Friday, 29 May 2026

29 May 2026: device-code-flow security guidance leads; other edits clarify policy scope and documentation

All four records are updates to Microsoft Learn documentation, with no new, removed, or Message Center items. The most consequential update is security guidance for the Entra ID Microsoft-managed policy covering device code flow. A second meaningful clarification says contractors are governed by policies separate from the Conditional Access baseline. The Workload ID assignment instruction and External ID supported-features material appear to be procedural or reference documentation maintenance; the supplied evidence does not indicate a new feature, preview, general availability release, retirement, or changed service behavior.

• Entra ID · Developer

  Managed Policies documentation highlights device code flow as an attack vector

  The updated Entra ID Managed Policies page says device code flow is rarely used by customers but frequently used by attackers, and states that enabling the Microsoft-managed policy helps remove this attack vector. This is updated security guidance, not evidence of a newly launched policy or an automatic enforcement change.

• Entra ID · Conditional Access

  Conditional Access guidance separates contractor coverage from the baseline

  The updated Conditional Access Agent Optimization Knowledge Base states that contractors are governed by their own policies, separate from the baseline. Administrators should check contractor-specific policy coverage rather than assume the baseline applies; the record does not show that Conditional Access enforcement behavior itself changed.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.