Daily.Entra.News
Aboutmerill.net
← Previous week
Next week →
Week in brief

Teams group-chat authentication is the week’s main Entra behavior rollout; most other changes are administrator guidance

The week of 13 October 2025 is dominated by Microsoft Learn maintenance: 35 updated entries, two new pages, one Microsoft 365 Message Center notice, and no removed entries. The meaningful product change is the scheduled Microsoft Teams group-chat agent and bot support for Microsoft Entra authentication. The strongest operational exceptions are updates to Group Source of Authority and Microsoft Entra Connect guidance, along with security and Global Secure Access troubleshooting material. Nothing supplied is labeled preview or general availability, and no retirement is announced. The two new Entra ID pages—SharePoint Backup Administrator and Exchange Backup Administrator—contain only their titles in the supplied excerpts, so they are new documentation, not evidence of newly introduced roles or permissions. Most remaining External ID and Native Authentication edits are screenshots, prerequisites, examples, and setup/reference clarification.

  • Microsoft Entra ID / Microsoft TeamsTeams group-chat agents and bots are scheduled to gain Entra authentication

    The Microsoft 365 Message Center notice says Microsoft Teams group-chat agents and bots will support Microsoft Entra authentication starting November 3–6, 2025. The feature is enabled by default and requires no admin action. Users who lack the Teams app or Entra consent will receive a private prompt to install the app and grant permissions. This is an explicit scheduled behavior rollout; the notice does not identify it as preview or general availability.

  • Microsoft Entra ID — Group Source of Authority and provisioningGroup Source of Authority guidance adds app-auth automation and AD DS mapping detail

    The updated Microsoft Entra ID Import Groups module documentation provides a PowerShell script for automating Group Source of Authority updates with app-based authentication. Related configuration guidance says that when a group is provisioned back to AD DS, administrators should preserve the OU path and set it in the Group Provision to AD configuration with the appropriate mapping. This is a workflow and documentation clarification, not evidence of a newly launched provisioning capability.

  • Microsoft Entra ID — Microsoft Entra ConnectMicrosoft Entra Connect host prerequisites and support caveats are spelled out

    The current prerequisite guidance states that Microsoft Entra Connect must run on a domain-joined Windows Server 2022, 2019, or 2016 host, with Windows Server 2022 recommended. It calls out Windows Server 2016 as being in extended support, notes that a paid support program might be needed for a supported configuration, and warns that unsupported versions may cause service failures or unexpected behavior. The supplied change is support and prerequisite guidance, not a retirement announcement.

  • Microsoft Entra ID — passwordless, FIDO2 attestation, and app consentPasswordless, FIDO2, and consent-policy documentation adds security planning detail

    The Remove Passwords from Microsoft Entra ID page was updated with password scrambling guidance for deploying passwordless and phishing-resistant authentication. The FIDO2 attestation page explains requirements for preparing hardware for attestation with Microsoft Entra ID. Separately, the Manage App Consent Policies page states that updates to the consent policy will have at least 30 days of notice. These are security and governance documentation updates; no new enforcement, deprecation, preview, or GA status is‌​

  • Global Secure AccessGlobal Secure Access connector troubleshooting documentation describes richer diagnostics

    Updated Troubleshoot Connectors material documents certificate details when a certificate is valid, tenant and connector IDs, TLS versions, retries, and exception messages for connectivity failures. A sample UI output section is marked as starting with version 1.5.4522.0. This makes the troubleshooting procedure more concrete, but it is documentation and tool-output clarification rather than an announced connector release or required client upgrade.

