September 2025 — Entra.News Daily

September was primarily a Microsoft Learn maintenance month rather than a broad Entra launch cycle: 1,017 of 1,030 records were updates, with four new records, five removals, and four Message Center notices. The most consequential exceptions were the Azure DevOps Conditional Access targeting change, scheduled MFA enforcement for Azure resource management, a Microsoft Authenticator sign-in UX change, and the late-period cross-cloud synchronization notice. The specifically described new Global Secure Access pages were test-environment PowerShell samples for TLS certificates, not evidence of a product launch. The five removals also contain no detail that supports calling a capability retired. A separate Entra ID Free notice says the no-cost subscription will appear in portals for tenant-ownership tracking without changing billing or functionality.

Azure DevOps sign-ins moved off the Azure Resource Manager Conditional Access pathMicrosoft Entra ID — Conditional Access
The Microsoft Entra notice said Conditional Access would stop being applied via Azure Resource Manager for Azure DevOps sign-ins starting 2 September, with full enforcement by 18 September. Policies must explicitly include the Azure DevOps application, App ID 499b84ac-1321-427f-aa17-267ca6975798. This is a changed targeting and enforcement behavior, not a feature launch.
Azure resource-management MFA enforcement is scheduled for 1 OctoberMicrosoft Entra MFA / Azure resource management
The Message Center notice says MFA will be enforced for all Azure resource-management actions from 1 October 2025, with a postponement option until July 2026. It calls out enabling MFA, updating Azure CLI and PowerShell, and using Azure Policy to assess impact. Gallatin customers are advised to implement MFA without enforcement. This is scheduled security enforcement, not an Entra feature release.
Microsoft Authenticator removes number entry for same-device confirmationsMicrosoft Authenticator / Microsoft Entra ID authentication
During the stated late-September-to-mid-October rollout, same-device sign-ins will require only a Yes/No confirmation instead of number entry. The first-run experience will also prioritize Microsoft Entra accounts and highlight QR-code scanning. The notice says no administrator action is required; this is a client UX behavior change rather than a change to Conditional Access semantics.
Cross-cloud synchronization is described as an opt-in public previewMicrosoft Entra cross-cloud synchronization
The week-of-29-September briefing describes a 3 October Message Center notice for Microsoft Entra cross-cloud synchronization, covering user lifecycle management across Microsoft commercial, US Government, and China clouds. The notice calls it public preview and opt-in while also listing general availability for late September to early October, so the supplied evidence does not support treating it as an unqualified GA release. The summary refers to licensing and administrator-enablement prerequisites but does not s
Security guidance and retirement-related documentation changed without confirming service retirementsEntra ID, ID Protection, Permissions Management, and Workload ID
Learn updates emphasize Conditional Access protection for MFA and self-service password-reset registration, controls for high-risk sign-ins, and blocking authentication transfer. Other guidance describes a dedicated first-party synchronization service principal for Entra Connect Sync, mitigation for retiring service-principal-less workload authentication, and offboarding for an anticipated Microsoft Entra Permissions Management deprecation. These are security, dependency, and planning signals; no retirement date,

For Entra administrators

Confirm that Conditional Access policies explicitly target the Azure DevOps application, and prepare users and automation for the 1 October Azure resource-management MFA requirement using the stated Azure CLI and PowerShell updates and Azure Policy assessment. The Authenticator and Entra ID Free notices state that no administrator action is required. Treat cross-cloud synchronization as opt-in public preview and verify the licensing and administrator-enablement prerequisites cited in the notice before considering it. For the Learn-only security and lifecycle material, review relevant Conditional Access, ID Protection, Entra Connect, and workload runbooks, but do not infer a broad policy rollout or a Permissions Management retirement date or replacement that the evidence does not provide.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

1030 updates by product

Reply Url

Updated

1. `http` URI schemes are acceptable because the redirect never leaves the device. As such, both of these URIs are acceptable:

10 September 2025

Github Enterprise Server Tutorial

Updated

* GitHub Enterprise Server supports **SP** and **IDP** initiated SSO.

