Guidance changes

Observed changes to selected Microsoft guidance. Review in My radar · Timelines and exceptions

Summaries identify wording to review. “May need admin action” is reserved for dates, prerequisites, endpoints, permissions and defaults; a match does not confirm a policy change or availability in your environment.

How this works

Checks start a history on this installation. Observation time is not Microsoft's edit time, and edits made before collection or reverted between checks are unknown. History is limited to 20 source revisions per page.

Where a page's source is in a public Microsoft documentation repository on GitHub, its page also lists Microsoft's commits, and a change shows Microsoft's newest commit message between the two checks. That commit is the likeliest explanation, not a confirmed one: several commits can land between checks, shared include files change pages too, and commit dates are when the source changed, which can precede publication.

Changes sharing a sole source-commit candidate fold together. Other busy days fold by UTC observation date; they do not imply one upstream edit. Expand an entry to read every page. Article references show literal targets and labels, including relative addresses; image bytes are not captured or compared.

Where Microsoft publishes a page's source under an open license (CC BY 4.0, or MIT for Entra), a change shows the changed passages in Microsoft's wording, with removed and added words marked. Other pages show short quotes of the changed words only. Full document copies are not published here.

469 of 469 selected pages have a baseline. 401 pages have an observed change; the newest was seen today.

Coverage and checks

469 of 469 selected pages have a baseline · 401 with observed changes · 439 current checks · 30 overdue

Observed changes

RSS

‹ December 2025 ›

MonTueWedThuFriSatSun12345678910111213141516171819202122232425262728293031

December 2025 in brief

No change observed this month under these filters.

Week of 26 Oct 2026

Entra Combined security information registration

Read to decideNew content in “Change a password in My Sign-Ins”; read it to see whether it concerns you.
Changed article references · 1 added · 0 removed
- Added link: Allow password change after secure sign-in.https://review.learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks?branch=pr-en-us-14357&tabs=secure-sign-in#tab/secure-sign-in
2 new passages (about 80 words), 2 edited passages (45 words changed).
New section: Change a password in My Sign-Ins
Also changed: Change a password in MySignIns
Changed wording view Inline diff Before After
EditedChange a password in My Sign-Ins

A user navigates to Security info. After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, ~~[removed: they're able to use the enhanced user experience to]~~ [added: they can] change their password without entering [removed: their existing password. When finished, the user has the new password updated on the Security info page. Authentication methods such as Temporary Access Pass (TAP) aren't supported for password change unless the user knows] their existing password.

Before: A user navigates to Security info. After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, they're able to use the enhanced user experience to change their password without entering their existing password. When finished, the user has the new password updated on the Security info page. Authentication methods such as Temporary Access Pass (TAP) aren't supported for password change unless the user knows their existing password.

After: A user navigates to Security info. After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, they can change their password without entering their existing password.
NewChange a password in My Sign-Ins

[added: An organization can also allow users to change their cloud password after they sign in with Microsoft Entra certificate-based authentication (CBA), a passkey (FIDO2), or a Microsoft Authenticator passwordless phone sign-in notification. Users don't need to know or enter their current password, and they don't need to be registered for SSPR. For administrator configuration, user steps, and limitations, see Allow password change after secure sign-in.]

Before: No saved wording on this side.

After: An organization can also allow users to change their cloud password after they sign in with Microsoft Entra certificate-based authentication (CBA), a passkey (FIDO2), or a Microsoft Authenticator passwordless phone sign-in notification. Users don't need to know or enter their current password, and they don't need to be registered for SSPR. For administrator configuration, user steps, and limitations, see Allow password change after secure sign-in.
1 more changed passage · see them all
Observed 30 Oct 01:49 UTC · current page · MIT

Week of 12 Oct 2026

Entra Combined security information registration

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Microsoft's commit: Rename secure sign-in documentation section
Observed 13 Oct 00:39 UTC · current page
Entra MFA NPS extension

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 23:53 UTC · current page
Entra Conditional Access authentication strengths for guests

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
Entra Authentication registration campaigns

May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant.

