Delete Entra modal: Update instructions (#35874)

Deleting Microsoft Entra ID doesn't unblock end users. Instead, to
unblock, the IT admin has to disable the "Conditional Access" policy in
Entra.

Context: https://github.com/fleetdm/fleet/pull/35632/files#r2524534037

articles/entra-conditional-access-integration.md

@@ -182,12 +182,9 @@ As an example, you can create a policy to "block access to Office 365 on macOS d
 
 Make sure to assign the "Fleet conditional access" group to the Entra policy.
 
-### Disabling "Conditional Access" on a team
+## Disable
 
-If you need all your hosts on a team to be marked as "Compliant" (e.g. to unblock access to a resource) go to **Policies > Select team > Automations > Conditional access**, uncheck all policies, and select **Save**. The hosts will be marked as "Compliant" the next time they check in with policy results (within one hour, or by refetching manually).
-
-To disable the "Conditional Access" feature on a team head to **Policies > Select team > Automations > Conditional access > Disable**.
-Once disabled, hosts will not be reporting compliance status to Entra anymore.
+If you want to unblock all end users, you can disable conditional access by heading to Entra and turning off the ["Conditional Access" Entra policies](#step-6-add-entra-policies).
 
 ## End user experience
 

docs/REST API/rest-api.md

@@ -941,7 +941,7 @@ Returns an Apple configuration profile file with `Content-Type: application/x-ap
 
 ### Delete Microsoft Entra ID
 
-Fleet will be disconnected from Microsoft Entra and will stop blocking end users from logging in with single sign-on.
+Disconnects Fleet from Entra. This won't unblock end users failing policies. Learn how to [unblock end users](https://fleetdm.com/guides/entra-conditional-access-integration#disable).
 
 `DELETE /api/v1/conditional-access/microsoft`
 

frontend/pages/admin/IntegrationsPage/cards/ConditionalAccess/ConditionalAccess.tsx

@@ -73,8 +73,16 @@ const DeleteConditionalAccessModal = ({
     >
       <>
         <p>
-          Fleet will be disconnected from Microsoft Entra and will stop blocking
-          end users from logging in with single sign-on.
+          Before you delete, first unblock all end users.{" "}
+          <CustomLink
+            text="Learn how"
+            url={`${LEARN_MORE_ABOUT_BASE_LINK}/disable-entra-conditional-access`}
+            newTab
+          />
+        </p>
+        <p>
+          If you don&apos;t, end users will stay blocked even after deleting
+          Entra.
         </p>
         <div className="modal-cta-wrap">
           <Button

website/config/routes.js

@@ -1010,6 +1010,7 @@ module.exports.routes = {
   'GET /learn-more-about/setup-experience/end-user-authentication': '/guides/macos-setup-experience#end-user-authentication',
   'GET /learn-more-about/setup-experience/bootstrap-package': '/guides/macos-setup-experience#bootstrap-package',
   'GET /learn-more-about/built-in-variables': '/docs/configuration/yaml-files#variables',
+  'GET /learn-more-about/disable-entra-conditional-access': '/guides/entra-conditional-access-integration#disable',
 
   // Sitemap
   // =============================================================================================================