Wednesday, 1 July 2026

1 July 2026: Global Secure Access publishes Microsoft-traffic guidance and calls out HTTP-method filtering in preview; ID Protection documents unified risk

This is a Microsoft Learn-led update rather than a release bulletin, with no Message Center item. The meaningful changes are a new set of Global Secure Access tutorials for Microsoft traffic controls, an updated Web Content Filtering page that explicitly labels HTTP method request filtering as preview, new ID Protection guidance for correlated risk, and Entra ID documentation for OIDC extensibility and SCIM API setup. The supplied evidence does not establish general availability, retirement, or an automatic tenant behavior change; the remaining edits are mainly standards, integration, logging, Security Copilot, and troubleshooting documentation maintenance.

• Global Secure Access · General

  Global Secure Access adds a Microsoft traffic labs tutorial and related configuration guidance

  The new tutorial brings source IP restoration, compliant network checks, and universal tenant restrictions into a Microsoft traffic lab path. Related new tutorials add the steps for enabling the Microsoft traffic profile, assigning users, installing the client, verifying forwarding, validating restored source IP in Entra sign-in logs, and configuring a Conditional Access policy that requires a compliant network. This is a new how-to set, not evidence of general availability or automatic changes to existing policies

• Global Secure Access · General

  Global Secure Access Web Content Filtering documents HTTP-method request filtering as preview

  The updated guidance identifies HTTP method request filtering as preview and describes blocking or allowing methods including GET, POST, PUT, PATCH, and DELETE. The evidence supports a documented preview capability, not general availability or a change to existing content policies; administrators should account for that status when assessing the option

• ID Protection · Fundamentals

  Microsoft Entra ID Protection documents unified risk signals and compounded user risk

  A new fundamentals article explains that identity-risk signals from Microsoft Entra ID Protection and Microsoft Defender are correlated to calculate compounded user risk. Related dashboard guidance describes correlation across other Microsoft security products within the same time window, and the Risky User Report update documents an option to aggregate risk signals by risky sign-ins. This clarifies risk interpretation and reporting; it does not announce a new tenant setting or scoring rollout

• Entra ID · Standards

  Entra ID adds an OIDC extensibility-to-Graph reference

  A new Microsoft identity platform reference maps each OpenID Connect extensibility surface to its configuration article and the Microsoft Graph API resource that programs it. Alongside updates to the OAuth and OIDC protocol pages, this is a navigation and implementation clarification for application and identity-platform owners, not evidence of a new protocol capability or availability change

• Entra ID · Standards

  Entra ID SCIM API documentation spells out call prerequisites

  The updated SCIM API reference states that callers must enable the SCIM Provisioning API, configure billing, set up credentials, and obtain an access token before calling the documented endpoints. A related enablement-page update points readers to API-call pricing. This is a documentation clarification with planning implications for SCIM API adopters; it does not state that existing integrations changed

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.