Wednesday, 4 November 2026

Managed-policy guidance adds scheduled enforcement details as External ID documents TOTP MFA

The most consequential update clarifies the stated behavior of an ID Protection managed policy left in Report-only: it will automatically enable itself on the communicated schedule, while naming its security group and excluding tenants with an enabled customer-managed user-risk policy. External ID guidance adds TOTP setup detail, cross-tenant synchronization guidance specifies role-assignable group mapping, and Zendesk provisioning guidance flags an API-token restriction and OAuth timing.

• ID Protection · Conditional Access

  Managed Policies guidance details scheduled enforcement and tenant exclusions

  The updated Conditional Access page names the managed policy’s security group, excludes tenants with an enabled customer-managed user-risk policy, and says the policy automatically enables itself on the communicated schedule if it remains in Report-only. Administrators should review the policy and security group before that schedule; no mandatory action is specified.

• External ID · Authentication

  External ID MFA guidance adds QR-code registration for TOTP

  The MFA in external tenants guidance now describes time-based one-time passwords as an MFA method, including QR-code registration and verification codes from Microsoft Authenticator or supported third-party authenticator apps. Administrators can use these documented steps when configuring TOTP as a second factor for customer users.

• External ID · Provisioning

  Cross-tenant synchronization guidance specifies role-assignable group mapping

  The updated preview guidance explains how to synchronize role-assignable groups by enabling the target setting and mapping isAssignableToRole during group creation. Source role assignments are not copied, and the mapping must be completed before assigning role-assignable groups.

• Entra ID · Provisioning

  Zendesk provisioning guidance flags API-token restrictions and OAuth timing

  The setup article now states that Zendesk restricted new API-token creation beginning October 27, 2026, provides an exception process, and targets OAuth client-credentials support for mid-December 2026. Administrators starting new provisioning integrations may need to request an API-token exception until OAuth support is available.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.