5 September 2025

- Azure CLI

30 September 2025

What Is Cloud Sync

Updated

manager: mwongerapk

30 September 2025

New

Microsoft is rolling out the no-cost Microsoft Entra ID Free subscription to track Entra tenant ownership via billing accounts. It will appear in Microsoft 365 and Azure portals starting October, requires no action, does not affect billing or functionality, and helps manage tenant ownership securely.

20 September 2025

Message CenterMC1156361 on mc.merill.net ↗Stay informed

Mandatory Multifactor Authentication

Updated

18 September 2025

Activity Log Schemas

Updated

- `category`: Indicates which resource category that's targeted by the activity. For example: `UserManagement`, `GroupManagement`, `ApplicationManagement`, `RoleManagement`. For more information, see [Audit log activities](reference-audit-activities.md).

18 September 2025

Updated

- You must have at least the [Microsoft Entra ID P1](licensing.md) license for the Conditional Access optimization agent.

6 September 2025

Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins

New

Updated

author: MicrosoftGuyJFlo

3 September 2025

Governance

Connect Install Prerequisites

Updated

- Microsoft Entra Connect must be installed on a domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016. We recommend Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported versions of Windows Server may cause service failures or unexpected behavior.

30 September 2025

Governance Active Directory To Entra Cloud Sync

Updated

Use the following steps to configure and start the provisioning:

24 September 2025

Connect Install Prerequisites

Updated

- Microsoft Entra Connect must be installed on a domain-joined Windows Server 2016-2022. We recommend using domain-joined Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported Windows Server version may cause service failures or unexpected behavior.

20 September 2025

Microsoft identity platform

Accepted Token Versions

Authentication

21799

Updated

When high-risk sign-ins are not properly restricted through Conditional Access policies, organizations expose themselves to security vulnerabilities. Threat actors can exploit these gaps for initial access through compromised credentials, credential stuffing attacks, or anomalous sign-in patterns that Microsoft Entra ID Protection identifies as risky behaviors. Without appropriate restrictions, threat actors who successfully authenticate during high-risk scenarios can perform privilege escalation by misusing the authenticated session to access sensitive resources, modify security configurations, or conduct reconnaissance activities within the environment. Once threat actors establish access through uncontrolled high-risk sign-ins, they can achieve persistence by creating additional accounts, installing backdoors, or modifying authentication policies to maintain long-term access to the organization's resources. The unrestricted access enables threat actors to conduct lateral movement across systems and applications using the authenticated session, potentially accessing sensitive data stores, administrative interfaces, or critical business applications. Finally, threat actors achieve impact through data exfiltration, or compromise business-critical systems while maintaining plausible deniability by exploiting the fact that their risky authentication was not properly challenged or blocked.

9 September 2025

Agent Optimization

Updated

- **Risky users**: The agent suggests a policy to require secure password change for high risk users. Requires Microsoft Entra ID P2 license.

6 September 2025

Microsoft Entra ID Governance

11 updates

Governance

27 September 2025

Access Review Agent Logs Metrics

Updated

To view information about the Access Review Agent, open up the Access Review Agent to get to the overview page. The highlight of the overview page is the Agent summary, which provides a quick summary of agent actions over the course of the last 30 days.

6 September 2025

Microsoft Entra External ID

Tenant Restrictions V2

Updated

- Tenant restrictions v2 is supported on all clouds. However, tenant restrictions v2 is not enforced with cross-cloud requests.

16 September 2025

Tenant Restrictions V2

Updated

Google Federation Customers

Updated

By setting up federation with Google, you allow customers to sign in to your applications with their own Google accounts. After you add Google as one of your user flow's sign-in options, customers can sign up and sign in to your application with a Google account. (Learn more about [authentication methods and identity providers for customers](concept-authentication-methods-customers.md).)

17 September 2025

New

Microsoft will enforce multifactor authentication (MFA) for all Azure resource management actions starting October 1, 2025, with a postponement option until July 2026. Users must enable MFA, update Azure CLI/PowerShell, and can apply Azure Policy to assess impact. Gallatin customers are advised to implement MFA without enforcement.

