Tuesday, 19 May 2026

Entra ID documents non-interruptible Conditional Access agent runs; agent, certificate, Global Secure Access, and OIDC guidance also updated

19 May 2026 was a documentation-update day: all 10 tracked items were updates, with no new, removed, or Message Center entries. The most specific operational clarification is that an Entra ID Conditional Access Agent Optimization run cannot be stopped or paused after it starts and may take a few minutes. Other meaningful updates cover Conditional Access for Agent ID, certificate-revocation troubleshooting, Global Secure Access connector routing, and GitHub Enterprise Managed User OIDC provisioning. The evidence does not establish a new feature launch, preview, general availability milestone, retirement, or service-side behavior change.

• Entra ID · Conditional Access

  Conditional Access Agent Optimization: runs are non-interruptible once started

  The Entra ID documentation update states that after the agent starts, an optimization run cannot be stopped or paused and may take a few minutes. This is an operational documentation clarification, not evidence of a newly launched or generally available capability.

• Agent ID · Conditional Access

  Conditional Access for agent identities: Zero Trust guidance updated

  Updated Agent ID guidance describes applying Conditional Access to agent identities to extend Zero Trust principles to AI agents and support secure access and governance. The supplied record does not establish a preview, general availability status, or new control; administrators governing agent access should review the guidance.

• Entra ID · Authentication

  Certificate-based authentication: revoked-certificate troubleshooting is more explicit

  The updated Entra ID guidance maps AADSTS500183 to a client certificate revoked by its issuing CA and directs administrators to provision and trust a replacement certificate and keep published CRLs and delta CRLs current and accessible to devices. This is security and troubleshooting guidance rather than a reported service change.

• Global Secure Access · Fundamentals

  Global Secure Access connector groups: routing choices documented

  For connector groups with multiple connectors, the updated documentation says the group selects which connector handles each request and lists Random as the default routing option alongside Session persistence. Administrators should verify their intended routing configuration; the evidence does not say that the service default changed.

• Entra ID · Provisioning

  GitHub Enterprise Managed User OIDC: provisioning test-app guidance

  The updated Entra ID tutorial directs administrators to add GitHub Enterprise Managed User (OIDC) from the application gallery for provisioning. An existing SSO app can be reused, but the guidance recommends creating a separate app when initially testing the integration; this is tutorial guidance, not evidence of a new integration launch.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.