May 2025 — Entra.News Daily

May was overwhelmingly a documentation-maintenance period: 5,758 of 5,804 records were updates, compared with 26 new and 18 removed entries, and only two Message Center notices. The clearest operational signals were the explicit GA date for Entra hybrid join in Power Automate hosted machine groups and the global availability notice for the Defender for Identity sensor on Microsoft Entra Connect servers. Learn updates separately mark linkable identifiers in Entra ID and TLS inspection in Microsoft Entra Internet Access as previews, while Tenant Restrictions v2 and certificate-based authentication content clarify security behavior. New entries such as the External ID emailOtpSend reference and the ID Governance PIM for Groups how-to are documentation additions, not evidence of launches. The 18 removals have no supplied scope, so no retirement can be established.

General availability announced: Entra hybrid join for Power Automate hosted machine groupsEntra ID / Power Automate
The 2 May Microsoft 365 Message Center notice announces the ability to configure Entra hybrid join for hosted machine groups in Power Automate and states that it will reach general availability on 31 May 2025. This is an explicit availability milestone rather than a documentation-only update; no additional prerequisites or rollout steps are supplied.
Global availability notice: Defender for Identity sensor on Entra ConnectEntra ID / Defender for Identity
The 9 May Message Center notice calls for deployment of the new Defender for Identity sensor on Microsoft Entra Connect servers. It says the update is available globally, recommends installation for comprehensive monitoring and threat detection, and states that no administrator action is required before rollout. This is a security availability notice, not evidence of a forced cutover.
Security previews: token correlation and TLS inspectionEntra ID; Microsoft Entra Internet Access
Updated Entra ID preview documentation says specific identifiers are embedded in all access tokens and surfaced in customer-facing logs, allowing activity to be correlated to a single root authentication event. Separately, the Microsoft Entra Internet Access TLS inspection page is explicitly marked Preview and describes decryption and inspection at service-edge locations so Global Secure Access can apply threat detection, content filtering, and granular access policies. These are separate preview capabilities; the供
Security guidance: Tenant Restrictions v2 and Universal Tenant RestrictionsEntra ID; External ID; Global Secure Access
Related External ID and Global Secure Access documentation clarifies Tenant Restrictions v2 scope, Universal Tenant Restrictions behavior, the treatment of own-tenant versus cross-tenant authentication, and migration from v1. This is policy and implementation guidance, not evidence of new enforcement, a mandatory migration, or a migration deadline.
Certificate-based authentication: tolerance for missing CRL endpoints is documentedEntra ID
The 26 May weekly brief characterizes an Entra certificate-based authentication update as a substantive behavior change and says the documentation records tolerance for missing CRL endpoints. CBA administrators should revisit their assumptions about certificate validation and CRL endpoint availability, but the supplied evidence gives no broader rollout date, GA announcement, forced migration, or retirement.

For Entra administrators

Power Automate teams using hosted machine groups should track the stated 31 May GA date. The Defender for Identity notice says no action is required before rollout, while recommending sensor installation for monitoring and threat detection. Security teams can assess the linkable-identifier and TLS-inspection previews, but the evidence supplies no GA, tenant-wide rollout, prerequisite, or enablement instruction. Tenant Restrictions administrators should review their v1/v2 posture and own- versus cross-tenant behavior; no mandatory migration or enforcement change is established. CBA owners should revisit assumptions about missing CRL endpoints. Do not infer retirement from the unexplained removals or a product launch from the new Learn pages.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

5804 updates by product

F5 Big Ip Forms Advanced

Updated

A Microsoft Entra documentation page was updated: F5 Big Ip Forms Advanced.

28 May 2025

F5 Big Ip Header Advanced

Updated

28 May 2025

F5 Big Ip Headers Easy Button

Updated

A Microsoft Entra documentation page was updated: F5 Big Ip Headers Easy Button.

28 May 2025

F5 Big Ip Kerberos Advanced

Updated

28 May 2025

F5 Big Ip Kerberos Easy Button

Updated

28 May 2025

F5 Big Ip Sap Erp Easy Button

Updated

A Microsoft Entra documentation page was updated: F5 Big Ip Sap Erp Easy Button.

28 May 2025

28 May 2025

Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Directory Services so that I…

Updated

28 May 2025

Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Directory Services so that I…

Updated

28 May 2025

Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Directory Services so that I…

Updated

28 May 2025

Updated

1. Authenticate with a certificate that has policy OID of 3.4.5.6 and Issued by CN=CBATestRootProd. Authentication should pass and get a multifactor claim.

