Daily.Entra.News
Aboutmerill.net
← Previous week
Next week →
Week in brief

Secure-default changes and Workload ID authentication retirement headline the week

The week of 14 July 2025 was dominated by documentation maintenance: 308 of 315 records were updates, including large batches covering Microsoft Entra Connect, Cloud Sync, pass-through authentication, and hybrid identity. Those entries mainly refresh existing procedures and references; the supplied evidence does not show a new feature launch, general-availability release, or new runtime behavior in that material. The clear operational exceptions are Microsoft 365 security-default changes and the retirement of service-principal-less authentication. Workload ID also received new isolation-scope documentation, while Microsoft identity platform guidance now explicitly steers applications away from implicit grant.

  • Entra ID · Authentication
    Microsoft 365 secure-by-default settings change

    Classification: Message Center major update and security-related behavior change. Microsoft 365 will update default settings to block legacy authentication protocols and require admin consent for third-party app access. The rollout starts in mid-July 2025 and completes by August 2025. The notice specifically calls for configuration assessment, stakeholder notification, documentation updates, and configuration of the Admin Consent workflow.

  • Workload ID · Authentication
    Service-principal-less authentication is being retired

    Classification: Workload ID retirement and authentication behavior change. Microsoft Entra ID will block authentication for non-Microsoft multitenant applications that lack a service principal in the tenant where they authenticate. The scenario is also called service-principal-less authentication; it is already disabled for most non-Microsoft applications, with this change addressing the remaining exceptions as a preventive security measure.

  • Workload ID · Security
    Isolation scope for user-assigned managed identities is newly documented

    Classification: new capability documentation, not a stated launch, preview, or general-availability announcement. New Workload ID pages explain isolation scope for user-assigned managed identities and how to configure it, describing security and resilience benefits. A related configuration page directs administrators to understand the benefits and implications first; the supplied evidence does not establish rollout status or require action.

  • Entra ID · Authentication
    Authentication security guidance was clarified without evidence of enforcement

    Classification: documentation and security guidance. Updated Microsoft identity platform guidance says not to use the implicit grant and points developers to authorization code with PKCE instead. New Entra pages also focus on securing the My Security Info MFA-registration page and restricting high-risk sign-ins, but their supplied records contain no implementation details. These entries support review of application and security guidance, not an inference that new Conditional Access controls or runtime enforcement‑

For Entra administrators

Prioritize the Microsoft 365 Message Center change: assess legacy-authentication and third-party app-consent configurations, notify stakeholders, update internal documentation, and configure the Admin Consent workflow. For Workload ID, identify non-Microsoft multitenant applications authenticating in a tenant without a service principal; authentication for that scenario is being blocked, although the behavior has already been disabled for most non-Microsoft applications. Organizations using user-assigned managed identities can evaluate the new isolation-scope guidance, but no availability status or mandatory migration is supplied. Application owners should review use of implicit grant, while recognizing that the documentation update does not state that Microsoft Entra has disabled the flow

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Provisioning

172

Factors influencing the performance of Microsoft Entra Connect

Updated

This document explains how various factors influence the Microsoft Entra Connect provisioning engine. These factors help organizations to plan their Microsoft Entra Connect deployment to make sure it meets their sync requirements.

18 July 2025

Tools used for synchronization

Updated

This article introduces the various tools that can be used to synchronize the cloud with on-premises environments.

18 July 2025

Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Corn…

Updated

A Microsoft Entra documentation page was updated: Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Cornerstone OnDemand so that I can streamline the user management process and ensure that users have the appropriate access to Cornerstone OnDemand..

18 July 2025

Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Sale…

Updated

A Microsoft Entra documentation page was updated: Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Salesforce Sandbox so that I can streamline the user management process and ensure that users have the appropriate access to Salesforce Sandbox..

18 July 2025

21869

Updated

When enterprise applications lack both explicit assignment requirements AND scoped provisioning controls, threat actors can exploit this dual weakness to gain unauthorized access to sensitive applications and data. The highest risk occurs when applications are configured with the default setting: "Assignment required" is set to "No" *and* provisioning isn't required or scoped. This dangerous combination allows threat actors who compromise any user account within the tenant to immediately access applications with broad user bases, expanding their attack surface and potential for lateral movement within the organization.

