- Introduces a login confirmation prompt for authentication requests using custom URI schemes or loopback URIs, replacing silent redirects
- Rejects prompt=none for non‑verifiable callbacks, requiring user interaction
- Existing tenants keep old behavior until April 2026; new tenants default to the prompt with opt‑in/out options