Empty fragments will be appended to every HTTP redirect from the login endpoint.
Effective date: February 8, 2020 Endpoints impacted: Both v1.0 and v2.0 Protocol impacted: OAuth and OIDC flows that use response_type=query - this covers the authorization code flow in some cases, and the implicit flow. When an authentication response is sent from login.microsoftonline.com to an application via HTTP redirect, the service will append an empty fragment to the reply URL. This prevents a class of redirect attacks by ensuring that the browser wipes out any existing fragment in the authentication request. No apps should have a dependency on this behavior.
Other open issues in Microsoft Entra
All known issues- Federated Identity Credentials now use case-sensitive matchingOpen · Identity-platform authentication changes
- Applications must be registered in a directoryOpen · Identity-platform authentication changes
- Updated RemoteConnect UX PromptOpen · Identity-platform authentication changes
- Omission of email claims with an unverified domain ownerOpen · Identity-platform authentication changes
- The Power BI administrator role will be renamed to Fabric Administrator.Open · Identity-platform authentication changes
- AD FS users will see more login prompts to ensure that the correct user is signed in.Open · Identity-platform authentication changes
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.
Keep track
- Watch above puts it on My radar, which shows when the publisher changes it.
- Microsoft Entra RSS feed: new known issues, releases and retirements.
- All open known issues across Windows, Office, Graph and Windows 365.