Wednesday, 1 October 2025

ID Protection risk guidance and External ID monitoring setup were clarified; Global Secure Access documentation details connector-log export and a Graph-based category checker in​

1 October was a documentation-focused day: all nine supplied changes were Microsoft Learn updates, with no new or removed items and no Message Center entries. The most actionable updates concern ID Protection risk interpretation and reporting, External ID-to-Log Analytics integration, and Global Secure Access operations. The evidence does not support calling any item a GA launch, retirement, or mandatory tenant change; the web category checker is explicitly labeled preview.

• ID Protection · Fundamentals

  ID Protection documentation clarifies original source-IP context for risk detections

  The updated guidance states that Microsoft Entra ID Protection risk detections get a consistent view of the original user source IP address when assessing various risk scores. This is security and risk-interpretation guidance; the supplied evidence does not establish a change to scoring algorithms or tenant configuration.

• External ID · Fundamentals

  External ID monitoring guidance explains the extra Log Analytics integration path

  The Azure Monitor documentation explains that an external tenant uses Microsoft Entra monitoring but cannot have an associated subscription, so additional steps are needed to integrate it with Log Analytics, where the logs are sent. This is an operational setup clarification, not evidence of a newly launched monitoring capability.

• ID Protection · Monitoring

  ID Protection risk-export guidance points to workbook queries and visual insights

  The updated export guidance directs administrators to additional queries and visual insights based on the AADUserRiskEvents and AADRisky Users logs in the Impact analysis of risk-based access policies workbook. The evidence supports a monitoring and reporting clarification, not a confirmed change to logging or risk-policy behavior.

• Global Secure Access · Monitoring

  Global Secure Access connector-log export procedure calls out the Azure Arc setup script

  The revised Export Connector Logs procedure explicitly includes downloading the Azure Arc agent setup script from the Azure portal. Administrators performing connector-log exports should account for this documented prerequisite or step; the update does not indicate a change to connector functionality.

• Global Secure Access · General

  Global Secure Access documents a preview web-category checker through Microsoft Graph

  The updated preview guidance describes using a web category checker to determine which web content category a URL belongs to through Microsoft Graph. This is preview tooling for URL classification, not evidence of general availability or a change to web-content-filtering enforcement.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.