June 2025 — Entra.News Daily

June's 3,775 records break down into 3,603 updates, 145 new entries, 24 removals, and three Message Center notices. The evidence is therefore overwhelmingly Microsoft Learn maintenance rather than a broad Entra launch narrative. The clearest operational signals are Workload ID's service-principal-less authentication retirement with a 31 March 2026 deadline, two separate Microsoft Entra B2B behavior changes in July, and the 15 August Access Reviews history cutoff. Security Copilot's Conditional Access optimization-agent material also expanded, but no Preview or GA status is supplied for the agent. Much of the remaining movement—new authentication-role pages and certificate-based authentication and Conditional Access edits—is reference or security guidance rather than proof of new roles, permission changes, or tenant-wide behavior. One updated certificate-authority article labels a PKI-based trust store Preview, but no scope or availability date is supplied; the 24 removals are not itemized and do not establish additional product retirements.

Retirement: Workload ID service-principal-less authenticationMicrosoft Entra Workload ID
The updated guidance describes a security-by-default retirement: a client service principal will be required for all applications, and action is required before 31 March 2026 to avoid application authentication failures. This is a retirement and changed authentication dependency, not evidence of a June enforcement event; the supplied material provides no migration steps.
Changed behavior: SharePoint and OneDrive B2B integration affects earlier OTP sharesMicrosoft Entra External ID / B2B
The 27 June Message Center notice says that effective 1 July 2025, external users will lose access to content shared through SharePoint One Time Passcode before SharePoint and OneDrive integration with Microsoft Entra B2B was enabled. Resharing is required to restore access for affected shares.
Phased behavior change: B2B guests move to their home-organization sign-in pageMicrosoft Entra ID / B2B collaboration
Microsoft says the guest authentication change starts in July 2025 and completes by December 2025. Guests will use their home organization's sign-in page. The notice says no administrative action is required and recommends reviewing B2B configuration; it does not present the change as a Preview or GA launch.
Retention change: Access Reviews history limited to 12 months through UI and APIsMicrosoft Entra ID Governance / Access Reviews
Beginning 15 August 2025, only the most recent 12 months of Microsoft Entra Access Reviews data will be available through the user interface and APIs. The notice calls for exporting historical data beforehand and establishing annual storage; it describes a history-availability policy change, not a change to the review workflow.
Guidance expansion: Conditional Access optimization agent with Security CopilotMicrosoft Security Copilot / Microsoft Entra Conditional Access
New troubleshooting material and an updated agent article describe an agent that recommends Conditional Access policies and changes aligned with best practices. The supplied record gives no Preview or GA status. For adopters, the related guidance calls out the Microsoft Entra ID P1 requirement for the review-suggestions workflow and covers possible MFA policy changes, metrics, and audit events.

For Entra administrators

Inventory Microsoft Entra Workload ID applications that use service-principal-less authentication and plan remediation before 31 March 2026; the supplied evidence does not include migration steps. For tenants that have enabled or will enable SharePoint and OneDrive integration with Microsoft Entra B2B, identify pre-integration SharePoint OTP shares, reshare the content, notify affected external users, and update internal guidance. Export historical Access Reviews data before 15 August 2025 and establish an annual storage routine. The B2B guest sign-in change itself requires no administrative action according to the notice, although it advises reviewing B2B configuration. Teams using or evaluating the Conditional Access optimization agent should consult the updated guidance for the stated P

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

3775 updates by product

New

Password Administrator

26 June 2025

Updated

19 June 2025

175

Whats New

Updated

**Service category:** Provisioning

30 June 2025

author: MicrosoftGuyJFlo

5 June 2025

Updated

4 June 2025

Troubleshoot inaccessible tenants

Updated

Instructions about how to unblock a tenant.

4 June 2025

Try Microsoft Entra Suite

Updated

Make the most of your Microsoft Entra Suite trial. Try out some of the

4 June 2025

What is Microsoft Entra ID?

Updated

Learn about Microsoft Entra ID, including terminology, available licenses, and a list of associated features.

4 June 2025

Customer intent: As a Microsoft Entra administrator, I want guidance to so that I can keep my Microsoft Entra tenant in a healthy state.

Updated

All these Microsoft Entra recommendations provide you with personalized insights with actionable guidance to:

Updated

You can download the latest version from the [Microsoft Entra Admin Center](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) under **Manage**.

New

role

26 June 2025

Updated

This article shows the new and updated documentation for the Microsoft Entra application management.

