Wednesday, 8 April 2026

Conditional Access guidance changes for patched Windows 11 23H2; the rest is targeted administrator documentation

8 April was a documentation-maintenance period rather than a release day: all 24 supplied records are updates, with no new or removed items and no Message Center notices. The most consequential item is revised Entra ID Conditional Access guidance for Windows 11 version 23H2 with KB5034848 or later. Other substantive updates cover a Windows App Protection/MAM enrollment caveat, break-glass account exclusions, and the location of authentication-context targeting controls. The page titled “Add a Microsoft Entra ID tenant as an OpenID Connect identity provider (Preview)” was updated, but the evidence does not establish a new preview rollout, general availability, retirement, or changed availability.

• Entra ID · Conditional Access

  Windows 11 23H2 Conditional Access exclusion guidance is revised

  The updated Entra ID authentication guidance says the authentication prompt normally occurs after a device has been offline for an extended period, and that Windows 11 version 23H2 with KB5034848 or later no longer needs an exclusion in the Conditional Access policy. It also says a policy can still be used when the administrator does not want the authentication prompt delivered as a toast notification. This documents a behavior change; it is not evidence of a new Entra feature launch.

• Entra ID · Security

  Windows App Protection documentation flags a MAM enrollment failure mode

  The updated Entra ID policy guidance identifies a known issue: a pre-existing, unregistered account in Microsoft Edge, or a user who signs in without registering through the Heads Up Page, is not properly enrolled in MAM; this configuration blocks proper enrollment. Administrators relying on Windows app protection should validate the affected sign-in and enrollment paths.

• Entra ID · Fundamentals

  Application-filter instructions explicitly exclude emergency-access accounts

  The updated Filter For Applications instructions direct administrators to use Exclude > Users and groups and select the organization’s emergency-access or break-glass accounts. This is security configuration guidance for protecting recovery access, not evidence of a new filtering capability or enforcement change.

• Entra ID · Conditional Access

  Published authentication-context targeting path is clarified

  The Conditional Access cloud-apps documentation states that administrators select published authentication contexts under Assignments > Target resources, using the Select what this policy applies to menu. This is a navigation and configuration clarification; the supplied evidence does not indicate that authentication contexts entered preview or general availability on this date.

• Entra ID · Conditional Access

  Policy example pages point administrators to common Conditional Access templates

  The updated Policy Block By Location page shows a link to the shared Conditional Access templates reference, and similar link-only updates appear on several other policy-example pages. This is ordinary documentation organization; the supplied evidence does not show a change to those policies’ defaults or enforcement behavior.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.