10 May 2025

Microsoft Defender XDR services: Deploy the New Defender for Identity sensor on Microsoft Entra Connect servers

New

Updated

3 May 2025

Jitbit Helpdesk Tutorial

Updated

![Authentication settings](./media/jitbit-helpdesk-tutorial/authentication.png "Authentication settings")

3 May 2025

Application Proxy Configure Single Sign On Password Vaulting

Updated

1. Select **application proxy**.

3 May 2025

Agent Optimization

Updated

- During the preview, avoid using an account to set up the agent that requires role activation with Privileged Identity Management. Using an account that doesn't have standing permissions might cause authentication failures for the agent.

2 May 2025

Power Automate – Configure Entra hybrid join for hosted machine groups

New

We are announcing the ability to configure Entra hybrid join for hosted machine groups in Power Automate. This feature will reach general availability on May 31, 2025.

2 May 2025

Message CenterMC1066093 on mc.merill.net ↗Stay informed

Howto Authentication Passwordless Security Key On Premises

Updated

$cloudCred = Get-Credential -Message 'An Active Directory user who is a member of the Hybrid Identity Administrators group for Microsoft Entra ID.'

1 May 2025

Tutorial Native Authentication Prepare Android App

Updated

//...

1 May 2025

Howto Password Smart Lockout

Updated

author: justinha

1 May 2025

Howto Mfa Nps Extension

Updated

Open PowerShell and run the following command. Replace the fictitious app ID with the correct ID.

28 May 2025

Updated

ai-usage: ai-assisted

3 May 2025

Updated

Updated

Provide the credentials for an Application Administrator in your Microsoft Entra directory. The Microsoft Entra Application Administrator credentials are often different from your Azure credentials in the portal.

3 May 2025

Migrate Approved Client App

Updated

Updated

2 May 2025

Plan a single sign-on deployment

Updated

Updated

Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, and walk through the SSO configuration as well. [Learn more about Microsoft 365 wizards](/microsoft-365/admin/misc/azure-ad-setup-guides).

17 May 2025

Quickstart Configure App Expose Web Apis

Updated

author: cilwerner

15 May 2025

Updated

A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I want to learn how to troubleshoot sign-up errors for various scenarios and using different tools so that I can resolve sign-up issues quickly..

2 May 2025

Troubleshoot Macos Platform Single Sign On Extension

Updated

Updated

The scenario outlined in this article assumes that you already have the following prerequisites:

22 May 2025

Smart Global Governance Tutorial

Updated

The scenario outlined in this article assumes that you already have the following prerequisites:

22 May 2025

Groups Lifecycle

Updated

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Groups Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).

15 May 2025

Integrate Darwinbox HR With Microsoft Entra ID

Updated

Learn how to integrate Darwinbox HR with Microsoft Entra ID to automate user provisioning, manage lifecycle workflows, and streamline HR-driven processes.

14 May 2025

Integrate Darwinbox HR With Microsoft Entra ID

New

Learn how to integrate Darwinbox HR with Microsoft Entra ID to automate user provisioning, manage lifecycle workflows, and streamline HR-driven processes.

9 May 2025

Branding

Customize Branding

Updated

Once your default sign-in experience is created, select the **Edit** button to make any changes. You can't delete a default sign-in experience after it's created, but you can remove all custom settings.

29 May 2025

CSS template reference guide

Updated

Reference guide for the CSS template selectors for customizing Microsoft Entra sign-in page company branding.

28 May 2025

Howto Add Branding In Apps

Updated

A Microsoft Entra documentation page was updated: Howto Add Branding In Apps.

28 May 2025

Configure Custom Domain

Updated

- You can control your branding and create the URLs you want. A custom domain can help build your users' confidence, because users see and use a familiar name instead of *`msappproxy.net`*.

4 May 2025

Conditional Access

V2 Conditional Access Dev Guide

Updated

A Microsoft Entra documentation page was updated: V2 Conditional Access Dev Guide.

24 May 2025

Conditional Access Admin Roles

Updated

- Global Administrator

23 May 2025

Plan Conditional Access

Updated

**Ensure that every app has at least one Conditional Access policy applied**. From a security perspective it's better to [create a policy that encompasses **All resources (formerly 'All cloud apps')**](policy-all-users-mfa-strength.md). This practice ensures you don't need to update Conditional Access policies every time you onboard a new application.

