Daily.Entra.NewsAll 41 recorded changes for 1 May were Microsoft Learn documentation updates; there were no new, removed, or Message Center records. The main substantive thread is a coordinated Microsoft Entra ID Governance refresh for Tenant Governance (preview), covering setup, tenant discovery, governance relationships, and configuration monitoring. This indicates expanded preview guidance, not general availability or a product launch. Other notable updates clarify Security Defaults token revocation, Workload ID Conditional Access scope, Combined registration behavior, and an Agent ID logging capability listed as new without availability details.
ID Governance · GovernanceUpdated ID Governance guidance describes Tenant Governance from setup through tenant discovery, governance, and configuration monitoring. The wider preview documentation set adds material on governance relationships, related-tenant signals, monitors, configuration drift, and licensing. These are documentation updates for a capability explicitly labeled preview; the evidence does not establish GA or a production rollout.
Entra ID · AuthenticationThe updated Entra ID guidance says administrators should revoke all existing tokens when enabling Security Defaults. This forces previously authenticated users to authenticate again and register for multifactor authentication, using the documented Revoke-MgUserSignInSession cmdlet in Microsoft Graph PowerShell. This is security guidance and documentation clarification, not a new feature announcement.
Workload ID · Conditional AccessThe updated guidance says Conditional Access can apply to single-tenant service principals registered in the tenant. Non-Microsoft SaaS and multitenant apps are out of scope, and managed identities are not covered. A separate Workload ID update also states that, without appropriate licenses, existing workload-identity policies continue to function but cannot be modified.
Entra ID · AuthenticationUpdated Entra ID guidance states that Combined registration requires all MFA-capable users to strongly authenticate before registering or managing security information. The record presents this as a documented default behavior and does not say that the behavior changed during this period.
Agent ID · AuthenticationThe updated Ignite 2025 What's New page lists sign-in and audit logs for agents as New. This is an explicit new-capability reference, but the supplied record is only a documentation entry and provides no preview or GA status, availability date, prerequisites, or rollout details.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
As part of enabling security defaults, administrators should revoke all existing tokens to require all users to register for multifactor authentication. This revocation event forces previously authenticated users to authenticate and register for multifactor authentication. This task can be accomplished using the [Revoke-MgUserSignInSession](/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession) cmdlet in the Microsoft Graph PowerShell SDK.
By default, Combined registration enforces all MFA-capable users to strongly authenticate prior to registering or managing their security info.
Frontline workers in many companies use shared devices to do inventory management and sales transactions. Sharing devices reduces the IT burden of provisioning and tracking them individually. With shared device sign-out, it's easy for a frontline worker to securely sign out of all apps on any shared device before handing it back to a hub or passing it off to a teammate on the next shift. Frontline workers can use Microsoft Teams to view their assigned tasks. Once a worker signs out of a shared device, Intune and Microsoft Entra ID clear all of the company data so the device can safely be handed off to the next associate. You can choose to integrate this capability into all your line of business [iOS](/entra/msal/objc/shared-devices-ios) and [Android](~/identity-platform/msal-shared-devices.md) apps using the [Microsoft Authentication Library](~/identity-platform/msal-overview.md).
1. Ensure the application is accessible. Sign in directly from the browser on the connector host using the internal URL defined in the Azure portal. If the sign-in succeeds, the application is accessible.
**Service category:** User Experience and Management
In addition, use the Active Directory Federation Services (AD FS) in the Azure portal to discover AD FS apps in your organization. Discover unique users that signed in to the apps, and see information about integration compatibility.
- [Synchronize users in multitenant organizations in Microsoft 365](/microsoft-365/enterprise/sync-users-multi-tenant-orgs)
>
* [Configure group claims for applications by using Microsoft Entra ID](../hybrid/connect/how-to-connect-fed-group-claims.md)
There's a known issue where there's a preexisting, unregistered account, like `user@contoso.com` in Microsoft Edge, or if a user signs in without registering using the Heads Up Page, then the account isn't properly enrolled in MAM. This configuration blocks the user from being properly enrolled in MAM.
- [Sign-in and audit logs for agents](../agent-id/sign-in-audit-logs-agents.md) (New)
Learn how Microsoft Entra Tenant Governance automatically establishes governance relationships when you create add-on tenants using secure tenant creation.
Learn about configuration management capabilities in Microsoft Entra Tenant Governance, including baselines and drift monitoring
Learn how to create a new Microsoft Entra tenant using the secure add-on tenant creation workflow in Tenant Governance
Learn how to create and configure a tenant configuration monitor in Microsoft Entra Tenant Governance to track configuration drift
Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring
Learn how to enable tenant discovery in Microsoft Entra Tenant Governance to identify related tenants across your organization
Learn about governance relationships and how they enable centralized management of tenants in Microsoft Entra Tenant Governance
Learn how to interpret tenant discovery data, signals, and metrics in Microsoft Entra Tenant Governance to assess related tenants
Learn which Microsoft Entra Tenant Governance features are available with each license tier, including P1, P2, and ID Governance
Learn how Microsoft Entra Tenant Governance discovers related tenants through identity, application, and billing signals across your organization
Learn how to view monitor results and detect configuration drifts in Microsoft Entra Tenant Governance using the admin center
Learn how to set up the required application permissions and roles for tenant monitoring in Microsoft Entra Tenant Governance
Learn about the signals and metrics used in Microsoft Entra Tenant Governance to identify and evaluate related tenants
Learn how to terminate a governance relationship between tenants in Microsoft Entra Tenant Governance and understand what resources are removed
Learn how to update an existing governance relationship between a governing and governed tenant in Microsoft Entra Tenant Governance
Learn how to update or delete a configuration monitor in Microsoft Entra Tenant Governance when baselines or requirements change
Learn about cross-tenant delegated administration and how it enables centralized management across tenants in Microsoft Entra
Learn about governance policy templates and how to use them to enforce consistent governance across tenants in Microsoft Entra
Learn how to set up a governance relationship between a governing and governed tenant using the handshake process in Microsoft Entra
Learn how to use cross-tenant delegated administration to sign in to and manage governed tenants using your governing tenant credentials
**May**:
1. Select a role you want to assign, select a member you want to assign to the role, and then select **Next**.
Learn how to monitor and audit governing tenant administrator activity in your governed tenant using sign-in and audit logs
Learn about Microsoft Entra Tenant Governance and how it helps organizations discover, manage, and govern tenants across their environment
"requestedCredentials": [
The portal verifies that `did.json` is reachable and correct when you select **Refresh registration status**. You should also consider verifying that you can request that URL in a browser to avoid errors like not using HTTPS, a bad TLS/SSL certificate, or the URL not being public. If the `did.json` file can't be requested anonymously in a browser or via tools such as `curl`, without warnings or errors, the portal won't be able to complete the **Refresh registration status** step.
> In directories without appropriate licenses, existing Conditional Access policies for workload identities continue to function, but can't be modified. For more information, see [Microsoft Entra Workload ID](https://www.microsoft.com/security/business/identity-access/microsoft-entra-workload-identities#office-StandaloneSKU-k3hubfz).
A workload identity is an identity that allows an application or service principal access to resources, sometimes in the context of a user. Conditional Access policies can be applied to single tenant service principals registered in your tenant. Non-Microsoft SaaS and multitenant apps are out of scope. Managed identities aren't covered by policy.
1. Install Microsoft Authenticator from the App Store and register the device to the tenant or install the Company Portal app (no device enrollment required).
