Daily.Entra.News
Aboutmerill.net
← Previous week
Next week →
Week in brief

Workload ID sets a 31 March 2026 remediation deadline; the rest of the week is mostly Entra guidance and preview documentation

The week of 14 April 2025 was documentation-heavy: 380 entries were updated, four were new, three were removed, and there were no Message Center items. The clearest operational signal is updated Workload ID guidance stating that service principal-less authentication will no longer be supported from March 2026, with action required before 31 March 2026 to avoid application authentication failures. Other notable updates cover mandatory MFA readiness and lockout guidance, plus the explicitly preview Conditional Access optimization agent. The supplied evidence does not establish a new general-availability launch or a tenant-wide service change this week.

  • Workload ID · Authentication
    Workload ID: service principal-less authentication is on a dated retirement path

    Two updated Workload ID pages say Microsoft Entra ID will no longer support service principal-less authentication behavior from March 2026. A related retirement page says administrators must act before 31 March 2026 to avoid application authentication failures, and the mitigation guidance specifically calls for verifying access, creating an enterprise application, and verifying tokens. This is a documented future deprecation and behavior change, not evidence that retirement began during this week.

  • Entra ID · Authentication
    Mandatory MFA documentation adds lockout and readiness guidance

    On 20 April, a new Entra ID authentication page covering users locked out by mandatory MFA was added, while the mandatory MFA and user-verification pages were also updated. The supplied summaries focus on verifying users who sign in to Azure and other management portals and on understanding affected applications and accounts. This is security and rollout-readiness guidance; the records do not indicate that MFA enforcement behavior or rollout timing changed this week.

  • Entra ID · Conditional Access
    Conditional Access optimization agent remains explicitly in preview

    Updated Entra ID pages describe the Conditional Access optimization agent as being in preview. Its documented scope includes recommending policies and changes aligned with Zero Trust, evaluating MFA requirements, enforcing device-based controls such as device compliance, app protection policies, and domain-joined devices, and blocking legacy authentication and device code flow. The update clarifies the preview scope; it is not a general-availability announcement.

  • Global Secure Access · Conditional Access
    Conditional Access and Global Secure Access scope guidance was clarified

    The updated Entra ID Office 365 application reference describes a detailed list of services and applications covered by the Office 365 Conditional Access app. Related Global Secure Access and Private Access pages cover applying Conditional Access to Global Secure Access traffic and Private Access apps, including the compliant network check. An Internet Access diagnostics update clarifies that selecting RemoteNetworkHealthLogs does not itself add new logs unless the organization uses Microsoft Entra Internet Access和

  • Entra ID · Authentication
    External ID connector guidance clarifies mutual certificate authentication

    Updated Microsoft Entra External ID self-service sign-up API connector guidance explains that Entra ID presents an X.509 client certificate during the SSL handshake. The API is responsible for validating that the certificate belongs to a valid client and for making authorization decisions. This is a security implementation clarification, not evidence of a new connector capability or availability change; connector owners should verify that their endpoint handles those responsibilities.

For Entra administrators

Prioritize the Workload ID mitigation path for affected applications: verify access, create an enterprise application, and verify tokens before the stated deadline. Use the updated Entra ID guidance to verify mandatory MFA readiness for Azure and other management portals. Treat the Conditional Access optimization agent as preview, and validate Conditional Access scope, diagnostics, and External ID connector certificate handling only where those capabilities are in use; the documentation updates alone do not imply blanket tenant configuration changes.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Authentication

91

How to verify that users are set up for mandatory MFA

Updated

This topic covers steps to verify that users in your organization are set up to meet Azure's mandatory MFA requirements. For more information about which applications and accounts are affected and how the rollout works, see [Planning for mandatory multifactor authentication for Azure and other admin portals](concept-mandatory-multifactor-authentication.md).

20 April 2025

Howto Sspr Windows

Updated

![Screenshot that shows examples of Windows sign-in screens with the SSPR link.](./media/howto-sspr-windows/windows-reset-password.png)

20 April 2025

Mfa Regional Opt In

Updated

For SMS verification, the following region codes require an opt-in. This means that if you'd like to use telecom in these regions, you'll have to reach out to support.

