Java
Updatedauthor: Dickson-Mwendia
Day in brief
Global Secure Access documents AI-agent discovery in preview; Entra updates reinforce ROPC migration and identity guidance
17 June 2026 was primarily a documentation-maintenance day: 30 items were updated and one new item appeared, with no removals or Message Center entries. The substantive exceptions are a new Global Secure Access preview description, explicit security guidance for deprecated ROPC, and concrete clarifications for Agent ID’s identity model and dynamic-group limits. The supplied evidence does not establish a general-availability launch, retirement, or broad tenant behavior change.
- Global Secure Access: AI agent discovery is documented as a preview
Global Secure Access · FundamentalsA new Microsoft Learn entry describes AI agent discovery in Global Secure Access (preview), providing network-level visibility into managed and shadow AI agents reaching the internet from the environment. It is explicitly preview documentation, not evidence of general availability or a required deployment.
- Security guidance: ROPC is deprecated for desktop apps
Entra ID · AuthenticationAn updated Entra ID article explains how the username-and-password (ROPC) flow works in desktop apps, why it is deprecated, and how to migrate to more secure authentication flows. This is security guidance, not evidence that ROPC was retired on this date or that tenant behavior changed; affected applications should be identified for migration planning.
- Documentation clarification: Agent ID identity and token model
Agent ID · AuthenticationAn updated Agent ID platform overview describes an OAuth 2.0- and OpenID Connect-compliant authentication service that issues tokens for resource and API access, supporting application-only and delegated scenarios. It also defines the agent identity blueprint, agent identity, and agent’s user account as core constructs. This clarifies fundamentals rather than announcing a new availability milestone or tenant setting.
- Dynamic-group guidance states a 50-member-group cap
Entra ID · GeneralThe updated member-of dynamic-group guidance states that each dynamic group can have up to 50 member groups. The supplied record does not say whether this is a new service limit or a clarification of an existing rule, so administrators using member-of rules should verify designs against the stated cap without assuming a behavior change.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
32 updates
Microsoft Entra ID
13 updates.NET
Updatedauthor: Dickson-Mwendia
Groups Dynamic Membership
Updated| `jobTitle` |Any string value or `null` | ```user.jobTitle -eq "value"``` |
ai-usage: ai-assisted
- Each dynamic group can have up to 50 member groups.
Ai Reader
Updated- Read AI-related enterprise services, extensibility, and copilot agents
Learn how to configure daemon apps that call web APIs using secrets, certificates, or client assertions.
Learn how autonomous agents acquire tokens using the Microsoft Entra ID Auth SDK (sidecar) to call downstream APIs independently.
This article shows the new and updated documentation for the Microsoft Entra application management.
Understand how the username and password (ROPC) flow works in desktop apps, why it is deprecated, and how to migrate to more secure authentication flows.
Conditional Access Grant
Updated> [!NOTE]
ai-usage: ai-assisted
What If Tool
Updated**Has filter** indicates whether the policy has app filters that use custom security attributes.
Microsoft Entra Agent ID
16 updates- [Microsoft Entra ID Auth SDK (sidecar) documentation](/entra/msidweb/agent-id-sdk/overview)
What Is Agent Id Platform
Updated- **Authentication service**: An OAuth 2.0 and OpenID Connect (OIDC) standard-compliant authentication service that enables secure, standards-based authentication for agents. This service issues tokens that agents use to authenticate to resources and APIs, supporting both application-only and delegated access scenarios. There are three objects that form the core identity constructs in the platform: agent identity blueprint, agent identity, and agent's user account.
author: Dickson-Mwendia
author: Dickson-Mwendia
To call an API from an agent, you need to obtain an access token that the agent can use to authenticate itself to the API. We recommend using the *Microsoft.Identity.Web* SDK for .NET to call your web APIs. This SDK simplifies the process of acquiring and validating tokens. For other languages, use the [Microsoft Entra ID Auth SDK (sidecar)](/entra/msidweb/agent-id-sdk/overview).
author: Dickson-Mwendia
author: Dickson-Mwendia
Integrate N8n Agent
UpdatedDeploy n8n on Azure Container Apps and secure AI agent workflows with Microsoft Entra Agent ID and Microsoft Graph MCP Server for Enterprise.
Use Microsoft Libraries
Updated> [!WARNING]
Key Concepts
UpdatedTraditional service principals were designed for static, deterministic workloads. Microsoft Entra Agent ID exists because service principals lack the governance infrastructure AI agents need. There's no enforced sponsorship, no agent-aware audit entries, and no blueprint-managed lifecycle. For more information, see [Agent identities, service principals, and applications](agent-service-principals.md).
Whats New Ignite 2025
Updated- [Call API: Azure services](../agent-id/call-api-azure-services.md) (New)
Microsoft is adding new Entra service plans—Conditional Access for Agents and ID Protection for Agents—to Microsoft Agent 365 and Microsoft 365 E7, enabling secure agent identity management. Rollout starts July 2026, with automatic enabling and no policy changes. No action required, but license review is recommended.
Configure Third Party Agents
Updated- [Configure Entra ID Auth SDK (sidecar) for agent identities](microsoft-entra-sdk-for-agent-identities.md)
author: Dickson-Mwendia
Whats New Agent Id
Updated- [AI-guided setup](agent-id-ai-guided-setup.md) (New) - Automate onboarding with an AI coding agent that walks you through blueprint creation, credential configuration, and agent identity provisioning.
Microsoft Entra Global Secure Access
3 updatesPowershell Get Token
UpdatedSet-Location -Path "C:\"
1. Select **Download Client**.
Learn how AI agent discovery in Global Secure Access provides network-level visibility into managed and shadow AI agents reaching the internet from your environment.