Wednesday, 20 May 2026

20 May 2026: Conditional Access migration guidance leads a documentation-focused Entra update

The clearest administrator-relevant change is the updated Microsoft Entra ID page on migrating from custom controls to external MFA, paired with an update to the page explaining custom controls. That pairing is useful for tenants already using the capability, but the supplied evidence does not announce deprecation, a retirement date, changed enforcement behavior, or a required migration. The other updates are ordinary documentation clarifications for Agent ID ownership and Global Secure Access licensing and IPv4 setup; no supplied item is identified as a new feature, preview, GA release, security advisory, or Message Center announcement.

• Entra ID · Conditional Access

  Conditional Access migration path to external MFA is documented

  The updated Entra ID Authentication page is specifically about moving from custom controls to external multifactor authentication. It gives the period a migration-oriented theme, but the record does not say that custom controls are retired, deprecated, or behaviorally changed, nor does it provide a deadline.

• Entra ID · Conditional Access

  Custom controls documentation updated as the companion reference

  The Conditional Access page covering how custom controls work was updated. Read with the migration page, it is a documentation reference for existing deployments; the supplied summary does not identify a new control, changed policy evaluation, or security requirement.

• Agent ID · General

  Agent ID ownership rules are spelled out

  The updated Agent ID guidance states that individual users, including guests, and service principals can be owners, while groups are not supported. Owners are optional for agent identity blueprints and agent identities, and service-principal ownership supports automated management. This is clarified ownership guidance, not evidence of a new owner capability.

• Internet Access · Fundamentals

  Global Secure Access fundamentals page includes license-to-profile mapping

  The updated What Is Global Secure Access page presents a comparison of Entra P1/P2 with the Microsoft traffic profile and separate Internet Access and Private Access licenses with their corresponding profiles. This is a reference-table clarification; no entitlement or availability change is stated.

• Global Secure Access · Fundamentals

  Global Secure Access IPv4-preferred setup tracking gets a registry check

  The updated page titled Track whether the IPv4-preferred setting was already correct includes an Edge policy registry check for BuiltInDnsClientEnabled as a DWORD with value 0 under HKLM\SOFTWARE\Policies\Microsoft\Edge. It is operational setup or troubleshooting guidance, not evidence that Global Secure Access changed its IPv4 behavior.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.