19 April 2025

Licensing Governance

Updated

The following table shows what features associated with identity governance are available with each license. For more information on other features, see [Microsoft Entra plans and pricing](https://www.microsoft.com/security/business/microsoft-entra-pricing). Not all features are available in all clouds; see [Microsoft Entra feature availability](~/identity/authentication/feature-availability.md) for Azure Government.

18 April 2025

Mfa Regional Opt In

Updated

|:----------- |:---------------------------------------------- |

18 April 2025

Refresh Tokens

Updated

Refresh tokens will automatically expire once the lifetime period elapses. Additionally, they can be revoked by the sign-in service at any time before their expiration. Your app should handle such revocations gracefully by redirecting the user to an interactive sign-in prompt to reauthenticate and obtain a new token.

18 April 2025

Authenticate Application Id

Updated

> - It is recommended to use the TPM to provide a hardware-based security boundary, as opposed to the Local Machine store. To check the status of your TPM use the [Get-TPM](/powershell/module/trustedplatformmodule/get-tpm?view=windowsserver2025-ps) PowerShell cmdlet. If using Hyper-V VMs, the TPM can be enabled by checking Security > Enable Trusted Platform Module. This can only be done on a generation 2 virtual machines. Generation 1 virtual machines can't be converted to a generation 2 virtual machines. For more information see [Generation 2 virtual machine security settings for Hyper-V](/windows-server/virtualization/hyper-v/learn-more/generation-2-virtual-machine-security-settings-for-hyper-v) and [Enable Trusted launch on existing Azure Gen2 VMs](/azure/virtual-machines/trusted-launch-existing-vm)

17 April 2025

Quickstart Create New Tenant

Updated

In this quickstart, you learn how to create a Microsoft Entra tenant for use in developing applications that use the Microsoft identity platform for authentication and authorization.

17 April 2025

Multi Service Web App Authentication App Service

Updated

The authentication module is enabled and configured through the Azure portal and app settings. No SDKs, specific languages, or changes to application code are required.​ A variety of identity providers are supported, which includes Microsoft Entra ID, Microsoft Account, Facebook, Google, and X​​. When the authentication module is enabled, every incoming HTTP request passes through it before being handled by app code.​​ To learn more, see [Authentication and authorization in Azure App Service](/azure/app-service/overview-authentication-authorization).

17 April 2025

Support Fido2 Authentication

Updated

FIDO2 is supported for Android apps that use MSAL with [BROWSER as the authorization user agent](/entra/msal/android/msal-configuration#authorization_user_agent) or broker integration. Broker is shipped in Microsoft Authenticator, Company Portal, or Link to Windows app on Android.

17 April 2025

Tutorial Cli App Node Sign In Prepare App

Updated

This tutorial is part 1 of a series that demonstrates building a Node.js command line interface (CLI) app and preparing it for authentication using the Microsoft Entra admin center. The client application you build uses the [OAuth 2.0 Authorization Code Flow](~/identity-platform/v2-oauth2-auth-code-flow.md) with Proof Key for Code Exchange (PKCE) for secure user authentication.

17 April 2025

Tutorial Native Authentication Android Sign In Call Api

Updated

In this tutorial, you learn how to acquire an access token and call an API in your Android mobile app. Microsoft Authentication Library (MSAL) native authentication SDK for Android allows you to acquire multiple access tokens with a single sign-in. This capability allows you to acquire one or more access tokens without requiring a user to reauthenticate.

17 April 2025

Tutorial Native Authentication Android Sign Up

Updated

This tutorial demonstrates how to sign up a user using email one-time passcode or username (email) and password, and collect user attributes in your Android mobile app using native authentication.

17 April 2025

Tutorial Native Authentication Single Page App React Set Up Local Cors

Updated

In this tutorial, you learn how to set up the CORS proxy server to manage CORS headers while interacting with native authentication API from a React single-page app (SPA). The CORS proxy server is a solution to the native authentication API's inability to support [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/docs/Web/HTTP/CORS).

