Error Codes
Doc updateThe error-code reference now documents AADSTS501581, which indicates that the selected external provider authentication method configuration does not exist or is not enabled.
Day in brief
Global Secure Access guidance moves QUIC handling to Custom Acquire and firewall blocking
Four Global Secure Access pages now align on a different QUIC operating pattern: keep browser QUIC enabled, acquire UDP 443 with Custom Acquire, and use a cloud firewall Block rule. The guidance identifies QUIC acquisition and blocking as preview capabilities and says end-to-end QUIC forwarding is unsupported. The other updates add AADSTS501581 to the Entra error reference and sharpen Agent ID governance guidance.
- Windows setup guidance now keeps browser QUIC enabled
Global Secure Access · GeneralThe Global Secure Access Windows client page directs administrators to use Custom Acquire for UDP 443 with a cloud firewall Block rule, link and apply the policies through Conditional Access, and keep DNS over HTTPS disabled for FQDN-based acquisition. It also records that QUIC acquisition and blocking are in preview and do not provide end-to-end QUIC forwarding.
- Health-check troubleshooting adds traffic-log and TCP-fallback checks
Global Secure Access · TroubleshootingThe health-check procedure replaces browser-level QUIC disabling with Custom Acquire and an enabled cloud firewall Block rule. It adds verification through traffic logs, including confirming a Block decision and TCP fallback.
- AADSTS501581 identifies missing or disabled external-provider configuration
Entra ID · TroubleshootingThe Entra ID error-code reference now defines AADSTS501581 as a condition where the selected external provider authentication method configuration does not exist or is not enabled, giving administrators a direct diagnostic for related sign-in failures.
- Agent ID governance clarifies service-principal policy scope
Agent ID · AuthenticationThe governance overview clarifies when to use an access package policy for service principals, renames its management section around delegated management, and adds a second Copilot Studio article link.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
6 updates
Microsoft Entra ID
1 updateMicrosoft Entra Agent ID
1 updateAgent Id Governance Overview
Doc updateThe overview adds a link to a second Copilot Studio article, clarifies when to use an access package policy for service principals, and renames the management section to focus on delegated management.
Microsoft Entra Global Secure Access
4 updatesCurrent Known Limitations
Doc updateAction requiredThe known-limitations page now says end-to-end QUIC forwarding is unsupported, while cloud firewall supports QUIC acquisition and blocking in preview. Administrators should keep browser QUIC enabled, use Custom Acquire for UDP 443 traffic, and apply a cloud firewall policy through the relevant security profile.
Install the Global Secure Access Client for Windows
Feature updateAction requiredThe documentation now directs administrators to keep browser QUIC enabled and use Custom Acquire with a cloud firewall Block rule for UDP 443. DNS over HTTPS must remain disabled for FQDN-based acquisition. QUIC acquisition and blocking are in preview and do not provide end-to-end QUIC forwarding.
Troubleshoot the Windows Global Secure Access client: Health check
Feature updateAction requiredThe guidance replaces browser-level QUIC disabling with Custom Acquire for UDP 443 and an enabled cloud firewall Block rule. It also adds verification steps using traffic logs and notes that QUIC acquisition and blocking are in preview, without end-to-end QUIC forwarding.
Troubleshoot Prompt Injection Protection
Feature updateAction requiredThe guidance changes from disabling browser QUIC to keeping it enabled, acquiring UDP 443 with Custom Acquire, and blocking matching traffic through cloud firewall. Administrators must verify acquisition, block decisions, TCP fallback, and the inspection certificate.