4 June 2025

Use a group to manage access to SaaS apps

Updated

Updated

19 June 2025

Error Codes

Updated

| AADSTS50139 | SessionMissingMsaOAuth2RefreshToken - The session is invalid due to a missing external refresh token. |

19 June 2025

category: Application management

Updated

If privileged role activations aren't restricted to dedicated Privileged Access Workstations (PAWs), threat actors can exploit compromised endpoint devices to perform privileged escalation attacks from unmanaged or noncompliant workstations. Standard productivity workstations often contain attack vectors such as unrestricted web browsing, email clients vulnerable to phishing, and locally installed applications with potential vulnerabilities. When administrators activated privileged roles from these workstations, threat actors who gain initial access through malware, browser exploits, or social engineering can then use the locally cached privileged credentials or hijack existing authenticated sessions to escalate their privileges. Privileged role activations grant extensive administrative rights across Microsoft Entra ID and connected services, so attackers can create new administrative accounts, modify security policies, access sensitive data across all organizational resources, and deploy malware or backdoors throughout the environment to establish persistent access. This lateral movement from a compromised endpoint to privileged cloud resources represents a critical attack path that bypasses many traditional security controls. The privileged access appears legitimate when originating from an authenticated administrator's session.

15 June 2025

Github Enterprise Managed User Ghe Com Tutorial

Updated

To configure single sign-on on **GitHub Enterprise Managed User** side, you can follow the documentation for [configuring your Identity Provider in the GitHub documentation](https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users#configure-your-enterprise).

15 June 2025

Updated

Updated

The following table is a list of events that are logged with the new auditing feature. To view the events, use the Event Viewer and view the Application log.

26 June 2025

Global Reader

Updated

This is a [privileged role](../privileged-roles-permissions.md). Users in this role can read settings and administrative information across Microsoft 365 services but can't take management actions. Global Reader is the read-only counterpart to Global Administrator. Assign Global Reader instead of Global Administrator for planning, audits, or investigations. Use Global Reader in combination with other limited admin roles like Exchange Administrator to make it easier to get work done without the assigning the Global Administrator role. Global Reader works with Microsoft 365 admin center, Exchange admin center, SharePoint admin center, Teams admin center, Microsoft 365 Defender portal, Microsoft Purview compliance portal, Azure portal, and Device Management admin center.

26 June 2025

Updated

1. After joining your Windows 10 or newer PC to a domain that is configured to allow Enterprise State Roaming, sign on with your work account. Go to **Settings** > **Accounts** > **Sync Your Settings** and confirm that sync and the individual settings are on, and that the top of the settings page indicates that you're syncing with your work account. Confirm the same account is also used as your account in **Settings** > **Accounts** > **Your Info**.

4 June 2025

Groups Troubleshooting

Updated

Updated

This is a [privileged role](../privileged-roles-permissions.md). Users in this role can create application registrations when the "Users can register applications" setting is set to No. This role also grants permission to consent on one's own behalf when the "Users can consent to apps accessing company data on their behalf" setting is set to No. Users assigned to this role are added as owners when creating new application registrations.

26 June 2025

Microsoft Entra ID access reviews: Updated historical data retention policy for access reviews

Configure multitenant organization policy templates using Microsoft Graph API

Updated

Learn how to configure multitenant organization policy templates in Microsoft Entra ID using the Microsoft Graph API.

6 June 2025

Architecture

Customize Branding

Updated

The default background image behind the sign-in box is changing later this year. The change is only to the image, requires no action, and doesn't affect any functionality. We know that the default background image is often used for training and documentation to demonstrate the sign-in experience. Providing the updated image allows you to update your documentation so you can demonstrate the exact sign-in experience that your users will see. For details on the upcoming change, see [Microsoft Entra releases and announcements](../fundamentals/whats-new.md).

28 June 2025

Organizational Branding Administrator

Updated

A Microsoft Entra documentation page was updated: Organizational Branding Administrator.

28 June 2025

Microsoft Entra ID: Change in guest authentication experience for B2B collaboration

New

Microsoft Entra ID will update the guest authentication experience for B2B collaboration starting July 2025, completing by December 2025. Guest users will sign in via their home organization’s sign-in page, enhancing usability and reducing confusion. No administrative action is required, but review your B2B configuration.

