Wednesday, 27 May 2026

Agent ID blueprint limit clarified; 27 May otherwise centers on Entra Connect Health documentation

27 May 2026 was primarily a documentation-maintenance day. The clearest administrator-facing update is an Agent ID boundary of no more than 50 resource apps per agent identity blueprint. The larger Entra ID cluster refreshes Connect Health installation, AD FS, Sync and AD DS monitoring, reporting, data freshness, ports, topology and PTA guidance; an updated Groups page restates the dynamic-membership licensing prerequisite. The supplied evidence contains no Message Center item or removal and does not establish a new preview, general-availability release, retirement, security advisory or product-behavior change. Four new Entra ID entries titled “Purpose:” contain only an author string and provide no actionable release detail.

• Agent ID · General

  Agent ID: inheritable-permissions blueprints have a documented 50-resource-app ceiling

  The updated blueprint guidance sets a maximum of 50 resource apps per agent identity blueprint, including entries in the inheritablePermissions collection. It explicitly says to reduce the number of resource apps if the limit is exceeded. This is a supported-boundary clarification, not evidence of a new Agent ID preview or generally available capability.

• Entra ID · Authentication

  Connect Health’s AD FS sign-in reporting guidance was updated

  The page describes integrating AD FS sign-ins with the Microsoft Entra Connect Health sign-ins report. A related same-day update covers the AD FS risky IP report in Azure Monitor Workbooks. These are monitoring and security-documentation updates; the supplied evidence does not establish a new report launch or changed sign-in behavior.

• Entra ID · Authentication

  Connect Health PTA guidance reiterates multi-agent high availability

  The updated PTA page says that installing multiple agents provides high availability of sign-in requests. This is operational guidance for PTA deployments, not evidence of a newly introduced feature or a mandated topology change.

• Entra ID · Monitoring

  AD DS monitoring guidance enumerates supported Windows Server versions

  The updated Connect Health with AD DS page lists Windows Server 2016, 2019, 2022 and 2025 as supported versions. The supplied record does not say whether this list changed during the period, so this should be treated as a documentation clarification and support reference rather than a newly announced compatibility change.

• Entra ID · General

  Dynamic membership documentation restates the licensing prerequisite

  The updated Groups Create Rule page says dynamic membership groups require a Microsoft Entra ID P1 license or an Intune for Education license. It does not indicate a new licensing policy or entitlement change; it provides the prerequisite to use when reviewing dynamic-group deployments.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.