diff --git a/.changeset/polite-keys-confess.md b/.changeset/polite-keys-confess.md
index c83bd20b3a..007ad98641 100644
--- a/.changeset/polite-keys-confess.md
+++ b/.changeset/polite-keys-confess.md
@@ -7,6 +7,5 @@ Previously only ClientId/ClientSecret was supported, but now all the authenticat
 Including Managed Identity, Client Certificate, Azure CLI and VS Code.
 
 If `clientId` and `clientSecret` are specified in configuration, the plugin behaves the same way as before.
-If these fields are omitted, the plugin uses `DefaultAzureCredential` to determine
-
+If these fields are omitted, the plugin uses `DefaultAzureCredential` to automatically determine the best authentication method.
 This is particularly useful for local development environments - the default configuration will try to use existing credentials from Visual Studio Code, Azure CLI and Azure PowerShell, without the user needing to configure any credentials in app-config.yaml
diff --git a/docs/integrations/azure/org.md b/docs/integrations/azure/org.md
index b5b8ac6f8d..37ef0634fc 100644
--- a/docs/integrations/azure/org.md
+++ b/docs/integrations/azure/org.md
@@ -230,12 +230,12 @@ export async function myOrganizationTransformer(
 
 ### Authentication / Token Errors
 
-See (Troubleshooting Azure Identity Authentication Issues)[https://aka.ms/azsdk/js/identity/troubleshoot]
+See [Troubleshooting Azure Identity Authentication Issues](https://aka.ms/azsdk/js/identity/troubleshoot)
 
 ### Error while reading users from Microsoft Graph: Authorization_RequestDenied - Insufficient privileges to complete the operation.
 