17 April 2025

Tutorial Single Page App React Prepare App

Updated

In this tutorial you'll build a React single-page application (SPA) and prepare it for authentication using the Microsoft identity platform. This tutorial demonstrates how to create a React SPA using `npm`, create files needed for authentication and authorization and add your tenant details to the source code. The application can be used for employees in a workforce tenant or for customers using an external tenant.

17 April 2025

Tutorial Single Page Apps Angular Extract User Data

Updated

This tutorial is the final part of a series that demonstrates building an Angular single-page application (SPA) and adding authentication using the Microsoft identity platform. In [Part 2 of this series](tutorial-single-page-apps-angular-sign-in-users-app.md), you created an Angular SPA and prepared it for authentication with your workforce tenant.

17 April 2025

Tutorial V2 Shared Device Mode

Updated

In this tutorial, Android developers learn how to add shared device mode support in an Android application using the Microsoft Authentication Library (MSAL) for Android.

17 April 2025

Tutorial Web App Dotnet Call Api

Updated

In this tutorial, you test the sign in and sign out experience of your ASP.NET Core web app and view the claims in the ID token. In the [previous tutorial](./tutorial-web-app-dotnet-sign-in-users.md), you added the authentication elements, the sign-in, and sign-out experiences to the application to enable your app call a web API. For the purposes of this tutorial, the Microsoft Graph API is called to display the profile information of the logged-in user.

17 April 2025

Tutorial Web App Dotnet Sign In Users

Updated

In this tutorial, you add the authentication and authorization elements to an ASP.NET Core web app. In the [previous tutorial](./tutorial-web-app-dotnet-prepare-app.md), you created an ASP.NET Core project and configured it for authentication.

17 April 2025

Tutorial: Create a .NET MAUI app

Updated

This tutorial demonstrates how to create a .NET MAUI shell app, add MSAL SDK support via MSALClient helper, and include an image resource.

17 April 2025

Tutorial Mobile App Maui Sign In Sign Out

Updated

This tutorial demonstrates how to add sign-in and sign-out code in .NET Multi-platform App UI (.NET MAUI) and how to run the app on the Android platform.

17 April 2025

Tutorial Mobile Android Device Shared Mode

Updated

In this tutorial, you learn how to add shared device mode support to an Android device with the Microsoft Authenticator App or a Mobile Device Management (MDM) tool like Microsoft Intune. Employees sign in once for single sign-on (SSO) to all SDM-supported apps and sign out to make the device ready for the next user with no access to previous data.

17 April 2025

Support Fido2 Authentication

Updated

FIDO2 is supported for Android apps that use MSAL with [BROWSER as the authorization user agent](/entra/msal/android/msal-configuration#authorization_user_agent) or broker integration. Broker is shipped in Microsoft Authenticator, Company Portal, or Link to Windows app on Android.

16 April 2025

Quickstart Desktop App Sign In

Updated

- [Tutorial: Authenticate users to your WPF desktop application](./tutorial-desktop-wpf-dotnet-sign-in-build-app.md)

16 April 2025

General

49

Harden Update Ad Fs Pingfederate

Updated

Post the MSOnline retirement date, older versions of Microsoft Entra Connect can’t switch Staging mode via the wizard.

18 April 2025

Lifebalance Program Oidc Tutorial

Updated

1. In the **Redirect URIs** textbox, use the URL associated with your LifeBalance Program subscription in this format. These usually have the following pattern:

18 April 2025

Upgrade Previous Version

Updated

![In-place upgrade](./media/how-to-upgrade-previous-version/inplaceupgrade.png)

18 April 2025

Multi Service Web App Access Microsoft Graph As User

Updated

You want to add access to Microsoft Graph from your web app and perform some action as the signed-in user. This section describes how to grant delegated permissions to the web app and get the signed-in user's profile information from Microsoft Entra ID.

17 April 2025

Harden Update Ad Fs Pingfederate

Updated

Though the deadline has been extended, if you are not yet on a minimum supported version, you'll experience the following impacts after the original date:

16 April 2025

Developer

46

Custom Extension Onattributecollectionsubmit Retrieve Return Data

Updated

The request to your REST API is in the format shown in the following example. In this example, the request includes user identities information along with built-in attributes (givenName and companyName) and custom attributes (universityGroups, graduationYear, and onMailingList).