22 May 2025

Managed Policies

Updated

Administrators with at least the [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator) role assigned find these policies in the [Microsoft Entra admin center](https://entra.microsoft.com) under **Protection** > **Conditional Access** > **Policies**.

7 May 2025

Microsoft Entra ID Protection

A Microsoft Entra documentation page was updated: Identity Protection Risks.

4 May 2025

Identity Protection

Updated

Check Status Workflow

Updated

A Microsoft Entra documentation page was updated: Check Status Workflow.

28 May 2025

4 May 2025

Updated

Updated

In entitlement management, approvers for access package requests can either be directly assigned, or determined dynamically. While entitlement management natively supports dynamic approvers such as the requestor's manager, second-level manager, or sponsor from a connected organization, these options don't cover all scenarios. With [custom extensions](entitlement-management-logic-apps-integration.md) calling out to [Azure Logic Apps](/azure/logic-apps/logic-apps-overview), you're able to determine approval requirements for access packages at the time of request through an external system. With this external call, you're able to determine approval requirements based on each of the [ApprovalStage properties](/graph/api/resources/approvalstage?view=graph-rest-beta#properties). This article walks you through making a custom extension, its underlying Azure Logic App, setting its system-assigned identity and role in the catalog, editing the logic app action to perform business logic, and testing to see if it runs successfully.

2 May 2025

Architecture

Pim Deployment Plan

Updated

* **Groups**- Anyone in a group to get just-in-time access to Microsoft Entra roles and Azure roles. For Microsoft Entra roles, the group must be a newly created cloud group that’s marked as assignable to a role while for Azure roles, the group can be any Microsoft Entra security group. We don't recommend assigning/nesting a group to a PIM for Groups.

2 May 2025

Set up trust between a user-assigned managed identity and an external identity provider to access Microsoft Entra resources without secrets or certificates.

23 May 2025

Active Directory B2c End Of Sale Notice

Updated

> [!IMPORTANT]

21 May 2025

Updated

17 May 2025

Whats New Docs

Removed

A Microsoft Entra documentation page was updated: Whats New Docs.

17 May 2025

Updated

21 May 2025

Mfa Licensing

Updated

Microsoft Entra multifactor authentication can be used, and licensed, in a few different ways depending on your organization's needs. All tenants are entitled to basic multifactor authentication features by using security defaults. You may already be entitled to use advanced Microsoft Entra multifactor authentication depending on the license you currently have. For example, the first 50,000 monthly active users in Microsoft Entra External ID can use MFA and other Premium P1 or P2 features for free.

20 May 2025

Cross Tenant Synchronization Overview

Updated

The following table lists the required licenses depending on your scenario.

18 May 2025

Supported Features Customers

Updated

16 May 2025

Supported Features Customers

Updated

15 May 2025

Authentication Methods Customers

Updated

9 May 2025

B2b Fundamentals

Updated

author: csmulligan

9 May 2025

Supported Features Customers

Updated

9 May 2025

Provisioning

Cross Tenant Synchronization Configure

Updated

A Microsoft Entra documentation page was updated: Cross Tenant Synchronization Configure.

28 May 2025

Cross Tenant Synchronization Configure

Updated

It can take up to 15 seconds for the configuration that you just created to appear in the list.

19 May 2025

Cross Tenant Synchronization Configure

Updated

:::image type="content" source="./media/cross-tenant-synchronization-configure/access-settings-cross-cloud-sync.png" alt-text="Screenshot of Microsoft cloud settings that shows check box to enable cross-cloud synchronization." lightbox="./media/cross-tenant-synchronization-configure/access-settings-cross-cloud-sync.png":::

18 May 2025

Cross Tenant Synchronization Configure

Updated

17 May 2025

Cross Tenant Synchronization Configure

Updated

When you select this check box, it grants an underlying service principal the following permissions:

16 May 2025

Cross Tenant Synchronization Configure

Updated

::: zone-end

6 May 2025

Include file

New

Include file

3 May 2025

Cross Tenant Synchronization Configure

Updated

Customize Branding

Updated

**The Azure Active Directory B2C (Azure AD B2C) company branding options are different.** Azure AD B2C branding is currently limited to background image, banner logo, and background color customization. For more information, see [Customize the UI](/azure/active-directory-b2c/customize-ui?pivots=b2c-user-flow#configure-company-branding.md) in the Azure AD B2C documentation.

