A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Conditional Access policy plans preview brings shared targeting before November first-MFA registration changes
New preview guidance covers Microsoft Entra Conditional Access policy plans, which group related rules under shared conditions and exclusions and support report-only review. A companion migration guide says existing policies remain unchanged and continue evaluating independently. Separately, a phased November 2026 rollout will let users register passkeys or passwordless sign-in as their first MFA method. The remaining additions are Secure Cloud OIDC and SCIM setup guides, while Private Access lost a connector-offline troubleshooting row.
- Conditional Access policy plans centralize conditions and exclusions in preview
Entra ID · Conditional AccessThe new preview guide covers creating plans from templates or from scratch, configuring shared conditions and exclusions, reviewing rules in report-only mode, and enabling plans. Creating, modifying, or deleting a plan requires the Conditional Access Administrator role.
- First-MFA registration will allow passkeys and passwordless sign-inEntra ID · Conditional Access
Microsoft Entra will let users register a passkey or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins in November 2026.
- Secure Cloud OIDC SSO setup gains a dedicated Entra guide
Entra ID · StandardsThe new guide covers prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification. It specifies that the enterprise application is created only after the initial Microsoft Entra sign-in and consent.
- Secure Cloud SCIM provisioning guidance covers the full user lifecycle
Entra ID · ProvisioningThe new tutorial explains automatic user and group provisioning, updates, synchronization, and deprovisioning through SCIM 2.0, including prerequisites, credentials, and deployment scope.
- Private Access operations guidance drops connector-offline troubleshooting
Private Access · GeneralThe operations page no longer includes the connector offline condition row, related Sentinel analytics guidance, or the Windows service check. Administrators should avoid relying on that removed troubleshooting workflow.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
7 updates
Microsoft Entra ID
6 updatesCreate a Conditional Access policy plan (preview)
Public previewA new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins November 2026, aiming to simplify strong authentication adoption and reduce registration friction.
Configure Secure Cloud User Integration for automatic user provisioning with Microsoft Entra ID
Doc updateMicrosoft added a step-by-step tutorial for configuring automatic user and group provisioning, updates, synchronization, and deprovisioning between Microsoft Entra ID and Secure Cloud using SCIM 2.0.
A new article explains how to configure Secure Cloud User Integration with Microsoft Entra ID using OIDC, including prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification.
Microsoft Entra Private Access
1 updateOperate Private Access
Doc updateThe Private Access operations page no longer includes the row describing a connector offline condition, related Sentinel analytics guidance, or the Windows service check.