Week of 9 June 2025 — Entra.News Daily

Week in brief

Week of 9 June 2025: Workload ID’s 31 March 2026 deadline and Entra ID’s KDFv1 support-removal notice lead an otherwise documentation-heavy week

Nearly all of the 1,998 supplied records are Microsoft Learn updates: 1,984 updated records, six new records, eight removals, and no Message Center changes. The data therefore does not support a broad launch narrative. The clearest operational item is a Workload ID notice requiring action before 31 March 2026 to avoid application authentication failures. A separate Entra ID article covers removing KDFv1 algorithm support. New Global Secure Access and Internet Access pages add Microsoft–Netskope coexistence guidance, while other notable edits clarify Conditional Access sign-in paths and app-registration redirect-URI risk. New pages covering tenant restrictions v2, Authenticator sign-in context, named locations, and access-package visibility are treated as documentation additions rather than previews or GA announcements because no availability status is supplied.

Workload ID · Authentication
Workload ID: Service Principal Less Authentication carries an explicit retirement deadline
The updated page titled “Retire Service Principal Less Authentication” says administrators must act before 31 March 2026 to avoid application authentication failure. This is a retirement and deadline notice, not merely an editorial change. The supplied evidence does not identify the affected applications or a replacement method, so the supported next step is dependency identification and remediation planning.
Entra ID · Authentication
Entra ID authentication: KDFv1 support-removal security update
The updated article explicitly covers removing KDFv1 algorithm support in Microsoft Entra authentication. That makes it a security-related support change, not a preview or GA announcement. No effective date, affected authentication path, or migration instruction is supplied, so administrators should check for dependencies without assuming a deadline or replacement.
Internet Access · Conditional Access
Global Secure Access and Internet Access: Microsoft–Netskope coexistence guidance expands
New articles describe configuring, testing, and deploying Microsoft and Netskope SSE/SASE solutions together across private applications, Microsoft 365, and internet access. An updated Netskope Coexistence page specifically includes Microsoft Entra Private Access with Netskope Internet Access. A related Internet Access update documents Intune device-compliance bypasses and warns that tunnel-authorization limitations can make blocking a forwarding profile in Conditional Access inadvertently lock users out of access.
Entra ID · Authentication
Conditional Access staged rollout: legacy-authentication fallback is clarified
The updated Connect Staged Rollout content says browser and modern-authentication-client sign-in traffic follows the rollout, while applications or cloud services using legacy authentication fall back to federated authentication flows. The examples include Exchange Online with modern authentication disabled and Outlook 2010. This is a documentation clarification of sign-in behavior, not evidence that legacy authentication support was retired or that a new Conditional Access feature shipped.
Entra ID · Microsoft identity platform
App registrations: dangling redirect URIs are highlighted as a security risk
Updated app-registration security guidance describes how orphaned redirect URIs tied to abandoned domains or DNS entries can be taken over, allowing attackers to intercept OAuth 2.0 tokens or credentials and potentially hijack sessions. This is security guidance rather than an announced enforcement change; reviewing applicable redirect URIs and domain ownership is the supported administrative response.

For Entra administrators

Determine which applications, if any, depend on the Workload ID authentication path and plan remediation before the stated deadline. Check Entra authentication dependencies for KDFv1, without assuming an unstated effective date or replacement method. If Microsoft Entra Private Access, Global Secure Access, or Internet Access is being deployed with Netskope, use the configuration and testing guidance and account for the documented tunnel-authorization and Conditional Access lockout limitation. For sign-in rollouts, distinguish legacy-authentication flows from browser and modern-client flows; for app registrations, verify that redirect URIs still resolve to domains the organization owns. These are targeted reviews, not evidence of a tenant-wide rollout.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Microsoft Entra ID

1946 updates

10 June 2025

11 June 2025

Veritas Provisioning Tutorial

Removed

Updated

author: owinfreyATL

10 June 2025

12 June 2025

V2 Oauth2 On Behalf Of Flow

Updated

> [!IMPORTANT]

10 June 2025

11 June 2025

11 June 2025

Restrict access to high risk users

Updated

author: barclayn

11 June 2025

14 June 2025

Updated

author: barclayn

11 June 2025

11 June 2025

Architecture

Configure Advanced F5 Kerberos Delegation for Multi-Tier SaaS Architectures

Updated

In this article, learn the steps you need to perform to integrate F5 with Microsoft Entra ID.

14 June 2025

Plan a single sign-on deployment

Updated

Plan your single sign‑on deployment in Microsoft Entra ID. Streamline role assignments, certificate management, and licensing to ensure uninterrupted access.