26 June 2025

Message CenterMC1103608 on mc.merill.net ↗Major updatePlan for change

role

New

role

26 June 2025

Customize Branding

Updated

26 June 2025

Organizational Branding Administrator

Updated

A Microsoft Entra documentation page was updated: Organizational Branding Administrator.

26 June 2025

Microsoft Entra ID Protection

author: justinha

8 June 2025

Security

Security Operator

Updated

This is a [privileged role](../privileged-roles-permissions.md). Users with this role can manage alerts and have global read-only access on security-related features, including all information in Microsoft 365 Defender portal, Microsoft Entra ID Protection, Privileged Identity Management and Microsoft Purview compliance portal. For more information about Office 365 permissions, see [Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance](/microsoft-365/security/office-365-security/scc-permissions).

26 June 2025

ID Protection notifications are enabled

Updated

author: HULKsmashGithub

20 June 2025

ID Protection Notifications Are Enabled

Updated

author: HULKsmashGithub

12 June 2025

Monitoring

Updated

author: csmulligan

8 June 2025

B2b Quickstart Add Guest Users Portal

Updated

Use this quickstart to learn how Microsoft Entra admins can add B2B guest users in the Microsoft Entra admin center and walk through the B2B invitation workflow.

8 June 2025

8 June 2025

Updated

8 June 2025

author: csmulligan

8 June 2025

User Flow Add Custom Attributes

Updated

8 June 2025

Updated

13 June 2025

Security Features in External Tenants

Updated

Learn about security features and fundamentals for Microsoft Entra External ID customer identity and access management (CIAM) in external tenant configurations.

11 June 2025

Add Member To Group

Updated

Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.yml#create-a-basic-group-and-add-members).

8 June 2025

Updated

8 June 2025

Native Authentication

Updated

Learn how to set up native authentication in Microsoft Entra External ID. Customize the user interface for mobile and desktop apps, and provide a seamless sign-in experience.

8 June 2025

Add Api Mfa Scopes

Updated

An API needs to publish a minimum of one scope, also called [Delegated Permission](~/identity-platform/permissions-consent-overview.md), for the client apps to obtain an access token for a user successfully. To publish a scope, follow these steps:

8 June 2025

Updated

8 June 2025

Customer intent: As an IT admin managing collaboration between organizations, I want to configure B2B direct connect settings, so that I can control…

Updated

author: csmulligan

8 June 2025

Customer intent: As an IT admin managing cross-tenant access settings, I want to configure B2B collaboration and B2B direct connect with external org…

Updated

author: csmulligan

8 June 2025

8 June 2025

Updated

Updated

8 June 2025

Configure cross-tenant synchronization using PowerShell or Microsoft Graph API

Updated

A Microsoft Entra documentation page was updated: Configure cross-tenant synchronization using PowerShell or Microsoft Graph API.

6 June 2025

Provisioning

Cross Tenant Synchronization Configure

Updated

> Cross-cloud synchronization is currently in PREVIEW.

27 June 2025

Cross Tenant Synchronization Configure

Updated

This article describes the steps to configure cross-tenant synchronization between Microsoft clouds, such as Microsoft Azure commercial and Microsoft Azure Government, using the Microsoft Entra admin center. When configured, Microsoft Entra ID automatically provisions and de-provisions B2B users in your target tenant.

25 June 2025

Cross Tenant Synchronization Configure

Updated

22 June 2025

Configure cross-tenant synchronization

Updated

Learn how to configure cross-tenant synchronization in Microsoft Entra ID using the Microsoft Entra admin center.

6 June 2025

Enable accidental deletions prevention in the Microsoft Entra provisioning service

Updated

Enable accidental deletions prevention in the Microsoft Entra provisioning service for applications and cross-tenant synchronization.

6 June 2025

Map directory extensions in cross-tenant synchronization

Updated

Learn how to map directory extensions in cross-tenant synchronization using the Microsoft Entra admin center.

6 June 2025

Topologies for cross-tenant synchronization

Updated

Faq Customers

Updated

Effective May 1, 2025 Azure AD B2C P1 and P2 will no longer be available to purchase for new customers, but current Azure AD B2C customers can continue using the product. The product experience, including creating new tenants or user flows, remains unchanged. The operational commitments, including service level agreements (SLAs), security updates, and compliance, also remain unchanged. We'll continue supporting Azure AD B2C until at least May 2030. More information, including migration plans will be made available. Contact your account representative for more information and to learn more about Microsoft Entra External ID.

