Configure Microsoft Entra Kerberos trust
Doc updateThe documentation now covers prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, and trust removal.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Key rotation reaches general availability while baseline enforcement guidance adds a Graph query
The strongest changes affect trust authentication, Conditional Access scoping, and Agent ID troubleshooting. Updated What's New guidance describes key rotation for incoming trust referral flows as generally available, improving reliability and addressing failures when referral tickets use a secondary key. Enforcement Resource Exclusions guidance records that baseline-scope enforcement rollout began June 15, 2026, and adds a Microsoft Graph query. New Agent ID how-to articles cover autonomous and interactive sign-ins, while a separate Kerberos trust guide details setup and lifecycle operations. The standalone Kerberos Server Key Rotation article was removed, and access-package guidance now clarifies a limitation on overlapping automatic-assignment policies.
- Generally available key rotation addresses secondary-key referral failures
Entra ID · AuthenticationThe updated What's New guidance says key rotation for incoming trust referral flows is generally available. It describes the change as improving reliability and addressing authentication failures caused when referral tickets use a secondary key; no required administrator action is stated.
- Baseline enforcement rollout gains a policy-discovery query
Entra ID · Conditional AccessEnforcement Resource Exclusions guidance now states that baseline-scope enforcement rollout began June 15, 2026. It adds a Microsoft Graph query for finding affected Conditional Access policies and clarifies customization and sign-in review guidance.
- Autonomous Agent ID sign-ins get preview health-investigation guidance
Agent ID · AuthenticationA new how-to explains Health Monitoring signals and alerts, impact criteria, log correlation, troubleshooting, and prerequisites for autonomous agent sign-ins. The monitoring and alerts are documented as being in preview, with guidance for identifying affected applications and investigating application-only authentication failures.
- Kerberos trust guidance covers setup through trust removalEntra ID · Authentication
The new guide documents prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, trust removal, and required permissions for managing trust between Microsoft Entra ID and on-premises AD DS.
- Automatic assignment policies must not overlap for matched users
ID Governance · GovernanceEntitlement Management guidance now clarifies that multiple automatic assignment policies for one access package are supported only when users do not match multiple policies simultaneously. Administrators should review overlapping policy scopes to avoid duplicate assignment paths.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
9 updates
Microsoft Entra ID
6 updatesWhats New
Generally availableThe documentation states that generally available key rotation improves reliability for incoming trust referral flows and addresses authentication failures caused when referral tickets used a secondary key.
Howto Investigate Health Scenario Alerts
Doc updateThe health scenario alerts guide now links to guidance for Agent ID interactive sign-ins and autonomous sign-ins.
Kerberos Server Key Rotation
Doc updateThe standalone article describing Kerberos server-key rotation, prerequisites, dual-key behavior, and the Set-AzureADKerberosServer procedure was deleted.
Enforcement Resource Exclusions
Doc updateThe documentation now states that baseline-scope enforcement rollout began June 15, 2026. It adds a Microsoft Graph query for finding affected Conditional Access policies and clarifies customization and sign-in review guidance.
Manage Device Identities
Feature updateThe documentation now states that any user can use **Download devices** to export a CSV of devices, with optional filters; without filters, all devices are included.
Microsoft Entra Agent ID
2 updatesInvestigate Agent ID autonomous sign-ins
Doc updateAdds a how-to article explaining Health Monitoring signals and alerts, log correlation, impact criteria, troubleshooting, and prerequisites for autonomous agent sign-ins. The monitoring and alerts are documented as being in preview.
A new how-to explains how to interpret Health Monitoring signals, correlate agent properties with sign-in and audit logs, and mitigate common failures. It also identifies the relevant non-interactive sign-in logs and documents licensing and role prerequisites.
Microsoft Entra ID Governance
1 updateThe documentation now clarifies that multiple automatic assignment policies for one access package are supported only when users do not match multiple policies simultaneously.