Week of 1 September 2025 — Entra.News Daily

Week in brief

Azure DevOps Conditional Access targeting and Azure-resource MFA enforcement define an otherwise documentation-heavy week

The week of 1 September 2025 is dominated by Learn maintenance: 880 items were updated, only one was marked new, and two Message Center notices contain the clearest operational consequences. One changes how Conditional Access applies to Azure DevOps sign-ins; the other schedules MFA for Azure resource-management actions. The supplied evidence does not establish a new preview, general-availability launch, or retirement for the remaining updates.

Entra ID · Conditional Access
Conditional Access targeting for Azure DevOps sign-ins is changing
A 5 September Microsoft 365 Message Center major update says Microsoft Entra will stop applying Conditional Access policies via Azure Resource Manager for Azure DevOps sign-ins from 2 September, with full enforcement by 18 September. Administrators must explicitly include Azure DevOps, application ID 499b84ac-1321-427f-aa17-267ca6975798, in relevant policies to maintain the stated access controls. This is a documented behavior change and action notice, not a routine documentation edit.
Entra ID · General
MFA enforcement is scheduled for Azure resource-management actions
A 6 September Message Center notice says Microsoft will enforce MFA for all Azure resource-management actions starting 1 October 2025. The supplied guidance calls for users to enable MFA, Azure CLI and PowerShell updates, and Azure Policy assessment, with a postponement option until July 2026. Gallatin customers are specifically advised to implement MFA without enforcement. This is security and enforcement guidance rather than evidence of a new Entra feature launch.
ID Protection · Authentication
Entra agent documentation records concrete licensing and workflow boundaries
Updated agent documentation states that the Conditional Access optimization agent requires at least Microsoft Entra ID P1. The ID Protection risky-user scenario, which suggests a policy requiring secure password change for high-risk users, requires Microsoft Entra ID P2. Updated ID Governance pages describe the Access Review Agent gathering insights and recommendations in Teams and exposing a 30-day summary of agent actions. These entries clarify documented requirements and operation; they do not identify a preview
Entra ID · Provisioning
A new Learn article documents GitHub Enterprise Server provisioning
The 5 September new Entra ID article explains automatic provisioning and de-provisioning of user accounts to GitHub Enterprise Server, while a related GitHub Enterprise Server SSO tutorial was updated. The evidence supports a new documentation path, not a claim that a connector or capability reached preview or general availability.
Entra ID · Conditional Access
The broad Conditional Access refresh does not itself signal another policy change
Updated pages cover resilience defaults, adaptive session lifetime policies, audit-log troubleshooting, the What If tool, report-only mode, phishing-resistant MFA for administrators, and Conditional Access session architecture. The supplied summaries identify the subjects but do not state a changed default, rollout stage, or retirement, so no additional tenant configuration action can be inferred from these updates alone.

For Entra administrators

Review Conditional Access policies that rely on Azure Resource Manager for Azure DevOps and explicitly include the Azure DevOps application ahead of full enforcement on 18 September. Prepare users and automation for the 1 October Azure resource-management MFA requirement, including the stated Azure CLI and PowerShell updates, and use Azure Policy to assess impact. For Entra agent scenarios, verify the documented P1 and P2 licensing boundaries. The other Learn changes should be treated as reference updates unless their detailed page diffs show a tenant-specific change; the two removed items have no supplied detail from which to infer a retirement.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Microsoft Entra ID

871 updates

General

613

Github Enterprise Server Tutorial

Updated

* GitHub Enterprise Server supports **SP** and **IDP** initiated SSO.

5 September 2025

3 September 2025

3 September 2025

3 September 2025

author: nguhiu

3 September 2025

Proactis Rego Invoice Capture Tutorial

Updated

author: nguhiu

3 September 2025

3 September 2025

Conditional Access

Copilot Entra Agents

Updated

- You must have at least the [Microsoft Entra ID P1](licensing.md) license for the Conditional Access optimization agent.

6 September 2025

Microsoft Entra: Action Required – Update Conditional Access Policies for Azure DevOps Sign-ins

New

Updated

Conditional Access App Control uses a reverse proxy architecture and is uniquely integrated with Microsoft Entra Conditional Access. Microsoft Entra Conditional Access allows you to enforce access controls on your organization’s apps based on certain conditions. The conditions define what user or group of users, cloud apps, and locations and networks a Conditional Access policy applies to. After you determine the conditions, you can route users to Microsoft Defender for Cloud Apps where you can protect data with Conditional Access App Control by applying access and session controls.

3 September 2025

3 September 2025

Microsoft identity platform

Group Source Of Authority Configure

Updated

| **Roles** | [Hybrid Administrator](/entra/identity/role-based-access-control/permissions-reference#hybrid-administrator) is required to call the Microsoft Graph APIs to read and update SOA of groups.<br>[Application Administrator](/entra/identity/role-based-access-control/permissions-reference#application-administrator) or [Cloud Application Administrator](/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator) is required to grant user consent to the required permissions to Microsoft Graph Explorer or the app used to call the Microsoft Graph APIs. |

5 September 2025

Whats New Docs

Updated

Welcome to what's new in the Microsoft identity platform documentation. This article lists new articles that were added or had significant updates in the last three months.

4 September 2025

Troubleshooting

Configure MX3 Diagnostics Connector for automatic user provisioning with Microsoft Entra ID

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to MX3 Diagnostics Connector.

3 September 2025

Microsoft Entra ID Protection

1 update

Authentication

Agent Optimization

Updated

- **Risky users**: The agent suggests a policy to require secure password change for high risk users. Requires Microsoft Entra ID P2 license.

6 September 2025

Microsoft Entra ID Governance

4 updates

Governance

Access Review Agent

Updated

Say goodbye to time-consuming research and the uncertainty of rushed decisions. The Access Review Agent works for your reviewers by automatically gathering insights and generating recommendations. It then guides reviewers through the review process in Microsoft Teams with natural language, with simple summaries and proposed decisions, so they can make the final call with confidence and clarity.

6 September 2025

Create Access Review Pim For Groups

Updated

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).

6 September 2025

Check Workflow Execution Scope

Updated

1. On the Execution conditions page, select the **Execution User Scope** tab.

4 September 2025

Fundamentals

Access Review Agent Logs Metrics

Updated

To view information about the Access Review Agent, open up the Access Review Agent to get to the overview page. The highlight of the overview page is the Agent summary, which provides a quick summary of agent actions over the course of the last 30 days.

6 September 2025

Microsoft Entra External ID

2 updates

Authentication

Azure Information Protection: Enable multifactor authentication for your Azure tenant by October 1, 2025

New

Microsoft will enforce multifactor authentication (MFA) for all Azure resource management actions starting October 1, 2025, with a postponement option until July 2026. Users must enable MFA, update Azure CLI/PowerShell, and can apply Azure Policy to assess impact. Gallatin customers are advised to implement MFA without enforcement.

6 September 2025

Message CenterMC1143999 on mc.merill.net ↗Stay informed

General

Tenant Restrictions V2

Updated

> [!NOTE]

6 September 2025

Microsoft Entra Global Secure Access

The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the iOS client app.

3 September 2025

Fundamentals

Remote Network Connectivity

Updated

Guest devices on your network might not have the client installed. To ensure that those devices adhere to your network security policies, you need their traffic routed through the Global Secure Access endpoint. Remote network connectivity solves this problem. No clients need to be installed on guest devices. All outgoing traffic from the remote network is going through security evaluation by default.

4 September 2025