Microsoft Identity Security Policy Enforcement Changes in Windows Server and Entra

Microsoft identity-related security enforcement is changing across both on-prem AD and cloud Entra environments, with potential authentication and access-control impacts if organizations have legacy configurations. In Windows Server 2025, LDAP signing is enabled by default on domain controllers via a new policy setting (LDAP server signing requirements Enforcement), while LDAP channel binding default behavior is unchanged; organizations are advised to audit before enforcing to avoid breaking LDAP-dependent applications and integrations.

Separately, Microsoft Entra will change Conditional Access enforcement starting March 27, 2026 (phased through June 2026) for sign-ins via client apps requesting only OIDC scopes or a limited set of directory scopes when Conditional Access targets All resources and includes resource exclusions. After the change, Conditional Access will be enforced at sign-in even when exclusions exist, which may newly trigger controls such as MFA or device compliance for affected tenants; tenants without “All resources” policies that include exclusions are not impacted.