17 April 2025

Assign User Or Group Access Portal

Updated

When you assign a group to an application, only users in the group have access. The assignment doesn't cascade to nested groups.

16 April 2025

Microsoft identity platform

26

Multi Service Web App Clean Up Resources

Updated

If you completed all the steps in this multipart tutorial, you created an app service, app service hosting plan, and a storage account in a resource group. You also created an app registration in Microsoft Entra ID. When no longer needed, delete these resources and app registration so that you don't continue to accrue charges.

17 April 2025

Tutorial Web Api Dotnet Core Build App

Updated

This tutorial series demonstrates how to protect an ASP.NET Core web API with the Microsoft identity platform to limit it's access to only authorized users and client apps. The web API you build uses both delegated permissions (scopes) and application permissions (app roles).

17 April 2025

Provisioning

20

Standards

9

V2 Oauth2 On Behalf Of Flow

Updated

Regardless of which API is identified in the authorization request, the consent prompt is combined with all required permissions configured for the client app. All required permissions configured for each middle tier API listed in the client's required permissions list, which identified the client as a known client application, are also included.

16 April 2025

Security

8

Groups Create Rule

Updated

Group membership based on user or device properties is supported for security groups and Microsoft 365 groups. When you apply a rule for a dynamic membership group, user and device attributes are evaluated for matches with the membership rule. When an attribute changes for a user or device, all rules for dynamic membership groups in the organization are processed for changes. Users and devices are added or removed if they meet the conditions for a dynamic membership group. In Microsoft Entra ID, a single tenant can have a maximum of 15,000 dynamic membership groups.

20 April 2025

Tutorial V2 Windows Desktop

Updated

When you've completed the guide, your application will able to call a protected API that uses personal accounts (including outlook.com, live.com, and others). The application will also use work and school accounts from any company or organization that uses Microsoft Entra ID.

17 April 2025

Tutorial Web Api Dotnet Core Call Protected Api

Updated

This tutorial is the final part of a series that demonstrates building and testing a protected web API registered in a Microsoft Entra tenant. In [Part 1 of this series](tutorial-web-api-dotnet-core-build-app.md), you created an ASP.NET Core web API and protected its endpoints. You'll now create a lightweight daemon app, register it in your tenant, and use the daemon app to test the web API you built.

17 April 2025

Fundamentals

7

Recommendations

Updated

| AAD Connect Deprecated | Tenant | Preview | No | Hybrid Identity Administrator |

17 April 2025

Provisioning Logs

Updated

- Examples of Other include if the source and target system details already match, so no change was made.

17 April 2025

Conditional Access

4

Office 365 Application Contents

Updated

The following list is provided as a reference and includes a detailed list of services and applications that are included in the Conditional Access [Office 365](concept-conditional-access-cloud-apps.md#office-365) app.

18 April 2025

Microsoft Entra Conditional Access optimization agent

Updated

The Conditional Access optimization agent helps you ensure all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings. In preview, the agent evaluates policies requiring multifactor authentication (MFA), enforces device based controls (device compliance, app protection policies, and Domain Joined Devices), and blocks legacy authentication and device code flow.

16 April 2025

Agents

Updated

The [Conditional Access optimization agent](../identity/conditional-access/agent-optimization.md) ensures all users are protected by policy. It recommends policies and changes based on best practices aligned with [Zero Trust](/security/zero-trust/deploy/identity) and Microsoft's learnings. In preview, the agent evaluates policies requiring multifactor authentication (MFA), enforces device based controls (device compliance, app protection policies, and Domain Joined Devices), and blocks legacy authentication and device code flow.

16 April 2025

Monitoring

4

Tutorial Create Log Analytics Workbook

Updated

In addition to querying the data with Kusto Query Language (KQL), you can create a custom workbook for further analysis and alerting. The least privileged role to create or update a workbook is the **Security Administrator** role.

