October 2025 — Entra.News Daily

October’s clearest operational changes are a dated retirement and an access-enforcement rollout. Microsoft Entra Privileged Identity Management (PIM) Iteration 2 beta APIs are scheduled for retirement on 28 October 2026, while Microsoft Purview is applying Entra Conditional Access compliance to eDiscovery administrators’ SharePoint access through November 2025. Cross-cloud synchronization and Teams group-chat authentication also have staged availability signals, but neither should be summarized more broadly than the supplied notices support. The cross-cloud notice calls the capability public preview and opt-in while also listing general availability for late September to early October 2025; the Teams notice schedules default-on support for 3–6 November.

PIM Iteration 2 beta APIs are on a dated retirement pathMicrosoft Entra ID Governance — Privileged Identity Management
The 29 October Message Center notice says Microsoft Entra PIM Iteration 2 beta APIs will be retired on 28 October 2026 and that applications using them will fail afterward. It directs organizations to stop new development on Iteration 2 and migrate to the Iteration 3 APIs, identified in the notice as GA. This is a concrete API retirement, not routine documentation maintenance.
Purview eDiscovery access will be enforced through Entra Conditional AccessMicrosoft Entra Conditional Access and Microsoft Purview eDiscovery
Microsoft Purview will enforce Entra Conditional Access policies for eDiscovery administrators accessing SharePoint content. Non-compliant users will be blocked, with rollout beginning in October and completing by November 2025. The change also adds FilePreviewed as an audit activity, making this both a behavior-enforcement and monitoring change.
Cross-cloud synchronization is available, but its status is not an unqualified GA announcementMicrosoft Entra cross-cloud synchronization
Microsoft Entra cross-cloud synchronization automates user lifecycle management across Microsoft commercial, US Government, and China clouds and supports configuration through the portal, PowerShell, and API. The notice requires specific licensing and administrator enablement, but describes the capability as public preview and opt-in while also listing GA for late September to early October 2025. Administrators should preserve that status distinction when assessing adoption.
Teams group-chat agents and bots are scheduled to support Entra authenticationMicrosoft Teams group-chat agents and bots with Microsoft Entra authentication
Beginning 3–6 November 2025, Microsoft Teams agents and bots in group chats will support Microsoft Entra authentication. The notice says the capability is enabled by default and requires no admin action. Users who lack the Teams app or have not granted Entra consent will receive a private prompt to install the app and provide permissions.
External ID fraud protection and Application Proxy CAE remain explicitly preview capabilitiesMicrosoft Entra External ID; Global Secure Access Application Proxy
The October documentation signals identify Microsoft Entra External ID integrations with Arkose Labs and HUMAN Security for sign-up fraud protection, and Continuous Access Evaluation for Application Proxy under Global Secure Access, as preview topics. The supplied evidence does not establish a GA date or changed tenant default for either capability, so these updates should not be treated as launch announcements.

For Entra administrators

Prioritize an inventory of applications using PIM Iteration 2 beta APIs and plan migration to the Iteration 3 GA APIs before 28 October 2026; the notice says applications will fail after retirement. For eDiscovery, review the Conditional Access compliance path for administrators accessing SharePoint content and account for the new FilePreviewed audit activity. For cross-cloud synchronization, confirm the applicable licensing and administrator-enablement prerequisites before opting in. Teams requires no admin enablement, but users without the Teams app or Entra consent may receive a private installation and consent prompt. If service principal-less authentication is in scope, review the Workload ID mitigation guidance, although no retirement deadline is supplied. The updated ID Protection,

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

530 updates by product

Agent Optimization

Updated

manager: dougeby

15 October 2025

F5 Big Ip Kerberos Advanced

Updated

14 October 2025

Updated

| Date | Area | Description |

2 October 2025

Updated

Removed

A Microsoft Entra documentation page was updated: Report View System Report.

2 October 2025

Ui Audit Trail

Removed

Updated

Some IP addresses can't be mapped to a specific country or region. To capture these IP locations, select the box **Include unknown countries/regions** when defining a geographic location. This option allows you to choose if these IP addresses should be included in the named location. Use this setting when the policy using the named location should apply to unknown locations.

