Wednesday, 18 June 2025

18 June: no new Entra entries; notable updates clarify MFA fraud controls, B2B claims, workload federation, and access-package visibility

This was a documentation-led day: 19 items were updated, no items were new, and the Cloudknox Permissions Management Platform Tutorial was removed from the Entra ID documentation set. The most consequential content is guidance or behavior clarification rather than a feature launch, preview, or general-availability announcement. Highlights include regional telephony-fraud protections, the home-tenant UPN behavior for B2B token claims, cloud-specific workload-federation audiences, and an access-package visibility notice for changes effective September 30, 2025. The large group of activity, sign-in, provisioning, streaming, and Log Analytics updates appears to clarify existing monitoring and analysis paths.

• Entra ID · Authentication

  Entra ID telephony-fraud guidance documents regional opt-in requirements

  Security guidance explains that Microsoft Entra ID uses heuristics and machine learning to detect and throttle suspicious telephony activity during MFA. It also states that some regions require opt-in through a support ticket because of elevated fraud risk. This is an updated guidance page, not evidence of a newly launched or generally available feature.

• External ID · Authentication

  External ID clarifies the UPN claim issued for B2B users

  The Claims Mapping update clarifies that when a B2B user authenticates with an external Microsoft Entra identity and an application uses `user.userprincipalname` as the source attribute, Microsoft Entra ID issues the UPN from the user’s home tenant. Applications that depend on a particular UPN value for B2B identities should verify their token-handling assumptions.

• Workload ID · Developer

  Workload ID federation guidance lists cloud-specific audience values

  The updated managed-identity app-trust guidance says the audience must match the cloud: `api://AzureADTokenExchange` for the global service, `api://AzureADTokenExchangeUSGov` for US Government, or `api://AzureADTokenExchangeChina` for China operated by 21Vianet. Workload identity federation owners should validate the configured audience for each target cloud.

• ID Governance · Fundamentals

  ID Governance documentation flags access-package visibility changes for September 30

  The revised Entitlement Management guidance explains that which access packages users can discover and request in the My Access portal depends on several settings, and highlights important changes effective September 30, 2025. The supplied evidence does not specify the new rules, so this is an advance notice to review current visibility configuration rather than a basis for assuming a particular setting will change.

• Entra ID · Authentication

  Entra Connect authentication guidance points to modern credentials

  The updated Entra ID article explains how the Microsoft Entra Connect application can authenticate to Microsoft Entra ID using modern, more secure credentials. The evidence identifies an implementation-guidance update but does not name a credential type or migration deadline, so Connect administrators should review the revised procedure before changing configuration.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.