Thursday, 14 May 2026

14 May: Conditional Access documentation details P2-required high-risk MFA guidance; Private Access documents connector-capacity thresholds

This was a documentation-only period: all six supplied entries were Microsoft Learn updates, with no new or removed items and no Message Center notices. The most consequential updates clarify Conditional Access agent guidance for risky sign-ins and policy coverage, Private Access connector-capacity response, Entra schema-extension limits, and the licensing prerequisite for ID Governance Account Discovery. The evidence does not identify a preview, general-availability release, retirement, or tenant-wide configuration change. The separate Agent ID update is setup guidance for users with the GitHub Copilot for Azure extension, not evidence of a launch.

• Entra ID · Conditional Access

  Conditional Access agent guidance now documents high-risk sign-in MFA suggestions

  Security guidance clarification: the updated page says the agent suggests a policy requiring multifactor authentication for high-risk sign-ins and states that Microsoft Entra ID P2 is required for this scenario. This describes agent guidance, not evidence that a policy was automatically created or deployed; administrators evaluating the suggestion should confirm the licensing dependency and validate the policy before rollout.

• Entra ID · Conditional Access

  Deep analysis guidance covers policy gaps, overlap, and exclusions

  Conditional Access analysis guidance clarification: deep analysis is documented as reviewing policies that block legacy authentication or device control flow and those requiring device or MFA controls. It evaluates user, group, and role coverage for gaps, redundant or overlapping policies, and consolidation opportunities, while also flagging broad exclusions and recommending explicit break-glass exclusions to reduce accidental-lockout risk. The update does not report changes to existing tenant policies.

• Private Access · Monitoring

  Private Access runbook specifies connector high-resource thresholds

  Operational guidance: the updated Operate Private Access page documents a connector-host alert condition of CPU above 80% or memory above 85% sustained for more than 15 minutes. The associated response is to check active sessions, redistribute load by adding another connector to the group, and investigate applications generating unusual traffic; Azure Monitor alerting is identified as the monitoring path.

• Entra ID · Developer

  Entra schema-extension limits are spelled out

  Service-limit clarification: string extensions are limited to 256 characters and binary extensions to 256 bytes; no more than 100 extension values across all types and applications can be written to one resource. The page also limits string or binary single-valued attributes to User, Group, TenantDetail, Device, Application, and ServicePrincipal entities, and states that DateTime extensions support only the equals operator, not range operators.

• ID Governance · Fundamentals

  Account Discovery licensing prerequisite is clarified

  Licensing clarification: the updated ID Governance guidance states that Account Discovery requires either the Microsoft Entra ID Governance add-on or Microsoft Entra Suite. The feature is described as finding existing accounts in target applications and identifying matching Entra accounts or orphan accounts, so teams planning that use should verify entitlement before proceeding.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.