15 July 2025

General

50

Connect Fed Sha256 Guidance

Updated

This page provides guidelines for changing SHA algorithm for federation trust with Microsoft 365.

18 July 2025

Connect Sync Recycle Bin

Updated

This topic recommends the use of AD Recycle Bin feature with Microsoft Entra Connect.

18 July 2025

Microsoft Entra seamless single sign-on

Updated

This topic describes Microsoft Entra seamless single sign-on and how it allows you to provide true single sign-on for corporate desktop users inside your corporate network.

18 July 2025

Licensing Service Plan Reference

Updated

- **Service plans included (friendly names)**: A list of service plans (friendly names) in the product that correspond to the string ID and GUID

15 July 2025

Authentication

28

Microsoft 365 Upcoming Secure by Default Settings Changes

New

Microsoft 365 will update default settings to enhance security by blocking legacy authentication protocols and requiring admin consent for third-party app access. Changes start mid-July 2025 and complete by August 2025. Organizations should assess configurations, notify stakeholders, update documentation, and configure the Admin Consent workflow.

19 July 2025
Message CenterMC1097272 on mc.merill.net ↗Major updatePlan for change

Connect Password Hash Synchronization

Updated

The Cloud Password Policy for Password-Synced Users feature ensures that Microsoft Entra ID enforces its native password policies (such as expiration and lockout), for users whose passwords are synchronized from on-premises Active Directory. This feature enables you to align the same on-premises Active Directory password policy with the Microsoft Entra password policy, for synchronized users.

19 July 2025

Authentication for Microsoft Entra hybrid identity solutions

Updated

This guide helps CEOs, CIOs, CISOs, Chief Identity Architects, Enterprise Architects, and Security and IT decision makers responsible for choosing an authentication method for their Microsoft Entra hybrid identity solution in medium to large organizations.

18 July 2025

Connect Pta

Updated

This article describes Microsoft Entra pass-through authentication and how it allows Microsoft Entra sign-ins by validating users' passwords against on-premises Active Directory.

18 July 2025

Connect Pta User Privacy

Updated

This article deals with Microsoft Entra pass-through authentication and GDPR compliance.

18 July 2025

Connect Sync Change Addsacct Pass

Updated

This topic document describes how to update Microsoft Entra Connect after the password of the AD DS account is changed.

18 July 2025

Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Agile Provisioning so that I…

Updated

A Microsoft Entra documentation page was updated: Customer intent: As an IT administrator, I want to learn how to configure single sign-on between Microsoft Entra ID and Agile Provisioning so that I can control who has access to Agile Provisioning, enable automatic sign-in with Microsoft Entra accounts, and manage my accounts in one central location..

18 July 2025

Authorization Basics

Updated

Authorization logic is often implemented within the applications or solutions where access control is required. In many cases, application development platforms offer middleware or other API solutions that simplify the implementation of authorization. Examples include use of the [AuthorizeAttribute](/aspnet/core/security/authorization/simple?view=aspnetcore-5.0&preserve-view=true) in ASP.NET or [Route Guards](./scenario-spa-sign-in.md?tabs=angular2#sign-in-with-a-pop-up-window) in Angular.

17 July 2025

Msal Authentication Flows

Updated

| [Implicit grant](#implicit-grant) | User sign-in and access to web APIs on behalf of the user. *Do not use this flow - use authorization code with PKCE instead.* | * [Single-page app (SPA)](scenario-spa-app-registration.md) <br /> * [Web](scenario-web-api-call-api-app-registration.md) |

17 July 2025

Enable Passkey Fido2

Updated

- Metadata for FIDO2 security keys needs to be published and verified with the FIDO Alliance Metadata Service, and also pass another set of validation testing by Microsoft. For more information, see [Become a Microsoft-compatible FIDO2 security key vendor](/entra/identity/authentication/concept-fido2-hardware-vendor).

15 July 2025

Fundamentals

16

Configure Security

Updated

A Microsoft Entra documentation page was updated: Configure Security.

