Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Microsoft is signaling near-term enforcement of the Microsoft-managed Conditional Access policy 'Require risk remediation for high-risk users': the policy and its security group are already present, and Entra ID Protection will prompt high-risk users to self-remediate. Microsoft Learn also adds concrete guidance for four Security Defaults protections, PIM postapproval extensions, SAP Access Control integration, and Private Access local-network routing.
ID Protection · Conditional AccessThe Message Center notice says Microsoft created the 'Require risk remediation for high-risk users' Conditional Access policy and a companion security group in the tenant. Entra ID Protection identifies high-risk users, while adaptive risk remediation lets them resolve their own risk without administrator intervention.
Entra ID · AuthenticationUpdated guidance describes administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking as separately manageable protections for selected Microsoft Entra ID Free tenants. It also documents Conditional Access interaction, management roles, and independent review or change of each protection’s scope and state.
ID Governance · GovernanceThe preview guidance covers postapproval custom extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also documents collecting values such as cost center and project code, along with required Microsoft Graph permissions and endpoint configuration. The extensions require an Entra ID Governance or Entra Suite license; Entra ID P2 alone does not include them.
ID Governance · GovernanceThe new guidance describes governing SAP business roles through Microsoft Entra catalogs, access packages, and My Access while retaining SAP Access Control workflows and approvals. Coverage includes SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.
Private Access · GeneralThe new guide instructs administrators to enable 'Allow local subnet bypass' in the applicable Private Access traffic forwarding profile. Users then enable 'Prefer Local Network' in the Global Secure Access client, helping overlapping local-subnet traffic remain local while Private Access is enabled.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation describes four separately manageable protections—administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking—for selected Microsoft Entra ID Free tenants. It also explains how these protections work with Conditional Access and which roles can manage them.
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
The article now covers application and agent creation and management. It documents the **Users can create agent blueprints** setting, which administrators can turn off to restrict agent blueprint creation to administrators and Agent ID Developers.
The documentation now links to the “Restricting who can create applications and agents” section in two references, including the application registration error guidance.
Step 1 now links to the permissions reference anchor without the `.md` suffix.
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
The documentation now states that when **Users can create agent blueprints** is set to **Yes**, any tenant user can create an agent identity blueprint and its principal. Otherwise, the Agent ID Developer and Agent ID Administrator roles can create them.
To strengthen your organization's security posture, Microsoft created a new Microsoft‑managed Conditional Access (CA) policy—Require risk remediation for high‑risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self‑remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.
The documentation adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also describes collecting attributes such as cost center and project code, along with the required Graph permissions and endpoint configuration.
The documentation describes integrating SAP Access Control with Microsoft Entra entitlement management to govern SAP business roles through catalogs, access packages, and My Access. It covers SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.
A new guide explains how directly connected local resources can remain reachable while Private Access is enabled, including routing behavior, prerequisites, and configuration steps.
