Friday, 21 November 2025

21 November 2025: Entra documentation clarifies federation limits, RDP access, and agent API consent

All 10 supplied records are Microsoft Learn updates; there are no new or removed records and no Message Center item. The period therefore reflects documentation clarification rather than a feature launch, preview, general-availability change, or retirement. The most consequential details concern a regional Workload ID restriction, an Entra ID Remote Desktop access limitation, the Agent ID API-consent model, and the guest-account consequence of external access-package assignment.

• Workload ID · Security

  Workload ID: regional limitation for federated identity credentials

  The updated Workload Identity Federation Considerations guidance says federated identity credentials cannot currently be created on user-assigned managed identities in certain regions. The supplied extract does not include the region names, so administrators should use the page’s region list when planning deployments. This is a documented constraint, not evidence of an availability expansion.

• Entra ID · General

  Entra ID: device-policy groups do not apply to Remote Desktop

  The updated Assign Local Admin guidance states that Microsoft Entra groups deployed to a device through this policy do not apply to Remote Desktop connections. To control RDP permissions on Microsoft Entra joined devices, it directs administrators to add the individual user’s SID to the appropriate group. This is a documented behavior caveat, not a reported new policy feature.

• Agent ID · Standards

  Agent ID: application API access is modeled through OAuth scopes and consent

  The assignment guidance explains that an application can expose an API and OAuth scopes, while the tool’s service principal can be granted consent to those scopes to call the API. For agent integrations, the concrete administrative concern is which scopes and consent are assigned; the update does not by itself establish a new release or availability stage.

• Entra ID · Authentication

  Entra ID Kerberos: an internet access scenario is spelled out

  The updated Kerberos page describes an Entra ID-joined Windows client accessing a file share or application over the internet, with Microsoft Entra ID issuing the necessary Kerberos tickets as a KDC associated with the resource. This is an architecture and scenario clarification; the supplied evidence does not say that tenant configuration or availability changed.

• ID Governance · Governance

  ID Governance: direct external assignment creates a guest account

  The access-package request-policy guidance says that, after an access package is created, administrators can directly assign internal or external users and that specifying an external user creates a guest user account in the directory. This is a lifecycle detail to account for when managing external assignments, not evidence of a new entitlement-management policy.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.