Daily.Entra.NewsMicrosoft Entra introduced preview guidance for Conditional Access policy plans, including creation, migration, shared conditions, exclusions, report-only review, and validation before enforcement. A separate Message Center notice says passkeys or passwordless sign-in can become a user’s first multifactor authentication method beginning with a phased rollout in November 2026. New Secure Cloud guides cover OIDC single sign-on and SCIM 2.0 provisioning; a lower-impact Private Access edit removed connector-offline troubleshooting, Sentinel analytics guidance, and a Windows service check from its operations page.
Entra ID · Conditional AccessThe preview supports creating plans from templates or from scratch, centralizing shared conditions and exclusions across related rules, reviewing rules in report-only mode, and enabling them. Creating, modifying, or deleting a plan requires the Conditional Access Administrator role.
Entra ID · Conditional AccessThe migration guidance explains how to consolidate selected Conditional Access policies, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
Entra ID · Conditional AccessMicrosoft Entra will allow users to register a passkey or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to configure alternate MFA methods first. The phased rollout begins in November 2026.
Entra ID · StandardsThe new guide covers OIDC prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification. It specifies that the enterprise application is created only after the initial Microsoft Entra sign-in and consent.
Entra ID · ProvisioningThe tutorial covers automatic user and group provisioning, updates, synchronization, and deprovisioning between Microsoft Entra ID and Secure Cloud, including prerequisites, credentials, and deployment scope.
Conditional Access administrators can organize related rules into plans and review generated behavior before enabling them; creating, modifying, or deleting plans requires the Conditional Access Administrator role. The passkey change alters the user registration path by removing the prior requirement to configure alternate MFA methods first. Secure Cloud administrators have new procedures for OIDC SSO and SCIM-based provisioning, while Private Access operators should not rely on the removed troubleshooting workflow.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
A new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins November 2026, aiming to simplify strong authentication adoption and reduce registration friction.
Microsoft added a step-by-step tutorial for configuring automatic user and group provisioning, updates, synchronization, and deprovisioning between Microsoft Entra ID and Secure Cloud using SCIM 2.0.
A new article explains how to configure Secure Cloud User Integration with Microsoft Entra ID using OIDC, including prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification.
The Private Access operations page no longer includes the row describing a connector offline condition, related Sentinel analytics guidance, or the Windows service check.