14 June 2025

Microsoft Entra ID Protection

3 updates

Authentication

implementationcost: Low

Updated

Without named locations configured in Microsoft Entra ID, threat actors can exploit the absence of location intelligence to conduct attacks without triggering location-based risk detections or security controls. When organizations fail to define named locations for trusted networks, branch offices, and known geographic regions, Microsoft Entra ID Protection can't assess location-based risk signals. Not having these policies in place can lead to increased false positives that create alert fatigue and potentially mask genuine threats. This configuration gap prevents the system from distinguishing between legitimate and illegitimate locations. For example, legitimate sign-ins from corporate networks and suspicious authentication attempts from high-risk locations (anonymous proxy networks, Tor exit nodes, or regions where the organization has no business presence). Threat actors can use this uncertainty to conduct credential stuffing attacks, password spray campaigns, and initial access attempts from malicious infrastructure without triggering location-based detections that would normally flag such activity as suspicious. Organizations can also lose the ability to implement adaptive security policies that could automatically apply stricter authentication requirements or block access entirely from untrusted geographic regions. Threat actors can maintain persistence and conduct lateral movement from any global location without encountering location-based security barriers, which should serve as an extra layer of defense against unauthorized access attempts.

15 June 2025

risklevel: Medium

Updated

Configuring workload identity based on risk policy in Microsoft Entra ID is a critical security measure that ensures only trusted and verified workloads can access sensitive resources. Without these policies, threat actors can compromise workload identities with minimal detection to perform further attacks. The lack of conditional controls for risk detections, such as anomalous activity, allows malicious operations like token forgery, sensitive resource access, and disruption of workloads to proceed unchecked. The lack of automated containment mechanisms increases dwell time and impacts the confidentiality, integrity, and availability of critical services.

15 June 2025

Security

ID Protection Notifications Are Enabled

Updated

author: HULKsmashGithub

12 June 2025

Microsoft Entra ID Governance

15 updates

Governance

Entitlement Management Access Package Visibility

Updated

**Introduction**

14 June 2025

Updated

Your tenants must be linked to an Azure subscription for proper billing and access to features. To link your tenant to a subscription, follow these steps.

9 June 2025

Fundamentals

Understanding Access Package Visibility in the My Access portal

New

Get an overview of access package visibility in the My Access portal.

14 June 2025

Microsoft Entra ID Governance licensing fundamentals

Updated

This article describes shows the licensing requirements for Microsoft Entra ID Governance features.

13 June 2025

Manage employee lifecycle using Microsoft Security Copilot

Updated

Microsoft Entra ID Governance applies the capabilities of [Microsoft Security Copilot](/security-copilot/microsoft-security-copilot) to save identity administrators time and effort when configuring custom workflows to manage the lifecycle of users across JML scenarios. It also helps you to customize workflows more efficiently using natural language to configure workflow information including custom tasks, execute workflows, and get workflow insights.

12 June 2025

Microsoft Entra External ID

Security Features in External Tenants

Updated

Learn about security features and fundamentals for Microsoft Entra External ID customer identity and access management (CIAM) in external tenant configurations.

11 June 2025

General

Training Videos

Updated

> [!VIDEO https://www.youtube.com/embed/lIdGt9rDM-E?si=8n1_G_AqFbYDP22y]

14 June 2025

Google Federation

PowerShell example that bypasses a certain fqdn or IP from being acquired by the Global Secure Access Client in the Internet Access forwarding profile.

11 June 2025

Conditional Access

Add Intune device compliance bypasses to Global Secure Access Internet Access

Updated

The [Universal Conditional Access documentation](/entra/global-secure-access/concept-universal-conditional-access#known-tunnel-authorization-limitations) notes that Global Secure Access has tunnel authorization limitations. This means that you can block access to a forwarding profile in Conditional Access and inadvertently lock users out from accessing anything on their machine.

11 June 2025

Security

Security Service Edge (SSE) Coexistence With Microsoft and Netskope

New

Learn how to configure and deploy Microsoft Entra and Netskope Security Service Edge (SSE) solutions together for optimized security and connectivity across private applications, Microsoft 365, and internet access.

11 June 2025

Microsoft Entra Workload ID

Conditional Access

Conditional Access Cloud Apps

Updated

Administrators can assign a Conditional Access policy to cloud apps from Microsoft as long as the service principal appears in their tenant. Some apps like [Office 365](#office-365) and [Windows Azure Service Management API](#windows-azure-service-management-api) include multiple related child apps or services. When new supported Microsoft cloud applications are created, they appear in the app picker list.

13 June 2025

1. Go to the system tray to check that Global Secure Access and Netskope clients are enabled.

14 June 2025

Fundamentals

Learn about integrations between Microsoft and Netskope.

New

A comprehensive guide for configuring and testing the integration between Microsoft's and Netskope's Secure Access Service Edge (SASE) solutions.

11 June 2025

Partner Ecosystems Overview

Updated

author: kenwith

11 June 2025

Netskope Coexistence

Removed

A Microsoft Entra documentation page was updated: Netskope Coexistence.

11 June 2025

Netskope Integration

Removed

A Microsoft Entra documentation page was updated: Netskope Integration.

11 June 2025

Security Copilot + Entra

1 update

Fundamentals

Copilot Entra Security Scenarios

Updated

Microsoft Security Copilot is a powerful tool that can help you manage and secure your Microsoft Entra identity environment. This article describes how to use Microsoft Security Copilot with Microsoft Entra in identity related scenarios to enhance your identity protection efforts. Using this feature requires a tenant with Microsoft Security Copilot enabled.

12 June 2025