Omission of email claims with an unverified domain owner
Effective date: June 2023 Endpoints impacted: v2.0 and v1.0 Change For multi-tenant applications, emails that aren't domain-owner verified are omitted by default when the optional email claim is requested in a token payload. An email is considered to be domain-owner verified if: The domain belongs to the tenant where the user account resides, and the tenant admin has done verification of the domain. The email is from a Microsoft Account (MSA). The email is from a Google account. The email was used for authentication using the one-time passcode (OTP) flow. It should also be noted that Facebook and SAML/WS-Fed accounts don't have verified domains.
Other open issues in Microsoft Entra
All known issues- Federated Identity Credentials now use case-sensitive matchingOpen · Identity-platform authentication changes
- Applications must be registered in a directoryOpen · Identity-platform authentication changes
- Updated RemoteConnect UX PromptOpen · Identity-platform authentication changes
- The Power BI administrator role will be renamed to Fabric Administrator.Open · Identity-platform authentication changes
- AD FS users will see more login prompts to ensure that the correct user is signed in.Open · Identity-platform authentication changes
- AppId Uri in single tenant applications will require use of default scheme or verified domainsOpen · Identity-platform authentication changes
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.
Keep track
- Watch above puts it on My radar, which shows when the publisher changes it.
- Microsoft Entra RSS feed: new known issues, releases and retirements.
- All open known issues across Windows, Office, Graph and Windows 365.