Microsoft Entra

No entries match these filters. Clear filters

1. changelog Oct 19, 2026 · issue 116

   Microsoft Entra adds Agent ID identity types for unmanaged/local agents and Dynamic Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. with graduated risk-driven enforcement for agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Extends Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors, so unmanaged agents become policy targets even without prior Microsoft Security integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Dynamic Conditional Access for agents, enabling risk-driven, graduated policy responses — reducing permissions, blocking writes while preserving reads, narrowing data/resource scope, restricting network paths, shortening or revoking time-bound access, requiring human approval, or isolating/stopping agent runtimes — coordinated across multiple enforcement points.

   2 details in Everything

2. changelog Oct 19, 2026 · issue 017

   Microsoft Entra adds Agent ID identity types for unmanaged/local agents and Dynamic Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. with graduated risk-driven enforcement for agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Extends Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors, so unmanaged agents become policy targets even without prior Microsoft Security integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Dynamic Conditional Access for agents, enabling risk-driven, graduated policy responses — reducing permissions, blocking writes while preserving reads, narrowing data/resource scope, restricting network paths, shortening or revoking time-bound access, requiring human approval, or isolating/stopping agent runtimes — coordinated across multiple enforcement points.

   2 details in Everything

3. changelog Sep 24, 2026 · issue 085

   Microsoft Purview and Entra Global Secure Access now GA: enforce data-security policies at the network layer to block sensitive data from reaching shadow AI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4. changelog Aug 4, 2026 · issue 036

   Zero Trust Assessment gains new AI, Security Operations, and Infrastructure pillars for broader posture coverage.

   ⤢ ⤢ ⤢
5. changelog Jul 30, 2026 · issue 031

   Microsoft Entra adds tenant governance, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.-default auth, Defender SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. integration, and Purview network-layer data protection.

   • New Tenant Governance capability enables centralized discovery, management, and governance of tenants with cross-tenant delegated administration.
   • PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. are now the default authentication experience in Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., reducing reliance on SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./voice and improving phishing-resistant security ahead of Microsoft telecom delivery retirement in 2027.
   • New interconnected Entra and Microsoft Defender experiences unify identity and SOC teams with shared user experience, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., and agentic workflows.
   • Microsoft Purview integrates with Microsoft Entra Internet Access to extend data security controls to the network layer, enabling real-time protection of sensitive data shared with unmanaged cloud and AI apps.

   4 details in Everything

6. changelog Jul 13, 2026 · issue 015

   Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. makes passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. the default MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. method and retires native SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./voice auth by February 2027.

   └──▷ HOW TO FIND IT
   Identify which users are still enabled for SMS or voice so you can prioritize them for passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. rollout before the September 1, 2026 auto-enrollment deadline.
   📍In the Entra admin center, go to Protection › Authentication methods › Policies, review which users or groups have SMS or Voice enabled, then navigate to Protection › Authentication methods › Registration campaign to enable passkey nudging for those users.
   • Starting September 1, 2026, users enabled for SMS or voice MFA are automatically enabled for passkeys and prompted to register one during their next MFA sign-in.
   • Supports synced passkeys (iCloud Keychain, Google Password Manager) and device-bound passkeys (Microsoft Authenticator, Entra passkey on Windows, FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. security keys) as first-class authentication options.
   • New Microsoft Security Store partner marketplace enables organizations that still require SMS or voice to select, configure, and manage third-party telecom providers starting October 30, 2026.
   • Registration campaigns now available to prompt users to register a passkey at scale during MFA sign-in flows.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !On February 1, 2027, Microsoft-provided SMS and voice authentication is retired; users relying on these methods will be required to register a passkey before they can sign in, with no opt-out option.
   • !After February 1, 2027, automatic passkey registration prompts will be enforced for all users in all tenants with no opt-out option.