-- Make sure you've granted all the permissions required
-- Make sure the permission is an `Application` permission rather than `Delegated`
+- Make sure you've granted all the required permissions to your application registration or managed identity
+- Make sure the permissions are `Application` permissions rather than `Delegated`
 - If your organization has configured "Admin consent" to be required, make sure this has been granted for your application permissions
 - If your group queries are returning Microsoft Teams groups, you may need to grant addition permissions (e.g. `Team.ReadBasic.All`, `TeamMember.Read.All`)
-- If you've added additional `select` fields, those may need additional permissions granted
+- If you've added additional `select` or `expand` fields, those may need additional permissions granted
diff --git a/plugins/catalog-backend-module-msgraph/README.md b/plugins/catalog-backend-module-msgraph/README.md
index a052a80c58..23166a755d 100644
--- a/plugins/catalog-backend-module-msgraph/README.md
+++ b/plugins/catalog-backend-module-msgraph/README.md
@@ -167,5 +167,3 @@ export async function myGroupTransformer(
    }),
  );
 ```
-
-## Troubleshooting
diff --git a/plugins/catalog-backend-module-msgraph/package.json b/plugins/catalog-backend-module-msgraph/package.json
index 7609b4c083..0e4c953890 100644
--- a/plugins/catalog-backend-module-msgraph/package.json
+++ b/plugins/catalog-backend-module-msgraph/package.json
@@ -33,7 +33,7 @@
     "start": "backstage-cli package start"
   },
   "dependencies": {
-    "@azure/identity": "^2.0.4",
+    "@azure/identity": "^2.1.0",
     "@backstage/backend-tasks": "^0.3.3-next.2",
     "@backstage/catalog-model": "^1.1.0-next.2",
     "@backstage/config": "^1.0.1",
diff --git a/yarn.lock b/yarn.lock
index 88993d0568..354d6616c8 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -287,6 +287,20 @@
     "@opentelemetry/api" "^1.0.1"
     tslib "^2.2.0"
 
+"@azure/core-tracing@^1.0.0":
+  version "1.0.1"
+  resolved "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.0.1.tgz#352a38cbea438c4a83c86b314f48017d70ba9503"
+  integrity sha512-I5CGMoLtX+pI17ZdiFJZgxMJApsK6jjfm85hpgp3oazCdq5Wxgh4wMr7ge/TTWW1B5WBuvIOI1fMU/FrOAMKrw==
+  dependencies:
+    tslib "^2.2.0"
+
+"@azure/core-util@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/@azure/core-util/-/core-util-1.0.0.tgz#07c7175670e0abe725ad88f9c3d65d074107a3af"
+  integrity sha512-yWshY9cdPthlebnb3Zuz/j0Lv4kjU6u7PR5sW7A9FF7EX+0irMRJAtyTq5TPiDHJfjH8gTSlnIYFj9m7Ed76IQ==
+  dependencies:
+    tslib "^2.2.0"
+
 "@azure/core-util@^1.0.0-beta.1":
   version "1.0.0-beta.1"
   resolved "https://registry.npmjs.org/@azure/core-util/-/core-util-1.0.0-beta.1.tgz#2efd2c74b4b0a38180369f50fe274a3c4cd36e98"
@@ -316,6 +330,28 @@
     tslib "^2.2.0"
     uuid "^8.3.0"
 
+"@azure/identity@^2.1.0":
+  version "2.1.0"
+  resolved "https://registry.npmjs.org/@azure/identity/-/identity-2.1.0.tgz#89f0bfc1d1264dfd3d0cb19837c33a9c6706d548"
+  integrity sha512-BPDz1sK7Ul9t0l9YKLEa8PHqWU4iCfhGJ+ELJl6c8CP3TpJt2urNCbm0ZHsthmxRsYoMPbz2Dvzj30zXZVmAFw==
+  dependencies:
+    "@azure/abort-controller" "^1.0.0"
+    "@azure/core-auth" "^1.3.0"
+    "@azure/core-client" "^1.4.0"
+    "@azure/core-rest-pipeline" "^1.1.0"
+    "@azure/core-tracing" "^1.0.0"
+    "@azure/core-util" "^1.0.0"
+    "@azure/logger" "^1.0.0"
+    "@azure/msal-browser" "^2.26.0"
+    "@azure/msal-common" "^7.0.0"
+    "@azure/msal-node" "^1.10.0"
+    events "^3.0.0"
+    jws "^4.0.0"
+    open "^8.0.0"
+    stoppable "^1.1.0"
+    tslib "^2.2.0"
+    uuid "^8.3.0"
+
 "@azure/logger@^1.0.0":
   version "1.0.1"
   resolved "https://registry.npmjs.org/@azure/logger/-/logger-1.0.1.tgz#19b333203d1b2931353d8879e814b64a7274837a"
@@ -330,6 +366,13 @@
   dependencies:
     "@azure/msal-common" "^5.2.0"
 
+"@azure/msal-browser@^2.26.0":
+  version "2.27.0"
+  resolved "https://registry.npmjs.org/@azure/msal-browser/-/msal-browser-2.27.0.tgz#3db38db6bc2bae44485025ba9bb99c43ed7f4302"
+  integrity sha512-PyATq2WvK+x32waRqqikym8wvn939iO9UhpFqhLwitNrfLa3PHUgJuuI9oLSQOS3/UzjYb8aqN+XzchU3n/ZuQ==
+  dependencies:
+    "@azure/msal-common" "^7.1.0"
+
 "@azure/msal-common@^4.5.1":
   version "4.5.1"
   resolved "https://registry.npmjs.org/@azure/msal-common/-/msal-common-4.5.1.tgz#f35af8b634ae24aebd0906deb237c0db1afa5826"
@@ -344,12 +387,12 @@
   dependencies:
     debug "^4.1.1"
 
-"@azure/msal-common@^7.1.0":
+"@azure/msal-common@^7.0.0", "@azure/msal-common@^7.1.0":
   version "7.1.0"
   resolved "https://registry.npmjs.org/@azure/msal-common/-/msal-common-7.1.0.tgz#b77dbf9ae581f1ed254f81d56422e3cdd6664b32"
   integrity sha512-WyfqE5mY/rggjqvq0Q5DxLnA33KSb0vfsUjxa95rycFknI03L5GPYI4HTU9D+g0PL5TtsQGnV3xzAGq9BFCVJQ==
 
-"@azure/msal-node@^1.3.0":
+"@azure/msal-node@^1.10.0", "@azure/msal-node@^1.3.0":
   version "1.11.0"
   resolved "https://registry.npmjs.org/@azure/msal-node/-/msal-node-1.11.0.tgz#d8bd3f15c1f05bf806ba6f9479c48c2eddd6a98d"
   integrity sha512-KW/XEexfCrPzdYbjY7NVmhq9okZT3Jvck55CGXpz9W5asxeq3EtrP45p+ZXtQVEfko0YJdolpCNqWUyXvanWZg==