16 April 2025

Troubleshooting

4

Architecture

2

Fundamentals

1

Security

1

Workbook Risk Based Policy Impact

Updated

:::image type="content" source="media/workbook-risk-based-policy-impact/workbook-risk-based-impact-trusted-network.png" alt-text="Screenshot showing the trusted network section of the workbook." lightbox="media/workbook-risk-based-policy-impact/workbook-risk-based-impact-trusted-network.png":::

17 April 2025

Governance

4

Licensing Governance

Updated

|[LCW + Custom Extensions (Logic Apps)](~/id-governance/lifecycle-workflow-extensibility.md)|||| :white_check_mark: | :white_check_mark: |

20 April 2025

Entitlement Management Dynamic Approval

Updated

Once you've created the custom extension and Logic app, you can reference the custom extension in an access package assignment policy by doing the following steps:

17 April 2025

Lifecycle Workflows Tasks Table

Updated

| [Remove all access package assignments for user](../id-governance/lifecycle-workflow-tasks.md#remove-all-access-package-assignments-for-user) | 42ae2956-193d-4f39-be06-691b8ac4fa1d | Leaver |

16 April 2025

Fundamentals

2

Licensing Fundamentals

Updated

The Microsoft Entra ID Governance capabilities are currently available in six standalone products. These six products provide the same identity governance capabilities. The difference between the six products is that they have different prerequisites.

18 April 2025

Self Service Portal

Updated

As an inviting organization, you might not know ahead of time who the individual external collaborators are who need access to your resources. You need a way for users from partner companies to sign themselves up with policies that you control. You can use [Microsoft Entra entitlement management](~/id-governance/entitlement-management-overview.md) to configure policies, which [manage access for external users](~/id-governance/entitlement-management-external-users.md#how-access-works-for-external-users). Then users from other organizations can request access, and upon approval be provisioned with guest accounts and assigned to groups, apps, and SharePoint Online sites.

17 April 2025

General

13

Automatic Redemption Include

Updated

| Users must accept a [consent prompt](~/external-id/redemption-experience.md#consent-experience-for-the-guest) | No | No | No |

20 April 2025

Tenant Restrictions V2

Updated

Tenant Restrictions v2 will not be enforced with request going across cross clouds.

19 April 2025

Developer

5

Assign Users Groups Roles

Updated

1. Select **All applications** to view a list of all your applications. If your application doesn't appear in the list, use the filters at the top of the **All applications** list to restrict the list, or scroll down the list to locate your application.

16 April 2025

Fundamentals

4

Cross Tenant Synchronization Overview

Updated

In the target tenant: Cross-tenant sync relies on the Microsoft Entra External ID billing model. To understand the external identities licensing model, see [MAU billing model for Microsoft Entra External ID](~/external-id/external-identities-pricing.md). You will also need at least one Microsoft Entra ID P1 license in the target tenant to enable auto-redemption.

20 April 2025

Cross Tenant Synchronization Overview

Updated

In the target tenant: Cross-tenant sync relies on the Microsoft Entra External ID billing model. To understand the external identities licensing model, see [MAU billing model for Microsoft Entra External ID](~/external-id/external-identities-pricing.md). You will also need at least one Microsoft Entra ID P1 license in the target tenant to enable auto-redemption.

19 April 2025

Provisioning

4

Authentication

3

Self Service Sign Up Secure Api Connector

Updated

Client certificate authentication is a mutual certificate-based authentication. The client, Microsoft Entra ID, provides its client certificate to the server to prove its identity as part of the SSL handshake. Your API is responsible for validating the certificates belong to a valid client, such as Microsoft Entra ID, and performing authorization decisions. The client certificate is an X.509 digital certificate.

17 April 2025

Tutorial: Authenticate users to your WPF desktop application

Updated

This tutorial is the final part of a series that demonstrates building a Windows Presentation Form (WPF) desktop app and preparing it for authentication using the Microsoft Entra admin center. In [Part 1 of this series](./tutorial-desktop-wpf-dotnet-sign-in-prepare-tenant.md), you registered an application and configured user flows in your external tenant. This tutorial demonstrates how to build your .NET WPF desktop app and sign in and sign out a user using Microsoft Entra External ID.

