Daily.Entra.NewsThe week of 20 October 2025 is a documentation-only period in the supplied data: 20 Microsoft Learn records were updated, with no new or removed items and no Message Center notices. The most consequential update is an Entra ID resilience and security clarification: the backup authentication system cannot perform a fresh certificate revocation list (CRL) check and instead uses the CRL state from the last backed-up session. Other substantive updates describe ID Governance workflows and a Workday provisioning setting. The evidence does not establish any launch, preview, general availability, retirement, or underlying service-behavior change.
The updated Entra ID architecture guidance says the backup authentication system cannot perform fresh CRL checks. It relies on the CRL result recorded when the session was last backed up; when revocation is needed before that backup expires, administrators should explicitly revoke the session. This is security guidance describing the documented fallback behavior, not evidence that the service behavior changed.
The ID Governance article describes an Access Review Agent that gathers insights, generates recommendations, and guides reviewers in Microsoft Teams with natural-language summaries and proposed decisions. Reviewers still make the final call. The supplied update provides capability documentation but gives no preview, general availability, or rollout information.
The updated ID Governance guidance covers creating a custom extension backed by an Azure Logic App, assigning its system-assigned identity a role in the catalog, editing the Logic App action to perform the business logic, and testing the workflow. This is implementation guidance; the record does not indicate a newly released capability or changed availability.
The Entra ID provisioning article specifically instructs administrators to enable the Termination Lookahead query for a Workday-to-AD or Workday-to-Microsoft Entra ID provisioning job. The evidence supports treating this as integration configuration guidance rather than a new provisioning-feature announcement.
If a session must be revoked before the backup expires, the documented action is to explicitly revoke the session rather than wait for a fresh CRL check. Administrators configuring Workday provisioning or entitlement-management dynamic approval can use the specific procedure updates, while the Access Review Agent article should not be treated as evidence of a tenant-wide rollout or availability status. Several remaining edits are ordinary documentation clarification, including External ID sign-in screenshots, a Conditional Access Save-button step, Global Secure Access sign-in and script instructions, and author, include-file, or checklist changes.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
To enhance its resilience posture, the backup authentication system can't perform fresh revocation checks. Instead, it relies on the state of the certificate revocation list (CRL) check that's performed when the session was last backed up. If you need to revoke before this backup expires, you should explicitly revoke the session instead of waiting for the CRL.
* A soft-deleted object isn't restored within 30 days.
author: MicrosoftGuyJFlo
author: MicrosoftGuyJFlo
To assign a group to an enterprise app, replace `Get-EntraUser` with `Get-EntraGroup` and replace `New-EntraUserAppRoleAssignment` with `New-EntraGroupAppRoleAssignment`.
include file
| App or service | Limitations |
1. At the bottom of the main **Settings** page, select the **Save** button.
author: MicrosoftGuyJFlo
There are several ways that you might manage applications in Microsoft Entra ID. The easiest way to start managing an application is to use a preintegrated application from the Microsoft Entra gallery, for both SaaS and on-premises or private cloud hosted applications. Developing your own application and registering it in Microsoft Entra ID is an option.
A Microsoft Entra documentation page was updated: Whats New Archive.
Before integrating applications with Microsoft Entra ID, it's important to know where you are and where you want to go. The following questions are intended to help you think about your Microsoft Entra application integration project.
> [!div class="checklist"]
Enable Termination Lookahead query for your Workday-to-AD/Microsoft Entra ID provisioning job.
Learn how to show suggested access packages to users in My Access so they can quickly find the most relevant access packages.
This article walks you through making a custom extension, its underlying Azure Logic App, setting its system-assigned identity and role in the catalog, editing the logic app action to perform business logic, and testing to see if it runs successfully.
Say goodbye to time-consuming research and the uncertainty of rushed decisions. The Access Review Agent works for your reviewers by automatically gathering insights and generating recommendations. It then guides reviewers through the review process in Microsoft Teams with natural language, with simple summaries and proposed decisions, so they can make the final call with confidence and clarity.
The following screenshots show the sign-in with Google experience. In the sign-in page, users select **Sign-in with Google**. At that point, the user is redirected to the Google identity provider to complete the sign-in.
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
<summary>PowerShell installation script</summary>
