Daily.Entra.NewsMicrosoft is warning that a new Microsoft-managed Conditional Access policy for high-risk users will soon be enforced, while sensitivity labels for Entra cloud security groups are scheduled for mid-November 2026. The period also adds two meaningful ID Governance previews—PIM postapproval extensions and SAP Access Control integration—plus clearer Security Defaults guidance for selected Free tenants.
ID Protection · Conditional AccessThe message says a new Microsoft-managed “Require risk remediation for high-risk users” policy and a new security group were created in the tenant. The policy uses Microsoft Entra ID Protection to identify high-risk users and prompts them to self-remediate through adaptive risk remediation; enforcement is described as soon.
Entra ID · GovernanceMicrosoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026. Labels can be assigned through multiple platforms, cannot yet be changed once applied, and require tenant configuration separate from Microsoft 365 groups.
ID Governance · GovernanceUpdated preview guidance adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also documents collecting cost center or project code and requires the relevant Graph permissions and endpoint configuration. The capability requires Entra ID Governance or Entra Suite; Entra ID P2 alone does not include it.
ID Governance · GovernanceNew preview guidance describes governing SAP business roles through Microsoft Entra entitlement management catalogs, access packages, and My Access while retaining SAP Access Control workflows and approvals. The documented setup covers SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.
Entra ID · AuthenticationFor selected Microsoft Entra ID Free tenants, the article now describes four separately manageable protections: administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking. It also explains their interaction with Conditional Access and which roles can manage them.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation describes four separately manageable protections—administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking—for selected Microsoft Entra ID Free tenants. It also explains how these protections work with Conditional Access and which roles can manage them.
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
The article now covers application and agent creation and management. It documents the **Users can create agent blueprints** setting, which administrators can turn off to restrict agent blueprint creation to administrators and Agent ID Developers.
The documentation now links to the “Restricting who can create applications and agents” section in two references, including the application registration error guidance.
Step 1 now links to the permissions reference anchor without the `.md` suffix.
The permissions reference now states that Application Developer role holders can update applications they own, in addition to creating application registrations independently of the user registration setting.
Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026, allowing administrators to apply and enforce governance policies on these groups. Labels can be assigned via multiple platforms, cannot yet be changed once applied, and require separate tenant configuration from Microsoft 365 groups.
The documentation now states that when **Users can create agent blueprints** is set to **Yes**, any tenant user can create an agent identity blueprint and its principal. Otherwise, the Agent ID Developer and Agent ID Administrator roles can create them.
To strengthen your organization's security posture, Microsoft created a new Microsoft‑managed Conditional Access (CA) policy—Require risk remediation for high‑risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self‑remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.
The documentation adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also describes collecting attributes such as cost center and project code, along with the required Graph permissions and endpoint configuration.
The documentation describes integrating SAP Access Control with Microsoft Entra entitlement management to govern SAP business roles through catalogs, access packages, and My Access. It covers SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.
A new guide explains how directly connected local resources can remain reachable while Private Access is enabled, including routing behavior, prerequisites, and configuration steps.
