Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The strongest additions are provisioning-focused: new Microsoft Graph beta guidance covers inspecting and removing stored source-to-target connections, while a new HR timeout article traces delays across HR retrieval, provisioning agents, and on-premises Active Directory. Other meaningful updates clarify cross-tenant consequences for Agent ID blueprints, device- and browser-dependent passkey prompts, and DNS and site prerequisites for Cloud Sync. Global Secure Access changes are mainly navigation updates for Explicit Forward Proxy settings.
Entra ID · ProvisioningNew Entra ID guidance explains how to inspect or remove stored source-to-target connections for provisioning jobs. It identifies required identifiers and permissions, includes recovery steps, and states that deleting a connection does not delete either object.
Entra ID · TroubleshootingA new article covers intermittent timeouts and slow provisioning from Workday, SAP SuccessFactors, and API-driven HR integrations to on-premises Active Directory. Its checklist covers job status, provisioning agents, matching attributes, domain controllers, DNS, connectivity, logs, and required roles.
Agent ID · GeneralThe updated procedure uses Disable > Disable in all tenants and specifies that related agents in other tenants can fail or lose functionality when a multi-tenant blueprint is globally disabled.
Entra ID · AuthenticationThe authentication guidance now explains that system-preferred authentication considers the current device and browser, prioritizes accessible local passkeys, and handles Windows Hello for Business and macOS Platform SSO device-bound credentials by platform.
The prerequisites now identify incorrect DNS, subnet-to-site mappings, and site configuration as causes of synchronization failures, performance issues, and intermittent connectivity. They direct administrators to map agent-server subnets correctly in Active Directory Sites and Services.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
New documentation explains how to inspect or remove stored source-to-target connections for provisioning jobs, including required identifiers, permissions, and recovery steps. The API is available through Microsoft Graph beta and deleting a connection does not delete either object.
A new reference lists source and target identifiers for provisioning scenarios, their required formats, and how to use them with Microsoft Graph to inspect or delete connections.
The article now explains that system-preferred authentication considers the user’s current device and browser, prioritizes accessible local passkeys, and handles device-bound credentials such as Windows Hello for Business and macOS Platform SSO by platform.
The prerequisites now explain how incorrect DNS, subnet-to-site mappings, or site configuration can cause provisioning synchronization failures, performance issues, and intermittent connectivity. It directs administrators to correctly map agent server subnets in Active Directory Sites and Services.
A new article explains how to diagnose intermittent timeouts and slow provisioning from Workday, SAP SuccessFactors, and API-driven HR integrations to on-premises Active Directory. It covers job status, provisioning agents, matching attributes, domain controllers, DNS, connectivity, and relevant logs.
The documentation now explains that globally disabling a blueprint can cause related agents in other tenants to fail or lose functionality. It also adds steps for disabling a blueprint in the Microsoft Entra admin center.
The documented procedure now uses **Disable** > **Disable in all tenants** and specifies that the impact applies to multi-tenant blueprints.
The documentation now states that tenant administrators or Microsoft can revoke application credentials, including credentials stolen or added by a threat actor.
The configuration instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy instead of Session management.
The documented path changed from Global Secure Access > Session management > Explicit Forward Proxy to Global Secure Access > Connect > Explicit Forward Proxy.
The instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy, replacing the previous Session Management path and tab selection.
