Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The period’s main development is a connected set of ID Governance guidance covering reusable configuration baselines, deployments to home or governed tenants, cross-tenant monitoring, asynchronous results, partial failures, and post-deployment validation. Separate Entra updates document the effects of Microsoft-provided SMS and voice retirement and add a procedure for restricting personal-account access to Copilot.
ID Governance · GovernanceNew guidance covers applying baseline settings to home and governed tenants, supported Entra and Exchange resources, asynchronous deployment statuses, partial failures, and post-deployment validation. Administrators can inspect resource-level results and validate the target configuration after deployment.
ID Governance · GovernanceThe new guidance describes creating, editing, versioning, and applying baseline templates to Tenant Governance monitors and deployments, including across governed tenants. It states that editing a template does not automatically update existing monitors or deployments and identifies role, licensing, baseline-data, permission, and governance-relationship prerequisites.
Entra ID · AuthenticationNew Entra guidance covers sign-in, password reset, NPS/RADIUS, passkey, and telephony-provider behavior as Microsoft-provided SMS and voice authentication changes roll out. Administrators should review authentication and recovery methods, policies, passkey compatibility, and telephony-provider migration.
Entra ID · GeneralThe updated procedure explains how to block personal Microsoft account access to Copilot by selecting its web, desktop, and mobile applications. It also documents client-side enforcement, supported clouds, and Apple and Google sign-in effects; the shared mobile application ID may affect Office and OneDrive sign-ins.
Entra ID · GovernanceMicrosoft Purview is scheduled to enable sensitivity labels for Microsoft Entra cloud security groups starting in mid-January 2027. Administrators must enable the feature separately and have appropriate licensing; labels cannot yet be changed or removed once applied.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation explains sign-in, password reset, NPS/RADIUS, passkey, and telephony-provider behavior as Microsoft-provided SMS and voice authentication changes roll out.
The documentation now links to guidance describing the user and administrator experience during retirement.
The page now explains how to block personal Microsoft account access to Copilot by selecting its web, desktop, and mobile applications, and notes the required client-side enforcement, supported clouds, and Apple/Google sign-in impact.
The Windows Autopilot sentence was revised from “isn’t be tagged” to “isn’t tagged” when describing devices without the ZTDID.
The identity governance deployment guide now links to the correct Governing Agent Identities page.
Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-January 2027. This allows applying label-based governance and access policies to these groups, enhancing protection and compliance. Admins must enable this feature separately and ensure proper licensing; labels cannot yet be changed or removed once applied.
The documentation no longer labels access package drift reports as being in preview or says their refresh schedule might change. It still states that reports refresh about once daily and may be up to 24 hours old.
The article describes how Microsoft Entra Agent ID, agent authentication, provisioning, and ID-JAG support access to third-party applications. It also invites partners and customers to share their current and planned support through a voluntary form.
The documentation describes creating, editing, versioning, and applying reusable configuration baseline templates to Tenant Governance monitors and deployments, including across governed tenants.
The documentation describes applying baseline settings to home and governed tenants, supported Entra and Exchange resources, asynchronous deployment statuses, partial failures, and post-deployment validation.
The documentation explains how to deploy approved baselines to home or governed tenants, including prerequisites, permissions, monitoring, and handling partial or failed deployments.
The guidance now covers using snapshots for baseline templates, monitors, and preview deployments. It specifies Global Administrator sign-in, naming rules, status and timestamps, and seven-day retention for snapshot jobs and generated snapshots.
The article now describes reusable configuration baseline templates, baseline deployments to home or governed tenants, and cross-tenant monitors. It also explains licensing coverage, tenant targeting, and required delegated permissions for monitoring other tenants.
The documentation now covers creating monitors for home and connected governed tenants, including target-tenant selection, governance relationships, delegated permissions, baseline templates, and governed-tenant naming rules. It also clarifies that Tenant Governance Premium is not required solely for cross-tenant monitoring.
The page distinguishes application permissions and Entra roles for snapshots and monitoring from delegated permissions required for deployments. It also adds requirements for governance relationships and delegated administration in governed tenants.
The documentation now distinguishes home-tenant and governed-tenant monitors, adds licensing and permission prerequisites, and explains that baseline changes hide prior results and drift records. Deletion stops future runs and removes the monitor without changing governed resources.
The documentation now covers monitor results and configuration drifts for home and governed tenants, including target-tenant filters, tenant-specific access requirements, licensing, and additional result details.
The article now consistently uses “multi-stage access reviews” in its title, descriptions, headings, text, and image alt text.
The guide now explicitly focuses on identity governance for employees and business guests, with a link to separate guidance for AI agent identity and access governance.
The guide title and heading now refer to governing privileged identities and their access.
The documentation now frames least privilege around identities, including human users, applications, and agents. It also adds delegation guidance describing entitlement management for access requests, assignments, reviews, and expiration.
The documentation introduces reusable baseline definitions for standardizing configurations across monitors and deployments, including versioning, approvals, cross-tenant use, and applying newer template versions.
