MC1260708 – M365 Change Digest

One-line summary

Entra ID audit logs for authentication methods policy updates will soon show only changed properties, improving clarity for admins and security teams.

Similar updates

Details

Summary

Microsoft Entra ID audit logs for Authentication Methods Policy updates will now show only changed properties with old and new values, improving readability. Rollout begins April 2026 worldwide. No changes to event names or policy enforcement. Organizations using automated log processing should review related logic.

Body (from Message Center)

Updated April 1, 2026: We have updated the content. Thank you for your patience.

[Introduction]

We’re improving the formatting of the Authentication Methods Policy Update and Authentication Methods Policy Reset audit log entries in Microsoft Entra ID. Previously, these audit logs included the full authentication methods policy payload under Modified properties, even when only a small number of settings were updated.

With this update, the audit log will now display only the specific properties that changed, along with their corresponding old and new values. The audit log activity name and when it is triggered will not change. This update only changes how modified properties are displayed.

[When this will happen]

General Availability (Worldwide): Rollout begins early April 2026 and is expected to complete by late April 2026.
General Availability (GCC, GCCH, DoD): Rollout begins late April 2026 and is expected to complete by late May 2026.

[How this affects your organization]

Who is affected:

Organizations that use Microsoft Entra ID audit logs, particularly administrators and security teams who review or process Authentication Methods Policy Update or Authentication Methods Policy Reset events.
This may also affect organizations that rely on audit log modified properties for automated processing, alerting, or custom parsing.

What will happen:

This update makes audit logs easier to read and interpret by reducing noise and highlighting exactly what was modified during an authentication methods policy update.
The audit log activity name, event timing, and policy behavior remain unchanged.
No new audit events are introduced, and existing policy enforcement is not affected.

[What you can do to prepare]

No action is required for most organizations.
If you use audit logs for automated processing, alerting, or custom parsing, review any logic that expects the full authentication methods policy payload in Authentication Methods Policy Update or Authentication Methods Policy Reset events’ modified properties.
After this change, audit log entries for authentication method setting changes will surface only the specific properties that were modified, rather than the entire policy object.
Policy-wide updates, such as Registration Campaigns and System-preferred MFA, may continue to include the full policy payload.

Learn more: Microsoft Entra audit log activity reference - Microsoft Entra ID | Microsoft Learn

[Compliance considerations]

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-04-01T00:00:00Z",
    "ai_actions": [
      "Review audit log processing logic if relying on full policy payloads"
    ],
    "ai_master_tags": [
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Entra ID audit logs for authentication methods policy updates will soon show only changed properties, improving clarity for admins and security teams.",
    "ai_topics": [
      "Entra"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Microsoft Entra ID audit logs for Authentication Methods Policy updates will now show only changed properties with old and new values, improving readability. Rollout begins April 2026 worldwide. No changes to event names or policy enforcement. Organizations using automated log processing should review related logic."
    },
    "id": "MC1260708",
    "importance": 3,
    "is_major_change": false,
    "last_modified": "2026-04-01T22:50:54Z",
    "ms_products": [
      "Entra"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Entra"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "Feature update",
      "Admin impact"
    ],
    "title": "(Updated) Microsoft Entra ID: Improved readability for Authentication Methods Policy Update audit logs"
  }
}