Update "Session controls for Combined Registration" to reflect Auth s…

[andrequeda]

…trengths conflict

Document conflict between Auth strengths and 10-minute session requirement for security info registration, as well as potential solutions for it

[prmerger-automator]

@andrequeda : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

[learn-build-service-prod]

Learn Build status updates of commit b303e41:

✅ Validation status: passed

File	Status	Preview URL	Details
docs/identity/authentication/concept-registration-mfa-sspr-combined.md	✅Succeeded

For more details, please refer to the build report.

[v-regandowner]

@Justinha

Can you review the proposed changes?

IMPORTANT: When the changes are ready for publication, adding a #sign-off comment is the best way to signal that the PR is ready for the review team to merge.

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

[Copilot]

Pull request overview

Updates the combined registration documentation to describe a conflict between Conditional Access authentication strengths and recent/related session reauthentication requirements, and to outline mitigation options.

Changes:

• Reformats “Session controls for Combined Registration” into clearer bullets.
• Adds the 10-minute MFA reauthentication requirement (MC1135479) and explains how it can conflict with authentication strengths.
• Notes possible tenant-level and user-level mitigations.

[Copilot]

Use hyphenation for the compound modifier here: "MFA-capable users" (not "MFA capable users").

Suggested change

	By default, Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info.
	By default, Combined registration enforces all MFA-capable users to strongly authenticate prior to registering or managing their security info.

[Copilot]

"sign-in" is used as a verb here. Update to "sign in" (verb) to match Microsoft style and the rest of the article.

Suggested change

	- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign-in and complete fresh MFA.
	- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign in and complete fresh MFA.

[Copilot]

This bullet mixes a few inconsistent terms/typography used elsewhere in the doc:

• Use "multifactor authentication" (no hyphen) for consistency.
• Use consistent product naming for "My Sign-ins" (the article uses "My Sign-ins" elsewhere).
• Replace the smart apostrophe in "haven’t" with a straight apostrophe for consistent Markdown text.

Suggested change

	- Starting August 25, 2025, as announced in MC1135479, users are required to complete multi-factor authentication (MFA) when managing credentials or accessing My Sign Ins if they haven’t done so within the last 10 minutes of their current session.
	- Starting August 25, 2025, as announced in MC1135479, users are required to complete multifactor authentication (MFA) when managing credentials or accessing My Sign-ins if they haven't done so within the last 10 minutes of their current session.

[Copilot]

This paragraph has several consistency/clarity issues:

• In running text, use lowercase "authentication strengths" unless you’re referring to the UI label.
• "Enforcing … to security info registration" is ungrammatical; use "for" instead of "to".
• Consider splitting this into shorter sentences (or a short list) to improve readability, and avoid "end-users" in favor of "users" per Microsoft style.
• The final "Authentication Strength" reference should be consistent (likely "authentication strength").

Suggested change

	Enforcing Authentication Strengths to security info registration can conflict with both aforementioned requirements, with end-users potentially experiencing the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*. Changes can be made at the tenant level, such as enforcing "Sign-in frequency: every time" to the "Register security info" user action or enabling Passkeys for Windows Hello for Business users, or at the user level, such as ensuring they authenticate with a session at most 10 minutes old or ensuring they authenticate with a combination of methods included in the enforced Authentication Strength.
	Enforcing authentication strengths for security info registration can conflict with both of these requirements. Users might experience the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*.
	You can make changes at either the tenant level or the user level:
	- At the tenant level, enforce **Sign-in frequency: Every time** for the **Register security info** user action, or enable passkeys for Windows Hello for Business users.
	- At the user level, ensure that users authenticate with a session that's no more than 10 minutes old, or ensure that they authenticate with a combination of methods included in the enforced authentication strength.

[Copilot]

The period is currently included in the link text ("registration."). Move punctuation outside the hyperlink to follow Microsoft Learn link formatting conventions.

Suggested change

	Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration.](~/identity/conditional-access/policy-all-users-security-info-registration.md).
	Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration](~/identity/conditional-access/policy-all-users-security-info-registration.md).