22 May 2025

Whats New

Updated

This feature also includes domain-based federation, so a user who enters an email address on the sign-in page that matches a predefined domain in any of the external identity providers will be redirected to authenticate with that identity provider.

18 May 2025

Whats New

Updated

16 May 2025

Troubleshooting

Troubleshoot Alerts

Updated

*Microsoft Entra Domain Services cannot be enabled in an Azure AD B2C Directory.*

23 May 2025

Known issues in external tenants

Updated

Learn about known issues in external tenants.

22 May 2025

Monitoring

Set up Azure Monitor in external tenants (preview)

Updated

A Microsoft Entra documentation page was updated: Set up Azure Monitor in external tenants (preview).

28 May 2025

Microsoft Entra Internet Access

22 May 2025

Fundamentals

What Is Global Secure Access

Updated

Microsoft Entra Internet Access protects access to internet and SaaS apps with an identity-based Secure Web Gateway (SWG), blocking threats, unsafe content, and malicious traffic.

2 May 2025

Security

Configure Transport Layer Security inspection (Preview)

Updated

Transport Layer Security (TLS) inspection in Microsoft Entra Internet Access enables decryption and inspection of encrypted traffic at service edge locations. This capability lets Global Secure Access apply advanced security controls like threat detection, content filtering, and granular access policies. Organizations use these access policies to protect against threats that might be hidden in encrypted communications.

24 May 2025

Microsoft Entra Private Access

- The connector now supports routing outbound traffic to destination in GSA Private Access through a forward proxy, enhancing network control.

21 May 2025

Security

Use SSH to administer servers with Microsoft Entra Private Access

Updated

Learn to configure and establish a Secure Shell (SSH) connection using Microsoft Entra Private Access for enhanced security.

18 May 2025

Configure Global Access With Pim

Updated

For the scenario where you need to control access to specific *critical* resources, such as highly valued servers and applications, Microsoft recommends that you add an extra security layer by enforcing just-in-time privileged access on top of their already secured private access.

17 May 2025

Management for SSH-based server administration

New

Learn to configure and establish a Secure Shell (SSH) connection using Microsoft Entra Private Access for enhanced security.

2 May 2025

Conditional Access

Apply Conditional Access policies to Private Access apps

Updated

manager: femila

28 May 2025

Developer

How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy

Updated

ai-usage: ai-assisted

28 May 2025

Microsoft Entra Verified ID

manager: femila

2 May 2025

Customer intent: As an enterprise, we want to enable customers to manage information about themselves by using verifiable credentials.

Updated

Updated

author: barclayn

2 May 2025

Microsoft identity platform

Customer intent: As a developer I am looking for information on how to enable my users to control their own information

Updated

A Microsoft Entra documentation page was updated: Customer intent: As a developer I am looking for information on how to enable my users to control their own information .

28 May 2025

Customer intent: As a developer, I want to build a custom wallet using Microsoft Entra Verified ID Wallet Library.

23 May 2025

Workload Identity Federation

manager: martinco

14 May 2025

Enable Multi Geo

Updated

29 May 2025

Gsa Deployment Guide Microsoft Traffic

Updated

|Use case|Recommended configuration|

24 May 2025

Gsa Deployment Guide Microsoft Traffic

Updated

|Use case|Recommended configuration|

22 May 2025

4 updates

Fundamentals

Microsoft Entra Recommendations with Microsoft Security Copilot

New

Use Microsoft Security Copilot and Microsoft Entra skills to quickly investigate how to evolve your tenant to a secure and healthy state.

31 May 2025

Customer intent: As a security administrator, I want to learn how to use Microsoft Security Copilot to investigate recommendations in Microsoft Entra…

Updated

> [!NOTE]

31 May 2025

Authentication

Agent Optimization

Updated

- For the initial agent enablement/setup, you will need to be either a [Security Administrator](../role-based-access-control/permissions-reference.md#security-administrator) or [Global Administrator](../role-based-access-control/permissions-reference.md#global-administrator) role during the preview. These roles also have [access to Security Copilot by default](/copilot/security/authentication). After setup, you can assign Conditional Access Administrators with Security Copilot access. This will give your Conditional Access Administrators the ability to use the agent as well.

10 May 2025

Security

Require phishing-resistant MFA for Microsoft Security Copilot access

New

17 May 2025