Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Cloud Sync migration is the period’s central theme: guidance now defines guided-tool eligibility, active-server requirements, Device Sync limitations, validation steps, and safe phased coexistence. Separately, Microsoft added a Private Access and Infoblox Threat Defense configuration how-to and expanded Identity Protection and disabled-application guidance with concrete administrator implications.
The guide now says migration must begin from the active Connect Sync server, treats Device Sync as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists. It also tells administrators to keep Connect Sync installed during the two-week validation period and use tenant-specific migration dates.
Entra ID · MonitoringConnect Sync and Cloud Sync may coexist during a phased migration, but they must not simultaneously export normal changes for the same object and attribute set. Administrators should complete migration and reference validation before removing objects from Connect Sync scope, avoiding unintended reference removals.
Private Access · SecurityA new how-to covers prerequisites, DNS bypasses, internal domains, category filters, endpoint groups, and security policies for using Microsoft Entra Private Access with Infoblox Threat Defense. The documented setup supports private application traffic alongside DNS security.
ID Protection · FundamentalsThe page now describes a real-time Identity Protection detection for suspiciously added authentication methods. It says the detection raises user risk and can trigger configured risk-based policies, and lists Microsoft Entra ID P2 as required pending confirmation.
Entra ID · SecurityThe consent-phishing guidance says tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It directs application publishers and users to the applicable support guidance.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
The documentation now shows an updated Android screenshot and describes selecting Approve or Deny instead of Yes or No for relevant number-matching prompts in Authenticator, Teams, and Outlook.
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.
The tutorial now emphasizes manual migration for test or pilot environments, directs eligible customers to the guided migration tool, adds scope-removal and source-anchor guidance, clarifies device migration coverage, and links related migration resources.
The article now explains that it covers configuring Device Sync in Microsoft Entra Cloud Sync, not transferring Device Sync with the guided migration tool. It links to the tool’s prerequisites.
The documentation now directs administrators to a migration decision guide, guided-tool eligibility checks, or manual phased migration guidance. It also clarifies scope protection, reference validation, and migration-result verification.
The guide now distinguishes platform capability comparisons from what the guided migration tool can transfer. It identifies device synchronization as a current guided-tool blocker and adds separate guidance for guided, manual, or deferred migration paths.
The documentation now states that tenant administrators cannot reverse Microsoft disablement by enabling tenant-local sign-in or reactivating the app registration.
The page now directs Connect Sync users to review the decision guide, validate guided-tool prerequisites, and choose a supported guided or manual migration path. It also links the migration FAQ and separates Device Sync review from guided-tool eligibility.
The documentation now explains that Connect Sync and Cloud Sync may coexist during a phased migration, but must not simultaneously export normal changes for the same object and attribute set. It adds links to manual migration steps and scope-removal planning.
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
The documentation now describes a real-time Identity Protection detection for suspiciously added authentication methods. It raises user risk and can trigger configured risk-based policies; the page lists Microsoft Entra ID P2 as required, pending confirmation.
The documentation now lists the `suspiciousCredentialAddition` risk event type instead of `TBD` and revises the detection description. Metadata and customer intent were also updated.
A new how-to explains configuring Microsoft Entra Private Access with Infoblox Threat Defense, including prerequisites, DNS bypasses, internal domains, category filters, endpoint groups, and security policies.