16 July 2025

Troubleshooting

8

Security

6

Policy All Users Copilot Ai Security

Updated

- [Manage Microsoft 365 for iOS and Android with Microsoft Intune](/intune/intune-service/apps/manage-microsoft-office#copilot-with-enterprise-data-protection)

17 July 2025

Network Considerations

Updated

Get-AzNetworkSecurityGroup -Name "nsg-name" -ResourceGroupName "resource-group-name" | Add-AzNetworkSecurityRuleConfig -Name "new-rule-name" -Access "Allow" -Protocol "TCP" -Direction "Inbound" -Priority "priority-number" -SourceAddressPrefix "CorpNetSaw" -SourcePortRange "*" -DestinationPortRange "3389" -DestinationAddressPrefix "*" | Set-AzNetworkSecurityGroup

15 July 2025

Monitoring

5

Standards

5

Domain Services Tls Enforcement

Updated

Microsoft is enhancing security by disabling TLS versions 1.0 and 1.1 as communicated on November 10, 2023. While the Microsoft implementation of TLS 1.0 and TLS 1.1 versions isn't known to have vulnerabilities, TLS 1.2 or later versions provide improved security features, including perfect forward secrecy and stronger cipher suites. This change helps protect customer data and ensures compliance with industry standards.

15 July 2025

Conditional Access

3

Mobile Sso Support Overview

Updated

In addition, enabling single sign-on in your app unlocks new authentication mechanisms that come with modern authentication, like [passwordless logins](~/identity/authentication/concept-authentication-passwordless.md). Usernames and passwords are one of the most popular attack vectors against applications, and enabling SSO allows you to mitigate this risk by enforcing Conditional Access or passwordless logins that add extra security or rely on more secure authentication mechanisms. Finally, enabling single sign-on also enables [single sign-out](v2-protocols-oidc.md#single-sign-out). This is useful in situations like work applications that will be used on shared devices.

17 July 2025

Developer

3

Architecture

1

Microsoft identity platform

1

Governance

5

Customize Workflow Email

Updated

1. On the pane that lists tasks, select the task for which you want to customize the email.

16 July 2025

Lifecycle Workflows Tasks Table

Updated

| [Remove all access package assignments for user](../id-governance/lifecycle-workflow-tasks.md#remove-all-access-package-assignments-for-user) | 42ae2956-193d-4f39-be06-691b8ac4fa1d | Leaver |

16 July 2025

Pim Create Roles And Resource Roles Review

Updated

:::image type="content" source="./media/pim-create-azure-ad-roles-and-resource-roles-review/current-v-series-setting.png" alt-text="Screenshot of the settings page under access reviews." lightbox="./media/pim-create-azure-ad-roles-and-resource-roles-review/current-v-series-setting.png":::

15 July 2025

Fundamentals

1

Whats New

Updated

**Service category:** Lifecycle Workflows

16 July 2025

Troubleshooting

1

Complete Access Review

Updated

> - User not found / other errors can also result in an apply result not being supported.

15 July 2025

Developer

1

Migrate Users

Updated

- If you are migrating from Azure AD B2C, the [seamless user migration sample](https://github.com/azure-ad-b2c/samples/tree/master/policies/migrate-to-entra-external-id-for-customers) repository on GitHub contains a seamless migration custom policy example and REST API code sample.

17 July 2025

General

2

Security

2

Authentication

1

Retire Service Principal Less Authentication

Updated

Microsoft Entra ID will block authentication for all non-Microsoft multitenant applications that don't have a service principal in the tenant where they're authenticating. This scenario is also known as service principal-less authentication. This behavior has already been disabled for most non-Microsoft applications. This change addresses a few remaining exceptions and is a preventive security measure.

16 July 2025

Fundamentals

1

Configure Managed Identities Isolation Scope

Updated

- Read the [Isolation scope for user-assigned managed identities](managed-identities-isolation-scope.md) concept article to understand the benefits and implications.

18 July 2025

General

1

Security

1

Conditional Access

1

Agent Optimization

Updated

The Security Administrator and Global Administrator roles have access to Security Copilot by default. You can assign Conditional Access Administrators with Security Copilot access. This authorization gives your Conditional Access Administrators the ability to use the agent as well. For more information, see [Assign Security Copilot access](/copilot/security/authentication#assign-security-copilot-access).

15 July 2025