Guidance changes
Observed changes to selected Microsoft guidance. Review in My radar · Timelines and exceptions
469 of 469 selected pages have a baseline. 401 pages have an observed change; the newest was seen today.
Coverage and checks
469 of 469 selected pages have a baseline · 401 with observed changes · 469 current checks
Observed changes
RSSOctober 2026 in brief
13 changes to 13 pages
13 read to decide
Entra 13
Pick a day to list only its changes.
Week of 2 Nov 2026
-
May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant.
1 new passage (about 60 words), 1 removed passage (about 60 words).
NewRequire device to be marked as compliant [added: Microsoft Authenticator requires UserAuthenticationMethod.ReadWrite access to register credentials. When this permission is used in a delegated context by Microsoft Authenticator, access required for credential registration isn't blocked by the Require device to be marked as compliant grant control. This exception doesn't apply to application permissions. Requests using the UserAuthenticationMethod.ReadWrite application permission remain subject to the Require device to be marked as compliant check.]
Before: No saved wording on this side.
After: Microsoft Authenticator requires UserAuthenticationMethod.ReadWrite access to register credentials. When this permission is used in a delegated context by Microsoft Authenticator, access required for credential registration isn't blocked by the Require device to be marked as compliant grant control. This exception doesn't apply to application permissions. Requests using the UserAuthenticationMethod.ReadWrite application permission remain subject to the Require device to be marked as compliant check.
RemovedRequire device to be marked as compliant [removed: Similarly, the Require device to be marked as compliant doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the Require device to be marked as compliant check.]Before: Similarly, the Require device to be marked as compliant doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the Require device to be marked as compliant check.
After: No saved wording on this side.
Microsoft's commit: Update Microsoft Authenticator access requirements
Observed 5 Nov 15:42 UTC · current page · MIT
-
May need admin actionCheck whether a default changed for your tenant or devices; check the roles and permissions you grant.
2 new passages (about 100 words), 1 edited passage (28 words changed).
Changed in: Require remediation for high-risk users
EditedRequire remediation for high-risk users This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group [added: named “Conditional Access: User Risk remediation”] is created alongside this policy to scope the affected users. [added: Microsoft populates this group with eligible active users registered for MFA, up to the tenant’s available Microsoft Entra ID P2 license count.] Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation …
Before: This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group is created alongside this policy to scope the affected users. Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation …
After: This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group named “Conditional Access: User Risk remediation” is created alongside this policy to scope the affected users. Microsoft populates this group with eligible active users registered for MFA, up to the tenant’s available Microsoft Entra ID P2 license count. Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation …
NewRequire remediation for high-risk users [added: Organizations that don't already have an enabled customer-managed Conditional Access policy targeting user risk. Microsoft skips tenants that already have an enabled customer-managed Conditional Access policy targeting user risk. Existing user risk policies in Report-only or Off state don't prevent this Microsoft-managed policy from being created. This check is specific to user risk policies, not all Conditional Access policies.]
Before: No saved wording on this side.
After: Organizations that don't already have an enabled customer-managed Conditional Access policy targeting user risk. Microsoft skips tenants that already have an enabled customer-managed Conditional Access policy targeting user risk. Existing user risk policies in Report-only or Off state don't prevent this Microsoft-managed policy from being created. This check is specific to user risk policies, not all Conditional Access policies.
1 more changed passage · see them all
Microsoft's commit: Update user risk remediation policy details
Observed 4 Nov 09:01 UTC · current page · MIT
Week of 12 Oct 2026
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 13 Oct 00:55 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 13 Oct 00:55 UTC · current page
11 pages · same-day observations 12 Oct 2026 · 11 changes 0 may need admin action · 11 read to decide · 0 no action expected
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 23:53 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:35 UTC · current page
- Entra Authentication strengths
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page
- Entra Conditional Access
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page
-
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page
-
Quoted wording: © Microsoft Corporation · source and applicable license beside each change.