Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The day's substantive change is a coordinated rewrite of Cloud Sync migration guidance: Device Sync is identified as a current guided-tool blocker, while Microsoft separates guided, manual, and deferred paths from broad platform capability comparisons. The guidance also tightens coexistence and validation rules. Elsewhere, Identity Protection documents a real-time detection for suspiciously added authentication methods, and security guidance clarifies the limits on reactivating Microsoft-disabled applications.
Entra ID · ProvisioningThe Cloud Sync migration decision guide distinguishes what the platform supports from what the guided migration tool can transfer. It identifies Device Sync as a current guided-tool blocker and directs administrators toward guided, manual, or deferred migration paths based on prerequisites and readiness.
Entra ID · MonitoringThe topology guidance says the services may coexist during phased migration, but must not simultaneously export normal changes for the same object and attribute set. Migration and reference validation should be complete before administrators remove objects from Connect Sync scope.
ID Protection · FundamentalsThe risk-detection page now describes a real-time detection for suspiciously added authentication methods. It raises user risk and can trigger configured risk-based policies; the page lists Microsoft Entra ID P2 as required, with that requirement pending confirmation.
Entra ID · SecurityThe consent-phishing guidance says tenant administrators cannot reverse Microsoft disablement by setting accountEnabled to true or reactivating the app registration. It directs application publishers and users to the appropriate support routes instead.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.
The tutorial now emphasizes manual migration for test or pilot environments, directs eligible customers to the guided migration tool, adds scope-removal and source-anchor guidance, clarifies device migration coverage, and links related migration resources.
The article now explains that it covers configuring Device Sync in Microsoft Entra Cloud Sync, not transferring Device Sync with the guided migration tool. It links to the tool’s prerequisites.
The documentation now directs administrators to a migration decision guide, guided-tool eligibility checks, or manual phased migration guidance. It also clarifies scope protection, reference validation, and migration-result verification.
The guide now distinguishes platform capability comparisons from what the guided migration tool can transfer. It identifies device synchronization as a current guided-tool blocker and adds separate guidance for guided, manual, or deferred migration paths.
The documentation now states that tenant administrators cannot reverse Microsoft disablement by enabling tenant-local sign-in or reactivating the app registration.
The page now directs Connect Sync users to review the decision guide, validate guided-tool prerequisites, and choose a supported guided or manual migration path. It also links the migration FAQ and separates Device Sync review from guided-tool eligibility.
The documentation now explains that Connect Sync and Cloud Sync may coexist during a phased migration, but must not simultaneously export normal changes for the same object and attribute set. It adds links to manual migration steps and scope-removal planning.
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
The documentation now describes a real-time Identity Protection detection for suspiciously added authentication methods. It raises user risk and can trigger configured risk-based policies; the page lists Microsoft Entra ID P2 as required, pending confirmation.
The documentation now lists the `suspiciousCredentialAddition` risk event type instead of `TBD` and revises the detection description. Metadata and customer intent were also updated.
