Content Security Policy
Updated- **Step 1**: Go through a sign-in flow with the dev console open to identify any violations.
Day in brief
26 November: Entra guidance sharpened agent governance, token claims, and LDAP SSL setup—no new release evidenced
This was a documentation-led period: 17 pages were updated, none were new, no Message Center items were supplied, and one External ID page was removed. The most substantive updates clarify governed access and ownership for agent identities, the documented OnTokenIssuanceStart flow for custom claims providers, and a certificate-permission prerequisite for on-premises LDAP connector SSL. External ID’s domain-acceleration note and the removal of the Solutions Customers page are documentation changes; the evidence does not establish a product retirement, new availability, or changed service behavior.
- Access packages are documented as the governance model for agent identities
Entra ID · StandardsUpdated Entra entitlement-management guidance describes access packages as a way to make agent access intentional, auditable, and time-bound, including standardized access for fleets of agents. This is a governance documentation clarification, not evidence of a new access-package or Agent ID capability becoming available. Organizations governing agent permissions can use the guidance when moving away from ad-hoc assignments.
- Agent ID guidance calls for maintained sponsors and owners
Agent ID · GeneralThe updated guidance says sponsors and owners should be assigned and maintained for each agent ID to prevent orphaned identities. This is lifecycle guidance rather than a stated enforcement change; organizations operating agent IDs should check that ownership is assigned and retained.
- Custom claims provider documentation clarifies OnTokenIssuanceStart
Entra ID · AuthenticationThe updated overview states that OnTokenIssuanceStart is triggered when a token is about to be issued, is configured within a custom claims provider, and can use a REST API to map claims from external systems into tokens for one or more applications. The change clarifies the documented flow rather than announcing a new event. Administrators using this capability should validate their event, provider, and application assignments against the description.
- LDAP connector SSL instructions add a certificate permission prerequisite
Entra ID · ProvisioningThe on-premises LDAP connector preparation guidance specifies that SSL requires granting NETWORK SERVICE read permission on the newly created certificate. This is deployment and security configuration guidance, not a product release. Teams setting up the connector with SSL should include this permission step.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
19 updates
Microsoft Entra ID
5 updatesCustom Extension Overview
UpdatedThe token issuance start event, **OnTokenIssuanceStart** is triggered when a token is about to be issued to an application. It is an event type set up within a [custom claims provider](custom-claims-provider-overview.md). The custom claims provider is a custom authentication extension that calls a REST API to fetch claims from external systems. A custom claims provider maps claims from external systems into tokens and can be assigned to one or many applications in your directory.
Microsoft Entra entitlement management provides access packages as a governance mechanism. Access packages ensure that agent access assignments are intentional, auditable, and time-bound. Access packages represent a structured approach to managing agent identity permissions, contrasting with ad-hoc permission assignments that might lack appropriate governance controls. Access packages enable standardized access for many AI Agents with the same access needs, for example, a fleet of customer support AI Agents. Through access packages, organizations can establish consistent governance practices for all agent identity resource access. For more information, see [Governing agent identities](/entra/id-governance/agent-id-governance-overview).
V2 Oauth2 On Behalf Of Flow
Updated"scope": "https://graph.microsoft.com/user.read",
In order to enable SSL to work, you need to grant the NETWORK SERVICE read permissions to our newly created certificate. To grant permissions, use the following steps.
Microsoft Entra Agent ID
2 updates- Ensure sponsors and owners are assigned and maintained for each agent ID, preventing orphaned agent IDs.
Security For Ai
UpdatedAgent proliferation creates a governance challenge termed "agent sprawl"—the uncontrolled expansion of agents across an organization without adequate visibility, management, or lifecycle controls.
Microsoft Entra ID Protection
1 update
Starting December 11, 2025, Microsoft Defender XDR will offer enhanced alert configuration for Entra ID Protection, allowing admins to filter alerts by risk level (High only, High + Medium, or All). The default will change to High risk only, reducing alert volume and improving clarity.
Microsoft Entra ID Governance
8 updatesCustom Extension Security
Updated1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](~/identity/role-based-access-control/permissions-reference.md#identity-governance-administrator).
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Catalog owner](../id-governance/entitlement-management-delegate.md#entitlement-management-roles) of the catalog where the custom extension will be located.
Follow these steps to create an Entitlement management catalog:
Follow these steps to create an Entitlement management catalog for the scenario.
Microsoft Entra External ID
2 updatesWhats New Docs
Updated- [Identity providers for external tenants](customers/concept-authentication-methods-customers.md) - Added domain acceleration information
Solutions Customers
RemovedA Microsoft Entra documentation page was updated: Solutions Customers.
Macos Client Release History
UpdatedTrack the latest updates and bug fixes for the Global Secure Access client for macOS. Stay informed about version changes and download instructions.