 in brief

No change observed this month under these filters.

Week of 2 Nov 2026

Entra Conditional Access grant controls

May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant.

1 new passage (about 60 words), 1 removed passage (about 60 words).
Changed wording view Inline diff Before After
NewRequire device to be marked as compliant

[added: Microsoft Authenticator requires UserAuthenticationMethod.ReadWrite access to register credentials. When this permission is used in a delegated context by Microsoft Authenticator, access required for credential registration isn't blocked by the Require device to be marked as compliant grant control. This exception doesn't apply to application permissions. Requests using the UserAuthenticationMethod.ReadWrite application permission remain subject to the Require device to be marked as compliant check.]

Before: No saved wording on this side.

After: Microsoft Authenticator requires UserAuthenticationMethod.ReadWrite access to register credentials. When this permission is used in a delegated context by Microsoft Authenticator, access required for credential registration isn't blocked by the Require device to be marked as compliant grant control. This exception doesn't apply to application permissions. Requests using the UserAuthenticationMethod.ReadWrite application permission remain subject to the Require device to be marked as compliant check.
RemovedRequire device to be marked as compliant

[removed: Similarly, the Require device to be marked as compliant doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the Require device to be marked as compliant check.]

Before: Similarly, the Require device to be marked as compliant doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the Require device to be marked as compliant check.

After: No saved wording on this side.
Microsoft's commit: Update Microsoft Authenticator access requirements
Observed 5 Nov 15:42 UTC · current page · MIT