Skip to content

Update "Session controls for Combined Registration" to reflect Auth s… #1949

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
andrequeda wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update "Session controls for Combined Registration" to reflect Auth s… #1949

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions docs/identity/authentication/concept-registration-mfa-sspr-combined.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,9 +114,14 @@ Users can go to [Security info](https://aka.ms/mysecurityinfo), or they can sele


### Session controls for Combined Registration
By default Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info. If a user is currently signed in, and previously completed MFA as part of a valid session, no additional MFA is required by default, unless a user is attempting to add or modify a passkey (FIDO2) method. Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign-in and complete fresh MFA. Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration.](~/identity/conditional-access/policy-all-users-security-info-registration.md).
By default, Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info.
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use hyphenation for the compound modifier here: "MFA-capable users" (not "MFA capable users").

Suggested change
By default, Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info.
By default, Combined registration enforces all MFA-capable users to strongly authenticate prior to registering or managing their security info.

Copilot uses AI. Check for mistakes.

- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign-in and complete fresh MFA.
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"sign-in" is used as a verb here. Update to "sign in" (verb) to match Microsoft style and the rest of the article.

Suggested change
- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign-in and complete fresh MFA.
- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign in and complete fresh MFA.

Copilot uses AI. Check for mistakes.
- Starting August 25, 2025, as announced in MC1135479, users are required to complete multi-factor authentication (MFA) when managing credentials or accessing My Sign Ins if they haven’t done so within the last 10 minutes of their current session.
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This bullet mixes a few inconsistent terms/typography used elsewhere in the doc:

  • Use "multifactor authentication" (no hyphen) for consistency.
  • Use consistent product naming for "My Sign-ins" (the article uses "My Sign-ins" elsewhere).
  • Replace the smart apostrophe in "haven’t" with a straight apostrophe for consistent Markdown text.
Suggested change
- Starting August 25, 2025, as announced in MC1135479, users are required to complete multi-factor authentication (MFA) when managing credentials or accessing My Sign Ins if they haven’t done so within the last 10 minutes of their current session.
- Starting August 25, 2025, as announced in MC1135479, users are required to complete multifactor authentication (MFA) when managing credentials or accessing My Sign-ins if they haven't done so within the last 10 minutes of their current session.

Copilot uses AI. Check for mistakes.
Enforcing Authentication Strengths to security info registration can conflict with both aforementioned requirements, with end-users potentially experiencing the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*. Changes can be made at the tenant level, such as enforcing "Sign-in frequency: every time" to the "Register security info" user action or enabling Passkeys for Windows Hello for Business users, or at the user level, such as ensuring they authenticate with a session at most 10 minutes old or ensuring they authenticate with a combination of methods included in the enforced Authentication Strength.

Comment on lines +121 to +122
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This paragraph has several consistency/clarity issues:

  • In running text, use lowercase "authentication strengths" unless you’re referring to the UI label.
  • "Enforcing … to security info registration" is ungrammatical; use "for" instead of "to".
  • Consider splitting this into shorter sentences (or a short list) to improve readability, and avoid "end-users" in favor of "users" per Microsoft style.
  • The final "Authentication Strength" reference should be consistent (likely "authentication strength").
Suggested change
Enforcing Authentication Strengths to security info registration can conflict with both aforementioned requirements, with end-users potentially experiencing the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*. Changes can be made at the tenant level, such as enforcing "Sign-in frequency: every time" to the "Register security info" user action or enabling Passkeys for Windows Hello for Business users, or at the user level, such as ensuring they authenticate with a session at most 10 minutes old or ensuring they authenticate with a combination of methods included in the enforced Authentication Strength.
Enforcing authentication strengths for security info registration can conflict with both of these requirements. Users might experience the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*.
You can make changes at either the tenant level or the user level:
- At the tenant level, enforce **Sign-in frequency: Every time** for the **Register security info** user action, or enable passkeys for Windows Hello for Business users.
- At the user level, ensure that users authenticate with a session that's no more than 10 minutes old, or ensure that they authenticate with a combination of methods included in the enforced authentication strength.

Copilot uses AI. Check for mistakes.
Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration.](~/identity/conditional-access/policy-all-users-security-info-registration.md).
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The period is currently included in the link text ("registration."). Move punctuation outside the hyperlink to follow Microsoft Learn link formatting conventions.

Suggested change
Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration.](~/identity/conditional-access/policy-all-users-security-info-registration.md).
Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration](~/identity/conditional-access/policy-all-users-security-info-registration.md).

Copilot uses AI. Check for mistakes.

Combined registration sessions are only valid for 15 minutes. If a user's registration or management actions take longer than this time period, the session expires and the user is asked to sign back in to continue.

## Key usage scenarios

Expand Down