Tuesday, 7 April 2026

Day in brief

Entra guidance says custom controls do not satisfy MFA claims and clarifies the 240-policy Conditional Access limit

The 7 April period contained six updated Microsoft Learn pages, with no new or removed items and no Message Center announcements. This was documentation-led rather than a feature launch: the strongest operational guidance concerns migrating custom-control deployments to external authentication methods and counting Conditional Access policies in every state toward the tenant limit. Other meaningful updates cover Certificate-Based Authentication’s revocation dependency and Workload ID licensing for user-based service accounts; the remaining admin-center and custom-controls overview updates show no specific rollout or behavior change in the supplied summaries.

Entra ID · Authentication
Custom controls do not satisfy multifactor authentication claim requirements
The updated Entra ID Managed Policies guidance states that custom controls do not satisfy multifactor authentication claim requirements and identifies external authentication methods as their replacement. Organizations using custom controls are directed to migrate, with an external provider that supports external authentication methods and supplies integration guidance. This is security and configuration guidance, not evidence of a dated retirement.
Entra ID · Conditional Access
The Conditional Access ceiling includes policies in every listed state
The updated Plan Conditional Access page says the 240-policy-per-tenant limit includes policies that are report-only, on, or off. Policies that are not currently enforcing access therefore still count toward the stated capacity. This is a capacity and planning clarification, not an announced new limit.
Entra ID · Authentication
Certificate-Based Authentication has a configuration-dependent CRL dependency
The Resilience In Credentials guidance notes that Certificate-Based Authentication requires a revocation check in most cases, depending on configuration, creating an external dependency on the certificate revocation list distribution point. Resilience assessments for affected CBA configurations should account for that dependency.
Workload ID · Conditional Access
Workload ID guidance documents licensing for service-account Conditional Access
The Mandatory Multifactor Authentication page describes a path for customers applying Conditional Access to user-based service accounts: reclaim the user-based license and add a Workload Identities license to apply Conditional Access for workload identities. This is licensing and configuration guidance, not evidence of a new Workload ID launch.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

6 updates

Microsoft Entra ID

5 updates

Authentication

Managed Policies

Updated

[Custom controls don't satisfy multifactor authentication claim requirements](controls.md#creating-custom-controls). If your organization uses custom controls you should [migrate to external authentication methods](/entra/identity/authentication/how-to-authentication-external-method-manage), the replacement of custom controls. Your external authentication provider must support external authentication methods and provide the necessary configuration guidance for integration.

Resilience In Credentials

Updated

|Certificate Based Authentication (CBA)|In most cases (depending on configuration) CBA will require a revocation check. This adds an external dependency on the CRL distribution point (CDP) |[Understanding the certificate revocation process](~/identity/authentication/concept-certificate-based-authentication-certificate-revocation-list.md#enforce-crl-validation-for-cas)|

Conditional Access

Custom controls in Microsoft Entra Conditional Access

Updated

Learn how custom controls in Microsoft Entra Conditional Access work.

Plan Conditional Access

Updated

Creating a policy for each app isn't efficient and makes managing policies difficult. Conditional Access has a limit of 240 policies per tenant. This 240-policy limit includes Conditional Access policies in any state, including report-only mode, on, or off.

Fundamentals

Microsoft Entra admin center

Updated

Overview of the Microsoft Entra admin center interface for configuring and managing Microsoft Entra products.

Microsoft Entra Workload ID

1 update

Conditional Access

Mandatory Multifactor Authentication

Updated

Some customers apply Conditional Access policies to user-based service accounts. You can reclaim the user-based license, and add a [workload identities](~/workload-id/workload-identities-overview.md) license to apply [Conditional Access for workload identities](~/identity/conditional-access/workload-identity.md).