19 June 2025

category: Application management

Updated

When guest users are assigned highly privileged directory roles such as Global Administrator or Privileged Role Administrator, organizations create significant security vulnerabilities that threat actors can exploit for initial access through compromised external accounts or business partner environments. Since guest users originate from external organizations without direct control of security policies, threat actors who compromise these external identities can gain privileged access to the target organization's Microsoft Entra tenant.

15 June 2025

Branding

Customize the company branding

Updated

Learn how to customize the sign-in and sign-up experiences for your customers.

8 June 2025

Customize your branding for your customers

Updated

Learn how to customize the look and feel of your customers' sign-in experiences.

8 June 2025

Troubleshooting

Resharing to external users required after enabling Microsoft SharePoint integration with Microsoft Entra B2B

New

Effective July 1, 2025, external users will lose access to content shared via SharePoint One Time Passcode (OTP) before enabling Microsoft SharePoint and OneDrive integration with Microsoft Entra B2B. Resharing is required to restore access. Notify users and update internal documentation accordingly.

27 June 2025

Message CenterMC1089315 on mc.merill.net ↗Major updatePlan for change

Troubleshooting Known Issues

Updated

8 June 2025

Microsoft Entra Internet Access

Global Secure Access points of presence and IP addresses for Microsoft Entra Internet Access and Microsoft Entra Private Access.

6 June 2025

Fundamentals

Add Intune device compliance bypasses to Global Secure Access Internet Access

Updated

The [Universal Conditional Access documentation](/entra/global-secure-access/concept-universal-conditional-access#known-tunnel-authorization-limitations) notes that Global Secure Access has tunnel authorization limitations. This means that you can block access to a forwarding profile in Conditional Access and inadvertently lock users out from accessing anything on their machine.

11 June 2025

Clients

Updated

Learn about the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.

6 June 2025

Internet Access

Updated

Learn about how Microsoft Entra Internet Access secures access to the Internet.

6 June 2025

Conditional Access

PowerShell sample - Disable traffic forwarding and disable Conditional Access policies using the compliant network condition in a break glass scenario

Updated

PowerShell examples for use in a Microsoft Entra Internet Access break glass scenario.

6 June 2025

Monitoring

Event Enrichment Logs

Updated

Global Secure Access includes Microsoft Entra Private Access and Microsoft Entra Internet Access. This article references event enrichment in Microsoft 365 enriched logs.

6 June 2025

Security

Security Service Edge (SSE) Coexistence With Microsoft and Netskope

New

Learn how to configure and deploy Microsoft Entra and Netskope Security Service Edge (SSE) solutions together for optimized security and connectivity across private applications, Microsoft 365, and internet access.

11 June 2025

Microsoft Entra Private Access

14 updates

General

6 June 2025

Connectors

Updated

Learn how Microsoft Entra private network connectors work and how they're used by Microsoft Entra Private Access and application proxy.

6 June 2025

Private Access

Updated

Learn about how Microsoft Entra Private Access secures access to your private corporate resources through the creation of Quick Access and Global Secure Access apps.

6 June 2025

Developer

Configure Quick Access

Updated

Configuring your Quick Access settings is a major component to utilizing Microsoft Entra Private Access. When you configure Quick Access for the first time, Private Access creates a new enterprise application. The properties of this new app are automatically configured to work with Private Access.

16 June 2025

Configure Per App Access

Updated

Learn how to configure per-app access to your private, internal resources using Global Secure Access applications for Microsoft Entra Private Access.

6 June 2025

Microsoft Entra Verified ID

21 June 2025

Microsoft Entra Verified ID Identity Verification partners

Updated

Our Identity Verification (IDV) partner network extends Microsoft Entra Verified ID capabilities to help you build seamless end-user experiences. With Verified ID, you can integrate with IDV partners to enable scenarios like remote onboarding with government ID checks using identity verification and proofing services.

4 June 2025

Developer

Issuance Request Api

Updated

Authorization: Bearer <token>

21 June 2025

Presentation Request Api

Updated

Authorization: Bearer <token>

21 June 2025

Get Started Request Api

Updated

Issuance request using the `idTokenHint` attestation flow:

21 June 2025

Vc Network Api

Updated

21 June 2025

Services Partners

Updated

You could select a partner from the list and build seamless end-user experiences for onboarding, secure access to critical services, self-service, and custom business application scenarios. If you're a Services or solution Partner and would like to be considered into Microsoft Entra Verified ID partner documentation, submit your application [request](https://forms.microsoft.com/r/AGVsXmf4EZ).