7 October 2025

Updated

Removed

Microsoft identity platform

Microsoft Teams: Agent and bot support for Entra authentication in group chats

New

Microsoft Teams group chat agents and bots will support Entra authentication starting November 3-6, 2025. Users without the Teams app or Entra consent receive a private prompt to install the app and grant permissions. This feature is enabled by default, requiring no admin action.

14 October 2025

Message CenterMC1171846 on mc.merill.net ↗Stay informed

Quickstarts Free Trial Note

Updated

If you don't have an [Azure subscription](/azure/guides/developer/azure-developer-guide#understanding-accounts-subscriptions-and-billing), create an [Azure free account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn) before you begin.

14 October 2025

Adal Msal Migration

Updated

manager: pmwongera

3 October 2025

Whats New Docs

Updated

minimumlicense: P2, Governance

Updated

A Microsoft Entra documentation page was updated: minimumlicense: P2, Governance.

30 October 2025

minimumlicense: P2, Governance

Updated

A Microsoft Entra documentation page was updated: minimumlicense: P2, Governance.

30 October 2025

minimumlicense: P2, Governance

Updated

A Microsoft Entra documentation page was updated: minimumlicense: P2, Governance.

30 October 2025

Connect Install Prerequisites

Updated

- Microsoft Entra Connect must be installed on a domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016. We recommend Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported versions of Windows Server may cause service failures or unexpected behavior.

15 October 2025

Security

sfipillar: Protect tenants and isolate production systems

Updated

A Microsoft Entra documentation page was updated: sfipillar: Protect tenants and isolate production systems.

11 October 2025

Revoke access to high-risk and unused tasks or assign read-only status for Microsoft Azure and Google Cloud Platform (GCP) identities

Updated

> [!NOTE]

3 October 2025

Certificate Credentials

Updated

A Microsoft Entra documentation page was updated: Certificate Credentials.

3 October 2025

Microsoft Entra Permissions Management integrates with Microsoft Defender for Cloud

New

Learn how Microsoft Entra Permissions Management helps strengthen security in cloud environments as an enhancement for Defender for Cloud

2 October 2025

Standards

Native Authentication Cors Solution Production Environment

Updated

In a production environment, we recommended using [Azure Front Door with a Standard/Premium subscription](/azure/frontdoor/standard-premium/troubleshoot-cross-origin-resources) as a reverse proxy.

14 October 2025

Scim Validator Tutorial

Updated

ai-usage: ai-assisted

7 October 2025

Use Scim To Provision Users And Groups

Updated

"members": []

7 October 2025

Saml Claims Customization

31 October 2025

Message CenterMC1181768 on mc.merill.net ↗Major updatePlan for change

Enforce Password Changes for Elevated User Risk

Updated

Learn how to create Conditional Access policies using Microsoft Entra ID Protection to enforce secure password changes for users with elevated risk.

2 October 2025

Fundamentals

Howto Identity Protection Investigate Risk

Updated

- Add corporate VPNs and IP address ranges to [named locations](../identity/conditional-access/concept-assignment-network.md) in your Conditional Access policies to reduce false positives.

8 October 2025

Identity Protection Risks

Updated

Also referred to as Adversary in the Middle, this high precision detection is triggered when an authentication session is linked to a malicious reverse proxy. In this kind of attack, the adversary can intercept the user's credentials, including tokens issued to the user. The Microsoft Security Research team uses Microsoft Defender for Cloud Apps to capture the identified risk and raises the user to **High** risk. We recommend administrators manually investigate the user when this detection is triggered to ensure the risk is cleared. Clearing this risk might require secure password reset or revocation of existing sessions.

8 October 2025

Source Ip Restoration

Updated

- [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks) get a consistent view of original user Source IP address for assessing various risk scores.

1 October 2025

Monitoring

Howto Export Risk Data

Updated

Access more queries and visual insights based on AADUserRiskEvents and AADRisky Users logs in the [Impact analysis of risk-based access policies workbook](workbook-risk-based-policy-impact.md).