14 new passages (about 460 words), 4 edited passages (107 words changed), 7 removed passages (about 220 words).
New sections: How passkey registration nudges are evaluated · Step 1: Determine how the passkey profile affects the nudge · Step 2: Evaluate the platform, when required
Also changed: Examples · Can users be nudged within an SSO session? · Passkey nudge evaluation by platform · How the passkey profile affects the nudge evaluation
Changed wording view Inline diff Before After
NewHow passkey registration nudges are evaluated

[added: After a user meets the registration campaign’s eligibility requirements, their passkey profile determines whether existing registered passkeys suppress the nudge across all platforms or only for the current operating system and browser combination (platform). Start with the profile table. Use the platform table only when platform-specific evaluation applies.]

Before: No saved wording on this side.

After: After a user meets the registration campaign’s eligibility requirements, their passkey profile determines whether existing registered passkeys suppress the nudge across all platforms or only for the current operating system and browser combination (platform). Start with the profile table. Use the platform table only when platform-specific evaluation applies.
NewHow passkey registration nudges are evaluated

[added: These rules apply to passkey campaigns in both the Enabled and Microsoft managed states. They are separate from passkey profile eligibility for the Microsoft managed registration campaign. In the Microsoft managed state, only users assigned to at least one eligible passkey profile are nudged. In contrast, when the registration campaign is set to Enabled, any user who is enabled for passkeys can be nudged, regardless of their passkey profile.]

Before: No saved wording on this side.

After: These rules apply to passkey campaigns in both the Enabled and Microsoft managed states. They are separate from passkey profile eligibility for the Microsoft managed registration campaign. In the Microsoft managed state, only users assigned to at least one eligible passkey profile are nudged. In contrast, when the registration campaign is set to Enabled, any user who is enabled for passkeys can be nudged, regardless of their passkey profile.
18 more changed passages · see them all
Microsoft's commit: Merge pull request #14574 from JasSuri/docs/clarify-registration-campaign-sso-nudge
Observed 12 Oct 19:50 UTC · current page · MIT
Entra Mandatory MFA enforcement

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:35 UTC · current page
Entra Authentication methods policy

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page
Entra Require MFA authentication strength

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page
Entra Multifactor authentication

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page

Week of 5 Oct 2026

Entra Authentication registration campaigns

May need admin actionCheck the dates against your plans.

1 removed passage (about 40 words).
Changed wording view Inline diff Before After
RemovedRun a registration campaign to set up a passkey or Microsoft Authenticator

[removed: Note We're rolling out this version of the registration campaign. The rollout is expected to finish by the end of September 2026. Until then, the registration campaign experience in your tenant might differ from what's described in this article.]

Before: Note We're rolling out this version of the registration campaign. The rollout is expected to finish by the end of September 2026. Until then, the registration campaign experience in your tenant might differ from what's described in this article.

After: No saved wording on this side.
Microsoft's commit: Remove registration campaign rollout note
Observed 7 Oct 23:38 UTC · current page · MIT
Entra Mandatory MFA enforcement

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

1 edited passage (2 words changed), 5 removed passages (about 30 words).
Changed in: FAQs · Feedback · Additional resources
Changed wording view Inline diff Before After
EditedFAQs

Question: What if I don't receive[added: ␣]an email about enabling MFA before it was enforced, and then I get locked-out. How should I resolve it?

Before: Question: What if I don't receivean email about enabling MFA before it was enforced, and then I get locked-out. How should I resolve it?

After: Question: What if I don't receive an email about enabling MFA before it was enforced, and then I get locked-out. How should I resolve it?
RemovedFeedback

~~[removed: Was this page helpful?]~~

Before: Was this page helpful?

After: No saved wording on this side.
2 more changed passages · see them all
Microsoft's commit: Spelling fixes (#2125)
Observed 6 Oct 17:57 UTC · current page · MIT