Friday, 3 April 2026

Apple SSO compatibility guidance is the main action item; AI security guidance was updated and a Copilot security page was removed

The 3 April 2026 Entra ID record is documentation-led rather than a feature-release day: it contains 10 updates and one removal, with no new feature, preview, general-availability announcement, or Message Center item evidenced. The clearest administrator action concerns applications and MDM solutions that access Microsoft Entra device-registration keys through Keychain. Other notable changes are updated Conditional Access guidance for generative-AI security, a documented provisioning limitation, and removal of one Copilot security documentation page.

• Entra ID · Authentication

  Apple SSO guidance requires a compatibility update for Keychain-based integrations

  Updated Microsoft identity platform guidance says applications or MDM solutions that depend on accessing Microsoft Entra device-registration keys through Keychain must be updated to use the Microsoft Authentication Library (MSAL) and the Enterprise SSO plug-in to maintain compatibility. This is compatibility guidance for an existing integration path, not evidence of a new Apple SSO feature launch.

• Entra ID · Conditional Access

  Generative-AI security guidance now emphasizes least privilege and Conditional Access

  The updated Secure Generative AI architecture guidance directs organizations to enforce least privilege and use Conditional Access policies as the access-control mechanism, with examples such as requiring MFA or device compliance. The evidence supports a security-guidance clarification, not a new policy template, default, or availability change.

• Entra ID · Security

  A Copilot AI security documentation page was removed

  The Entra ID security page titled Policy All Users Copilot Ai Security is marked Removed. No replacement, rationale, or product retirement is supplied, so administrators should classify this as a documentation removal rather than evidence that the underlying Copilot policy or capability was retired.

• Entra ID · Authentication

  Provisioning passwords are recorded as unsupported

  An updated Entra ID Known Issues page states that provisioning passwords aren't supported. This documents a limitation rather than announcing a behavior change or feature; provisioning owners should not assume password provisioning is available, and the supplied evidence does not identify the affected connector scope or a workaround.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.