Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The 14 October changes add practical guidance for keeping directly connected home-network resources reachable with Microsoft Entra Private Access, while expanding documented detail on independently manageable Security Defaults protections and PIM role-activation extensions. Entra ID reference updates also specify customer sign-in issuer and domain_hint requirements and clarify the Application Developer role’s ability to update owned applications. A separate Provision On Demand edit only updates a permissions-reference link.
Private Access · GeneralA new guide explains routing, prerequisites, and configuration for keeping directly connected local resources reachable while Private Access is enabled. Administrators configure Allow local subnet bypass in the applicable traffic forwarding profile; users then enable Prefer Local Network in the Global Secure Access client so overlapping local-subnet traffic can remain local.
Entra ID · AuthenticationThe updated page identifies administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking as separately manageable protections for selected Microsoft Entra ID Free tenants, and explains their relationship with Conditional Access and the roles that can manage them.
ID Governance · GovernanceThe updated preview guidance covers postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning, including collection of attributes such as cost center and project code. It also documents required Graph permissions and endpoint configuration, and states that the capability requires an Entra ID Governance or Entra Suite license; Entra ID P2 alone does not include it.
Entra ID · AuthenticationThe guide now specifies using the tenant ID or the tenant’s onmicrosoft.com domain in the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents refreshing a user flow after provider configuration changes.
Entra ID · GeneralThe updated reference states that Application Developer role holders can update applications they own, while they can create application registrations independently of the user registration setting. Administrators should account for this scope when reviewing role assignments.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation describes four separately manageable protections—administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking—for selected Microsoft Entra ID Free tenants. It also explains how these protections work with Conditional Access and which roles can manage them.
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
Step 1 now links to the permissions reference anchor without the `.md` suffix.
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
The documentation adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also describes collecting attributes such as cost center and project code, along with the required Graph permissions and endpoint configuration.
A new guide explains how directly connected local resources can remain reachable while Private Access is enabled, including routing behavior, prerequisites, and configuration steps.