17 April 2025

Tutorial: Authenticate users to your WPF desktop application

Updated

This tutorial is the final part of a series that demonstrates building a Windows Presentation Form (WPF) desktop app and preparing it for authentication using the Microsoft Entra admin center. In [Part 1 of this series](./tutorial-desktop-wpf-dotnet-sign-in-prepare-tenant.md), you registered an application and configured user flows in your external tenant. This tutorial demonstrates how to build your .NET WPF desktop app and sign in and sign out a user using Microsoft Entra External ID.

16 April 2025

Microsoft identity platform

1

Security

1

Fundamentals

2

Diagnostic Settings Logs Options

Updated

The `RemoteNetworkHealthLogs` provide insights into the health of your remote network configured through Global Secure Access. Selecting this option doesn't add new logs to your workspace unless your organization is using Microsoft Entra Internet Access and Microsoft Entra Private Access to secure access to your corporate resources. For more information, see [Remote network health logs](../../global-secure-access/how-to-remote-network-health-logs.md).

18 April 2025

General

1

General

3

Architecture

1

Gsa Deployment Guide Intro

Updated

- [Microsoft Global Secure Access Deployment Guide for Microsoft Entra Private Access](gsa-deployment-guide-private-access.md)

18 April 2025

Conditional Access

1

Developer

1

Fundamentals

1

Authentication

4

Service principal-less authentication mitigation

Updated

From March 2026, Microsoft Entra ID will no longer support service principal-less authentication behavior. In this article, you'll learn how to prepare for the deprecation of service principal-less authentication. As a tenant administrator you'll verify access, create an enterprise application, and verify tokens.

19 April 2025

Service Principal Table

Updated

The Microsoft service principal sign-in logs capture service-to-service authentication events for Microsoft services in your tenant. While not necessary for security investigations, the information can be useful for understanding how your services are interacting with each other.

16 April 2025

Developer

1

Fundamentals

1

Multi Service Web App Access Microsoft Graph As App

Updated

You want to call Microsoft Graph for the web app. A safe way to give your web app access to data is to use a [system-assigned managed identity](~/identity/managed-identities-azure-resources/overview.md). A managed identity from Microsoft Entra ID allows App Service to access resources through role-based access control (RBAC), without requiring app credentials. After assigning a managed identity to your web app, Azure takes care of the creation and distribution of a certificate. You don't have to worry about managing secrets or app credentials.

17 April 2025

General

1

Security

1

Multi Service Web App Access Storage

Updated

A managed identity from Microsoft Entra ID allows App Service to access resources through role-based access control (RBAC), without requiring app credentials. After assigning a managed identity to your web app, Azure takes care of the creation and distribution of a certificate. People don't have to worry about managing secrets or app credentials.

17 April 2025

General

26

Fundamentals

19

Private Name Resolution

Updated

A high-level Private DNS flow for Windows clients is shown in the following diagram.

20 April 2025

Edr Antivirus Coexistence

Updated

- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessEngineService.exe`

20 April 2025

Name Resolution

Removed

A Microsoft Entra documentation page was updated: Name Resolution.

20 April 2025

Private Name Resolution

Updated

:::image type="content" source="media/concept-private-name-resolution/image1.png" alt-text="Screenshot of a network diagram showing the high-level Private DNS flow for Windows clients.":::

18 April 2025

Monitoring

4

Conditional Access

3

Developer

2

Security

2

Configure Transport Layer Security inspection (preview)

Updated

A significant percentage of internet traffic is encrypted. By terminating Transport Layer Security (TLS) at the edge, Global Secure Access inspects and applies security policies to decrypted traffic, enabling threat detection, content filtering, and granular access controls.

20 April 2025

Learn about Security Service Edge (SSE) coexistence with Microsoft and Zscaler

Updated

In today's rapidly evolving digital landscape, organizations require robust, and unified solutions to ensure secure and seamless connectivity. Microsoft and Zscaler offer complementary Secure Access Service Edge (SASE) capabilities that, when integrated, provide enhanced security and connectivity for diverse access scenarios.

18 April 2025

Troubleshooting

2

Architecture

1

Authentication

1

Configure Kerberos Sso

Updated

|445 |UDP/TCP |Replication, User and Computer Authentication, Group Policy |

19 April 2025