A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Conditional Access policy plans preview centers shared targeting and staged rule validation
The period’s main development is a three-article Entra ID guidance set for Conditional Access policy plans in preview. The material covers the capability’s shared targeting model, creation and migration workflows, and validation before enforcement. A separate Entra ID guide covers Secure Cloud User Integration SSO, while a Private Access operations update removes one connector troubleshooting workflow.
- Policy plans centralize shared targeting and exclusions
Entra ID · Conditional AccessNew preview guidance describes policy plans as groups of related Conditional Access rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; no action is required from the overview alone.
- Creation workflow adds template-based setup and report-only reviewEntra ID · Conditional Access
Administrators can create plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable the plan. Creating, modifying, or deleting a plan requires the Conditional Access Administrator role.
- Migration keeps original policies active during validationEntra ID · Conditional Access
The migration procedure consolidates selected Conditional Access policies into a plan, then lets administrators review shared conditions and generated rules before enforcement. The original policies remain unchanged and continue evaluating independently.
- Secure Cloud User Integration guidance specifies consent-gated SSO setup
Entra ID · StandardsThe new guide covers OIDC prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification. It specifies that the enterprise application is created only after the initial Microsoft Entra sign-in and consent.
- Private Access page removes connector-offline troubleshooting workflow
Private Access · GeneralThe updated operations page no longer includes the connector offline condition, related Sentinel analytics guidance, or the Windows service check. Administrators should avoid relying on that removed troubleshooting workflow.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
5 updates
Microsoft Entra ID
4 updatesCreate a Conditional Access policy plan (preview)
Public previewA new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
A new article explains how to configure Secure Cloud User Integration with Microsoft Entra ID using OIDC, including prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification.
Microsoft Entra Private Access
1 updateOperate Private Access
Doc updateThe Private Access operations page no longer includes the row describing a connector offline condition, related Sentinel analytics guidance, or the Windows service check.