For Entra administrators

The Teams notice says no admin enablement is required; the main tenant-visible effect is that users without the Teams app or Entra consent will receive a private prompt to install the app and grant permissions. For deployments using Group Source of Authority or Microsoft Entra Connect, the updated documentation provides concrete workflow and host-support checks. Security teams working on passwordless or FIDO2 authentication can use the refreshed guidance, and Global Secure Access operators gain more documented troubleshooting signals. The supplied evidence does not support a mandatory tenant change, client upgrade, RBAC assignment, or retirement.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

General

14

Permissions Reference

Updated

> | [Dynamics 365 Business Central Administrator](#dynamics-365-business-central-administrator) | Access and perform all administrative tasks on Dynamics 365 Business Central environments. | 963797fb-eb3b-4cde-8ce3-5878b3f32a3f |

17 October 2025

User Source Of Authority Configure

Updated

:::image type="content" border="true" source="media/how-to-user-source-of-authority-configure/event-6956.png" alt-text="Screenshot of event ID 6956.":::

16 October 2025

Prerequisites

Updated

You need the following to use Microsoft Entra Cloud Sync:

15 October 2025

Authentication

4

Import Groups module

Updated

You can use the following PowerShell script to automate Group SOA updates by using app-based authentication.

16 October 2025

Fundamentals

3

Microsoft identity platform

2

Quickstarts Free Trial Note

Updated

If you don't have an [Azure subscription](/azure/guides/developer/azure-developer-guide#understanding-accounts-subscriptions-and-billing), create an [Azure free account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn) before you begin.

14 October 2025

Provisioning

2

Group Source Of Authority Configure

Updated

If you want to provision the group back to AD DS, plan to complete the following steps to preserve the OU Path and set it in the **Group Provision to AD** configuration with the right mapping:

14 October 2025

Developer

1

Governance

1

Connect Install Prerequisites

Updated

- Microsoft Entra Connect must be installed on a domain-joined server that runs Windows Server 2022, Windows Server 2019, or Windows Server 2016. We recommend Windows Server 2022. You can deploy Microsoft Entra Connect on Windows Server 2016. However, since Windows Server 2016 is in extended support, you might need [a paid support program](/lifecycle/policies/fixed#extended-support) if you require support for this configuration. Installing on unsupported versions of Windows Server may cause service failures or unexpected behavior.

15 October 2025

Standards

1

Authentication

1

Integrate Fraud Protection

Updated

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Extensibility Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-extensibility-administrator) or [Application Administrator](/entra/identity/role-based-access-control/permissions-reference#application-administrator).

18 October 2025

Branding

1

Authentication Methods Customers

Updated

The following screenshots show the sign-in with Apple experience. In the sign-in page, users select **Sign-in with Apple**. Then the user is redirected to the Apple identity provider to complete the sign-in.

15 October 2025

Fundamentals

1

Solutions Customers

Updated

Microsoft Entra External ID offers solutions that let you quickly add intuitive, user-friendly sign-up and sign-up experiences for your consumer and business customer apps. The Woodgrove Groceries demo environment illustrates several of the most common authentication experiences that can be configured for your apps.

16 October 2025

Provisioning

1

Known Issues

Updated

zone_pivot_groups: app-provisioning-cross-tenant-synchronization

15 October 2025

General

1

Points Of Presence

Updated

The Global Secure Access service is accessed from the Global Secure Access client and is used for Microsoft Entra Internet Access (including Microsoft 365) and Microsoft Entra Private Access traffic. The Internet Protocol (IP) addresses are listed.

17 October 2025

Troubleshooting

3

Troubleshoot Connectors

Updated

The tool also provides additional information, such as certificate details (if the cert is valid), tenant and connector ID, and TLS versions. To ensure that no checks are missed due to network or intermittent issues, the tool contains retries and prints out exception messages for any connectivity failures.

16 October 2025

General

1

Install Windows Client

Updated

The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.

17 October 2025

Security

1

Transport Layer Security

Updated

```openssl x509 -req -in <CSR file> -CA rootCAchain.pem -CAkey rootCAchain.key -CAcreateserial -out signedcertificate.pem -days 370 -sha256 -extfile openssl.cnf -extensions signedCA_ext```

18 October 2025