Guidance changes

Observed changes to selected Microsoft guidance. Review in My radar · Timelines and exceptions

Summaries identify wording to review. “May need admin action” is reserved for dates, prerequisites, endpoints, permissions and defaults; a match does not confirm a policy change or availability in your environment.

How this works

Checks start a history on this installation. Observation time is not Microsoft's edit time, and edits made before collection or reverted between checks are unknown. History is limited to 20 source revisions per page.

Where a page's source is in a public Microsoft documentation repository on GitHub, its page also lists Microsoft's commits, and a change shows Microsoft's newest commit message between the two checks. That commit is the likeliest explanation, not a confirmed one: several commits can land between checks, shared include files change pages too, and commit dates are when the source changed, which can precede publication.

Changes sharing a sole source-commit candidate fold together. Other busy days fold by UTC observation date; they do not imply one upstream edit. Expand an entry to read every page. Article references show literal targets and labels, including relative addresses; image bytes are not captured or compared.

Where Microsoft publishes a page's source under an open license (CC BY 4.0, or MIT for Entra), a change shows the changed passages in Microsoft's wording, with removed and added words marked. Other pages show short quotes of the changed words only. Full document copies are not published here.

469 of 469 selected pages have a baseline. 401 pages have an observed change; the newest was seen today.

Coverage and checks

469 of 469 selected pages have a baseline · 401 with observed changes · 439 current checks · 30 overdue

Observed changes

RSS

‹ June 2027 ›

MonTueWedThuFriSatSun123456789101112131415161718192021222324252627282930

June 2027 in brief

No change observed this month under these filters.

Week of 26 Oct 2026

Entra Passkeys in Microsoft Authenticator

May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant; check the dates against your plans.
Changed article references · 1 added · 0 removed
- Added link: exclude the Microsoft Authenticator Credential Registration resource#workarounds-for-an-authentication-strength-conditional-access-policy-loop
2 new passages (about 170 words), 1 edited passage (1 word changed), 1 removed passage (about 80 words).
Changed in: Workarounds for an authentication strength Conditional Access policy loop · Users who can't register passkeys because of Require approved client app or Require app protection policy Conditional Access grant controls
Changed wording view Inline diff Before After
NewWorkarounds for an authentication strength Conditional Access policy loop

[added: You can exclude the Microsoft Authenticator Credential Registration resource from the Conditional Access policy. Note The Microsoft Authenticator Credential Registration resource will be available in November 2026. Before you can exclude the resource from a Conditional Access policy, you must provision the Microsoft Authenticator Credential Registration enterprise application in your tenant. As a Cloud Application Administrator or Application Administrator: Manually provision the Microsoft Authenticator Credential Registration app by using one of the supported methods for creating an enterprise application from a multitenant app. Use the following details: App ID: 6aa00308-ea33-4caa-90d6-ae905d8cb51b Required role: Cloud Application Administrator or Application Administrator For example, use Microsoft Graph Explorer to make a POST request to https://graph.microsoft.com/v1.0/servicePrincipals with the following body: { "appId": "6aa00308-ea33-4caa-90d6-ae905d8cb51b" } After you provision the app, Microsoft Authenticator Credential Registration appears as a resource in Conditional Access. Exclude it from any Conditional Access policies scoped to All resources to unblock passkey registration in Microsoft Authenticator.]

Before: No saved wording on this side.

After: You can exclude the Microsoft Authenticator Credential Registration resource from the Conditional Access policy. Note The Microsoft Authenticator Credential Registration resource will be available in November 2026. Before you can exclude the resource from a Conditional Access policy, you must provision the Microsoft Authenticator Credential Registration enterprise application in your tenant. As a Cloud Application Administrator or Application Administrator: Manually provision the Microsoft Authenticator Credential Registration app by using one of the supported methods for creating an enterprise application from a multitenant app. Use the following details: App ID: 6aa00308-ea33-4caa-90d6-ae905d8cb51b Required role: Cloud Application Administrator or Application Administrator For example, use Microsoft Graph Explorer to make a POST request to https://graph.microsoft.com/v1.0/servicePrincipals with the following body: { "appId": "6aa00308-ea33-4caa-90d6-ae905d8cb51b" } After you provision the app, Microsoft Authenticator Credential Registration appears as a resource in Conditional Access. Exclude it from any Conditional Access policies scoped to All resources to unblock passkey registration in Microsoft Authenticator.
EditedWorkarounds for an authentication strength Conditional Access policy loop