21 June 2025

Whats New

Updated

Applications that use the Microsoft Entra Verified ID service must use the Request API endpoint that corresponds to their Microsoft Entra tenant's region.

21 June 2025

Fundamentals

Decentralized Identifier Overview

Updated

manager: femila

27 June 2025

Decentralized Identifier Overview

Updated

In order to be able to resolve DID documents, DIDs are typically recorded on an underlying network of some kind that represents a trust system. Microsoft currently supports DID:Web trust system. DID:Web is a permission based model that allows trust using a web domain’s existing reputation. DID:Web is in support status General Available.

21 June 2025

Dnsbind

Updated

The domain you verify ownership of to your DID is defined in the [overview section](verifiable-credentials-configure-tenant.md#set-up-verified-id). The domain needs to be a domain under your control and it should be in the format `https://www.example.com/`.

21 June 2025

Entra Admin Center

Updated

* [Credentials](~/verified-id/verifiable-credentials-configure-tenant-quick.md)

6 June 2025

Authentication

Using the Microsoft Authenticator with Verified ID

Updated

In this tutorial, you learn how to install the **Microsoft Authenticator** app and use it for the first time with Verified ID. You use the public end to end demo webapp to issue a verifiable credential to the **Authenticator** and present verifiable credentials from the **Authenticator**.

21 June 2025

Plan Verification Solution

Updated

:::image type="content" source="media/plan-verification-solution/plan-verification-solution-authenticator.png" alt-text="Diagram of the components of a verification solution with Microsoft Authenticator application highlighted.":::

21 June 2025

Verified helpdesk with Microsoft Entra Verified ID

Updated

An ongoing challenge for helpdesk is verifying the identity of callers seeking help, especially in remote interactions via phone, chat, or email. Traditional methods such as personally identifiable information (PII) and knowledge-based authentication are no match for today’s sophisticated attackers, who use phishing, social engineering, and even AI-powered voice cloning to bypass defenses. The consequences are serious: under pressure, helpdesk agents may unintentionally expose sensitive data or authorize fraudulent actions.

4 June 2025

Standards

Issuer Openid

Updated

To receive a verifiable credential, your users need to sign into your IDP from the **Microsoft Authenticator** app.

21 June 2025

Retire Service Principal Less Authentication

Updated

manager: CelesteDG

8 June 2025

Security

Attribute Assignment Administrator

Global Secure Access Web content filtering categories

6 June 2025

Zscaler Coexistence

Updated

Updated

Learn how to Create a remote network, apply Conditional Access, and review the logs in Global Secure Access.

6 June 2025

Developer

Version History

Updated

| Understand Microsoft Entra private network connectors | Find out more about [connector management](../identity/app-proxy/application-proxy-connectors.md) and how connectors [autoupgrade](../identity/app-proxy/application-proxy-connectors.md#automatic-updates). |

27 June 2025

Customer intent: As an administrator, I want to use Application discovery to detect the applications accessed by users and create separate private ap…

Updated

author: HULKsmashGithub

8 June 2025

Secure private application access with Privileged Identity Management (PIM) and Global Secure Access

Updated

Learn how to secure highly valued private application access with Privileged Identity Management (PIM) and Global Secure Access

6 June 2025

Security Copilot + Entra

11 updates

Fundamentals

7 June 2025

Troubleshooting Conditional Access policies and Security Copilot

New

ms.service: entra-id

6 June 2025

Troubleshoot Security Copilot Policies

Updated

- bb3d68c2-d09e-4455-94a0-e323996dbaa3 - Security Copilot API

6 June 2025

Conditional Access

Microsoft Entra Conditional Access optimization agent with Microsoft Security Copilot

Updated

The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings.

6 June 2025

Microsoft identity platform

Copilot Entra Security Scenarios

Updated

Microsoft Entra Health provides look-back reporting on Service Level Agreements (SLA) for authentication availability for your Microsoft Entra tenant. The SLA Attainment is a monthly look-back solution that shows the core authentication availability of Microsoft Entra ID each month. IT admins often need to review the SLA reports in conjuntion with service outages. Security Copilot interacts with the Microsoft Entra SLA using the Microsoft Graph API.

8 June 2025

Security

Policy All Users Security Copilot

Removed

A Microsoft Entra documentation page was updated: Policy All Users Security Copilot.

7 June 2025