1 October 2025

Microsoft Entra ID Governance

1. Sign in to the My Access portal at [https://myaccess.microsoft.com](https://myaccess.microsoft.com) as the direct manager of the team who you want to manage access package assignments for. For US Government, the domain in the My Access portal link is `myaccess.microsoft.us`.

8 October 2025

Fundamentals

Microsoft Entra | Iteration 2 (beta): Privileged Identity Management (PIM) APIs to be phased out by Oct 28, 2026

New

Microsoft Entra Privileged Identity Management (PIM) Iteration 2 (beta) APIs will be retired on October 28, 2026. Applications using these APIs will fail after this date. Organizations should migrate to the more reliable Iteration 3 (GA) APIs and stop new development on Iteration 2 APIs.

29 October 2025

Message CenterMC1181281 on mc.merill.net ↗Plan for change

Licensing Fundamentals

Updated

- **Free** - Included with Microsoft cloud subscriptions such as Microsoft Azure, Microsoft 365, and others.

10 October 2025

Conditional Access

Plan Conditional Access

Updated

- Admins who interact with Conditional Access need one of the following role assignments, depending on the tasks they're performing. To follow the [Zero Trust principle of least privilege](/security/zero-trust/), consider using [Privileged Identity Management (PIM)](~/id-governance/privileged-identity-management/pim-configure.md) to activate privileged role assignments just in time.

8 October 2025

Microsoft identity platform

Microsoft Entra: Cross-cloud synchronization now available

New

Microsoft Entra's cross-cloud synchronization, in public preview and opt-in, automates user lifecycle management across Microsoft commercial, US Government, and China clouds. General availability is late September to early October 2025. It requires specific licenses, admin enablement, and supports configuration via portal, PowerShell, and API.

3 October 2025

Message CenterMC1124558 on mc.merill.net ↗Stay informed

Microsoft Entra External ID

2 October 2025

Monitoring

Azure Monitor

Updated

During this deployment, you'll configure your external tenant where logs are generated. You'll also configure your external tenant where the Log Analytics workspace will be hosted. The external tenant accounts used (such as your admin account) should be assigned the [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator) role on the external tenant. The account you'll use to run the deployment in the external tenant must be assigned the [Owner](/azure/role-based-access-control/built-in-roles#owner) role in the Microsoft Entra subscription. It's also important to make sure you're signed in to the correct directory as you complete each step as described.

2 October 2025

Provisioning

Known Issues

Updated

zone_pivot_groups: app-provisioning-cross-tenant-synchronization

15 October 2025

Microsoft Entra Internet Access

4 updates

General

Points Of Presence

Updated

The Global Secure Access service is accessed from the Global Secure Access client and is used for Microsoft Entra Internet Access (including Microsoft 365) and Microsoft Entra Private Access traffic. The Internet Protocol (IP) addresses are listed.

17 October 2025

2 updates

General

Configure Domain Controllers

Updated

To configure Microsoft Entra Private Access for Active Directory Domain Controllers, you must have the following:

9 October 2025

Cisco Coexistence

Updated

5. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.

8 October 2025

Microsoft Entra Workload ID

3 updates

General

Managed Identity Libraries

Updated

A Microsoft Entra documentation page was updated: Managed Identity Libraries.

29 October 2025

Howto Create Service Principal Portal

Updated

A Microsoft Entra documentation page was updated: Howto Create Service Principal Portal.

3 October 2025

Authentication

Retire Service Principal Less Authentication

Updated

Learn about the mitigation steps tenant administrators should perform for the retirement of service principal-less authentication.

3 October 2025

Microsoft Entra Global Secure Access

Use the web category checker to find which web content category a URL belongs to via Microsoft Graph.

1 October 2025

Troubleshooting

Troubleshoot Connectors

1. Download the Azure Arc agent setup script from the Azure portal.

1 October 2025

Security

Transport Layer Security

Updated

```openssl x509 -req -in <CSR file> -CA rootCAchain.pem -CAkey rootCAchain.key -CAcreateserial -out signedcertificate.pem -days 370 -sha256 -extfile openssl.cnf -extensions signedCA_ext```

18 October 2025