Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The period centers on new and revised administrator guidance. External ID now has documented invitation-redemption routing through domain_hint, while Entra ID guidance covers Arkose anti-bot verification before telephony-based sign-in. Additional updates clarify Connector Groups routing scope, atypical-travel risk timing, and the causes of a Deactivated application status.
External ID · StandardsNew External ID guidance explains how the domain_hint authorization parameter routes invited external-tenant users to configured OpenID Connect, SAML/WS-Federation, or social identity providers. It covers invitations through Microsoft Graph or the admin center and custom invitation emails, and lists the external tenant, registered application, associated user flow, configured provider, and domain_hint value as prerequisites.
Entra ID · AuthenticationNew Entra ID guidance says users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls. It documents the user experience, network requirements, and help-desk guidance; restrictive firewalls, proxies, or web filtering may require HTTPS access to the specified Arkose Labs domains.
Global Secure Access · AuthenticationThe updated Global Secure Access guidance describes Performance mode as routing user traffic to the connector with the lowest measured network latency. It also clarifies that connector load balancing applies only to Microsoft Entra Private Access applications, not application proxy applications, and identifies the routing behavior as preview guidance.
ID Protection · FundamentalsThe ID Protection risk table now lists Atypical travel as “Real-time” instead of “Offline.” Its Premium requirement and unlikelyTravel identifier are unchanged, so administrators reviewing operational expectations should use the updated processing description.
Entra ID · DeveloperUpdated Entra ID application-property guidance says Deactivated can result from tenant-local sign-in disablement, app registration deactivation, or Microsoft disablement. These conditions can overlap and must be remediated independently, so the status label alone does not identify the underlying cause.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation explains when users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls, including user experience, network requirements, and help-desk guidance.
Microsoft added a conceptual guide describing macOS Platform SSO registration, Secure Enclave device keys, the Platform SSO PRT, app SSO, and the roles of MDM, macOS, the Microsoft Enterprise SSO plug-in, and Microsoft Entra ID.
The article now explains that disabling sign-in sets the service principal’s `accountEnabled` property to `false` and changes Activation status to Deactivated. It also adds steps to restore tenant-local sign-in and notes that other deactivation conditions can still apply.
The documentation now explains that Deactivated can result from tenant-local sign-in disablement, app registration deactivation, or Microsoft disablement. It also documents the related properties and clarifies that these conditions can overlap and must be remediated independently.
The article now distinguishes deactivating an app registration from disabling sign-in on a tenant-local service principal. It also explains that activation status includes tenant-local and Microsoft disablement, and that reactivating the app registration does not automatically restore tenant-local sign-in.
The documentation now describes adaptive learning for new users’ sign-in behavior and says detection is calculated in real time, replacing the previous learning-period and offline-calculation details.
The risk detection table now lists Atypical travel as “Real-time” instead of “Offline.” Its Premium requirement and unlikelyTravel identifier are unchanged.
The documentation date was updated, and the report description now refers to users and agent IDs when explaining direct access and active assignment mismatches.
The page now explains self-service sign-up through a user flow and invitation redemption through a custom OIDC provider using the domain_hint authorization parameter.
The article now highlights testing the user flow as the primary next step and adds links for adding applications, managing custom attributes, and routing invited users to an external identity provider.
New guidance explains how to use the domain_hint parameter to route invited external-tenant users to configured OpenID Connect, SAML/WS-Federation, or social identity providers. It covers prerequisites, invitations through Microsoft Graph or the admin center, and custom invitation emails.
The documentation now clarifies that invited users from another Microsoft Entra tenant use the default redemption flow unless an application explicitly routes them to a custom OIDC provider. The related link was also updated.
The documentation adds Performance mode, which routes user traffic to the connector with the lowest measured network latency. It also clarifies that connector load balancing applies only to Microsoft Entra Private Access applications, not application proxy applications.
