Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The strongest updates clarify Entra ID authentication and dynamic-group behavior rather than announce new releases. The period also adds explicit Conditional Access Policy Plans limits and expands Global Secure Access private network connector operational guidance.
Entra ID · AuthenticationThe SSPR how-it-works guidance now says a user who signs in with a passkey can change a forgotten password without entering the current password. Losing the passkey is a separate path requiring account recovery or administrator-issued recovery credentials to register a new one.
Entra ID · Conditional AccessThe guidance sets a limit of 100 rules per plan and 100 plans per tenant, while streamlining Global Secure Access and agent-access scenarios. Administrators can use these limits when designing and scaling policy plans.
Entra ID · GeneralThe Groups Create Rule guidance says unsupported properties can be saved while processing is paused but produce a Processing error when processing resumes. Membership remains at the last successful evaluation and no new members are added, so affected users may not receive targeted policies or assignments.
Entra ID · GeneralThe memberOf dynamic-rule guidance now says deleting a child group does not automatically update membership: affected users or devices remain members until the rule is modified. Administrators should use this limitation when troubleshooting dynamic-group membership.
Global Secure Access · GeneralGlobal Secure Access release notes now cover 24-hour CPU and memory history, improved health reporting, interface-specific DNS, trace rotation, expanded event-log capacity, clearer errors, TCP keepalive, memory management, and local log and file security. Administrators can download the version from the Microsoft Entra admin center to assess the operational improvements.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The article now explains that passwordless users can change their cloud password from Security info after secure sign-in, supporting legacy applications that still require passwords. The rollout notice was removed.
The documentation now explains that users who sign in with a passkey can change a forgotten password without entering the current password. It also distinguishes passkey loss, which requires account recovery or administrator-issued recovery credentials to register a new passkey.
The documentation now explains that unsupported properties can be saved while processing is paused, but trigger a Processing error when processing resumes. During that error, membership remains at the last successful evaluation and no new members are added.
The documentation now states that membership does not automatically update when a child group is deleted; affected users or devices remain members until the rule is modified. The reference to members removed from a child group was removed.
The documentation now states that each plan supports up to 100 rules and each tenant supports up to 100 plans. It also streamlines guidance for Global Secure Access and agent access scenarios.
The SAP provisioning guidance now explicitly identifies the associated Microsoft Entra agents as Microsoft Entra provisioning agents.
The SAP documentation now notes that Joule, SAP’s AI assistant, works across connected SAP applications and links to SAP guidance for enabling it in Cloud Identity Services.
The documentation now describes how signed-in users can update existing passwords through the Microsoft Entra External ID credential management API, including the required delegated permissions and JSON request format.
The release notes document 24-hour CPU and memory history, improved health reporting, interface-specific DNS support, trace rotation, expanded event-log capacity, better error messages, TCP keepalive, memory management, and local log and file security.