6 September 2025

Message CenterMC1143999 on mc.merill.net ↗Stay informed

Branding

Facebook Federation Customers

Updated

By setting up federation with Facebook, you can allow customers to sign in to your applications with their own Facebook accounts. After you've added Facebook as one of your application's sign-in options, on the sign-in page, customers can sign-in to Microsoft Entra External ID with a Facebook account. (Learn more about [authentication methods and identity providers for customers](/entra/external-id/customers/concept-authentication-methods-customers).)

17 September 2025

Customize Branding Customers

Updated

After creating a new external tenant, you can customize the end-user experience. Create a custom look and feel for users signing in to your apps by configuring **Company branding** settings for your tenant. With these settings, you can add your own background images, colors, company logos, and text to customize the sign-in experiences across your apps.

17 September 2025

Developer

Add Attributes To Token

Updated

You can specify which built-in or custom attributes you want to include as claims in the token that Microsoft Entra ID sends to your application.

17 September 2025

10 updates

General

Workload Identities Faqs

Updated

26 September 2025

Use PowerShell to grant a managed identity access to a resource

Updated

Step-by-step instructions on using PowerShell to assign a managed identity access to an Azure resource or another resource.

11 September 2025

Manage User Assigned Managed Identities Azure Cli

Updated

Deleting a user-assigned managed identity won't remove the reference from any resource it was assigned to. Remove those from the resource itself. For example, for a VM or virtual machine scale set, use the `az vm/vmss identity remove` command.

11 September 2025

Assign App Role Managed Identity

Removed

A Microsoft Entra documentation page was updated: Assign App Role Managed Identity.

11 September 2025

How Manage User Assigned Managed Identities

Removed

A Microsoft Entra documentation page was updated: How Manage User Assigned Managed Identities.

11 September 2025

Fundamentals

Conditional Access Setup: Users, Groups, and Workload Identities

Updated

Learn how to include or exclude users, groups, and workload identities in Conditional Access policies for secure and flexible access management.

24 September 2025

Assign App Role Managed Identity Azure Cli

Updated

- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](./overview.md).

11 September 2025

Assign App Role Managed Identity Powershell

Updated

- If you're unfamiliar with managed identities for Azure resources, see [Managed identity for Azure resources overview](./overview.md).

11 September 2025

Grant Managed Identity Resource Access Azure Portal

Updated

The steps outlined below show how you grant access to a service using Azure RBAC. Check specific service documentation on how to grant access; for example, check [Azure Data Explorer](/azure/data-explorer/data-explorer-overview) for instructions. Some Azure services are in the process of adopting Azure RBAC on the data plane.

11 September 2025

Provisioning

Hardening update to Microsoft Entra Connect Sync

Updated

As part of increasing the security posture of Microsoft Entra Connect, Microsoft deployed a dedicated first-party application to enable the synchronization between Active Directory and Microsoft Entra ID. This new application will manifest as a first party service principal called the "Microsoft Entra AD Synchronization Service" (Application Id: `6bf85cfa-ac8a-4be5-b5de-425a0d0dc016`) and will be visible in the Enterprise Applications experience within the Microsoft Entra admin center. This application is critical for the continued operation of on-premises to Microsoft Entra ID synchronization functionality through Entra Connect.

26 September 2025

Microsoft Entra Global Secure Access

The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.

3 September 2025

Customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for iOS devices.

Updated

Configure Threat Intelligence

Updated

Since threat intelligence is critical for users' basic security posture, you can alternatively link your threat intelligence policy to the baseline security profile, which applies policy to all users' traffic in your tenant.

24 September 2025

Netskope Coexistence

Updated

1. Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.

24 September 2025

PowerShell Sample - Create a TLS Certificate Using OpenSSL

New

Use this PowerShell script to generate and sign Transport Layer Security (TLS) certificates using OpenSSL in a test environment.

20 September 2025

Integrate Global Secure Access with Microsoft Sentinel

Updated

Strengthen your organization's security posture by integrating Global Secure Access with Microsoft Sentinel using preconfigured workbooks and analytics rules.

9 September 2025