Thursday, 4 June 2026

4 June: Agent-aware access and governance guidance sharpened; no new Entra release was recorded

All eight recorded items were Microsoft Learn updates, with no new or removed entries and no Message Center notices. The most substantive changes clarify Conditional Access signals for agents, autonomous-agent policy targeting, and the resource roles available in Agent Access Packages. An External ID passkey page also documents a user capability around viewing registered passkeys. The supplied evidence does not identify a launch, general-availability event, retirement, or tenant behavior change.

• Agent ID · Conditional Access

  Agent ID Conditional Access guidance now describes agent-aware risk evaluation

  The updated guidance describes Conditional Access evaluating both users and agents through context, device, location, and session-risk signals, with possible outcomes including allowing, blocking, limiting, or requiring additional verification. This is a documentation update, not evidence of a new release or changed tenant behavior. Teams governing agent access should use the clarified model when reviewing existing policy design.

• Entra ID · General

  Autonomous-agent policies are documented as targeting all or selected agent users

  The Entra ID policy guidance explicitly identifies two targeting choices: all agent users or a selected set of agent users. This clarifies policy scope for implementation and audits, but the evidence does not indicate whether the behavior is new, in preview, or generally available.

• Agent ID · Governance

  Agent Access Packages clarify supported resource-role types

  The updated instructions say agent-identity access packages can include security group memberships, directory roles, or API permissions as resource roles. The API-permission path is marked as preview in the linked guidance, and the excerpt warns not to add application roles. Administrators designing agent entitlements should validate that assignments use the documented role types.

• External ID · Authentication

  External ID passkey guidance now includes viewing registered passkeys

  The Sign In With Passkey update includes the step that users can view their registered passkeys. The supplied record does not establish a new authentication flow, rollout status, or administrative configuration requirement, so this should be treated as a documentation clarification unless it differs from an existing implementation.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.