Note With ~~[removed: either]~~ [added: any] workaround, users must also satisfy any Conditional Access policy that targets Register security info or they can't register the passkey. If you have other conditions set up with the All resources policies, those conditions must be met when the passkey …

Before: Note With either workaround, users must also satisfy any Conditional Access policy that targets Register security info or they can't register the passkey. If you have other conditions set up with the All resources policies, those conditions must be met when the passkey …

After: Note With any workaround, users must also satisfy any Conditional Access policy that targets Register security info or they can't register the passkey. If you have other conditions set up with the All resources policies, those conditions must be met when the passkey …
2 more changed passages · see them all
Microsoft's commit: Merge pull request #14558 from tilarso/docs/migrate-passkey-pr-2124
Observed 28 Oct 23:20 UTC · current page · MIT

Week of 12 Oct 2026

Entra Passkey (FIDO2) authentication method

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 23:53 UTC · current page
Entra Passkey requirements and limitations

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
Entra FIDO2 security key Windows sign-in

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:50 UTC · current page
Entra Entra passkeys on Windows

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:35 UTC · current page
Entra Passkeys in Microsoft Authenticator

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

2 edited passages (51 words changed).
Changed wording view Inline diff Before After
EditedPrerequisites for passkeys in Authenticator

… in the following table to enable cross-device registration and authentication. Devices must be allowed to reach these URLs. For more information about requirements for Apple devices, see Use Apple products on enterprise networks. Platform URL Android cable.ua5v.com iOS cable.auth.comapp-site-association.cdn-apple.comapp-site-association.networking.apple Note ~~[removed: Users can't use]~~ [added: On iOS, users can only register attested passkeys directly in the Authenticator app. On Android, users can register attested passkeys directly in the Authenticator app and by using a] cross-device registration ~~[removed: if you enable attestation.]~~ [added: flow.]

Before: … in the following table to enable cross-device registration and authentication. Devices must be allowed to reach these URLs. For more information about requirements for Apple devices, see Use Apple products on enterprise networks. Platform URL Android cable.ua5v.com iOS cable.auth.comapp-site-association.cdn-apple.comapp-site-association.networking.apple Note Users can't use cross-device registration if you enable attestation.

After: … in the following table to enable cross-device registration and authentication. Devices must be allowed to reach these URLs. For more information about requirements for Apple devices, see Use Apple products on enterprise networks. Platform URL Android cable.ua5v.com iOS cable.auth.comapp-site-association.cdn-apple.comapp-site-association.networking.apple Note On iOS, users can only register attested passkeys directly in the Authenticator app. On Android, users can register attested passkeys directly in the Authenticator app and by using a cross-device registration flow.
EditedAuthenticator attestation

~~[removed: Users]~~ [added: On iOS, users] can only register attested passkeys directly in the Authenticator app. ~~[removed: Cross-device registration flows don't support registration of]~~ [added: On Android, users can register] attested ~~[removed: passkeys.]~~ [added: passkeys directly in the Authenticator app and by using a cross-device registration flow.]

Before: Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.

After: On iOS, users can only register attested passkeys directly in the Authenticator app. On Android, users can register attested passkeys directly in the Authenticator app and by using a cross-device registration flow.
Microsoft's commit: Align attestation registration guidance
Observed 12 Oct 19:35 UTC · current page · MIT
Entra Passkey platform and browser compatibility

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:35 UTC · current page
Entra Passkeys and FIDO2

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

The page title or its body outside the tracked passages changed. Review the source for its effect.
Observed 12 Oct 19:19 UTC · current page