📋 Microsoft Entra Documentation Changes

ms.date: 05/21/2026

Microsoft Entra External ID adds customer identity and access management (CIAM) to your app on the Microsoft Entra platform, so you get consistent app integration, tenant management, and operations across workforce and customer scenarios.

This article is a decision-making guide for the six planning steps. Each section summarizes the key choices and links to the canonical how-tos and reference docs.

:::image type="content" source="media/concept-planning-your-solution/planning-flow-horizontal.png" alt-text="Diagram showing the six setup steps as a horizontal flow: create an external tenant, choose an authentication approach, register your application, integrate a sign-in flow, secure your sign-in, and customize your sign-in.":::

Jump to a step for details, or go straight to the **How-to guides**.

ms.date: 06/17/2026

ms.reviewer: etbasser, owinfrey

# ID Protection for agents

Starting soon, ID Protection for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to extend protection to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).

Because agents can operate autonomously and on behalf of a user, they can display unique sign-in behavior. Agents can take initiative, interact with sensitive data, and operate at scale. Microsoft Entra ID Protection for agents identifies and mitigates risks associated with these capabilities. **Learning Mode** automatically suppresses behavioral alerts for agents that lack sufficient activity history, preventing false positives during onboarding and after periods of inactivity. A separate detection runs in parallel to ensure genuinely malicious early-life behavior is still caught. Once an agent exhibits suspicious behavior, ID Protection flags the activity as risky.

ms.date: 06/10/2026

ms.reviewer: etbasser, owinfrey

## Agent detections

In agent on-behalf-of flows, where an agent acts using a user's delegated permissions, risky activity is attributed to the **user** rather than the agent. This approach targets remediation at the compromised user session without disrupting the agent for other users. Risk detections in this table apply specifically to autonomous agent activity.

 

ms.date: 06/17/2026

This role is available for assignment only as an additional local administrator in [Device settings](~/identity/devices/assign-local-admin.md). Users with this role become local machine administrators on all Windows 10 or newer devices that are joined to Microsoft Entra ID. They do not have the ability to manage device objects in Microsoft Entra ID.

 

This role is separate from the device registration policy setting that controls whether the user who performs Microsoft Entra join becomes a local administrator on the device they join.

ms.date: 06/10/2026

Microsoft Entra Suite includes all Microsoft Entra Conditional Access features.

 

Starting soon, Conditional Access for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to apply policies to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).

ms.date: 06/17/2026

> [!NOTE]

> In self-service setup, the user who completes Microsoft Entra join becomes the device's primary user and is a local administrator on that device by default. This local administrator status applies to the device only. It doesn't grant a Microsoft Entra directory role. For Windows Autopilot, the user account type is configurable. Bulk enrollment doesn't add users who sign in after the device is joined to the local Administrators group.

 

ms.date: 06/17/2026

- **Manage Additional local administrators on Microsoft Entra joined devices**: This setting lets you select users who are granted local administrator rights on all Microsoft Entra joined devices in the tenant. These users are assigned to the Microsoft Entra Joined Device Local Administrator role, which applies tenant-wide.

- **Registering user is added as local administrator on the device during Microsoft Entra join**: This setting controls whether users who perform Microsoft Entra join are added to the local Administrators group on the device they join. This setting affects local device administrator membership only. It doesn't assign a Microsoft Entra directory role, such as Global Administrator, and it doesn't add the user to the Microsoft Entra Joined Device Local Administrator role. To verify the result, check the local Administrators group on the device or use a device management tool. In Microsoft Graph, this setting is represented by the `azureADJoin.localAdmins.registeringUsers` property of the [device registration policy](/graph/api/resources/deviceregistrationpolicy).

ms.date: 05/20/2026

ai-usage: ai-assisted

Yes. Microsoft Entra External ID supports two authentication approaches: **browser-delegated authentication**, which redirects users to a Microsoft-hosted sign-in page, and **native authentication**, which lets you build the sign-in UI directly into your app. Native authentication gives you full control over the sign-in experience for mobile and single-page applications but requires more development effort and shared security responsibility. To compare both approaches and decide which is right for your app, see [Choose an authentication approach](concept-choose-authentication-approach.md).

ms.custom: msecd-doc-authoring-1012

ms.custom: msecd-doc-authoring-1013

Starting soon, ID Protection for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to extend protection to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).

 

ms.date: 06/17/2026

- **Device registration policy** - The device registration policy controls whether users who perform Microsoft Entra join become local administrators on the devices they join. This setting affects membership in the local Administrators group on the joined device. It doesn't assign a Microsoft Entra directory role, such as Global Administrator, and it doesn't add the user to the Microsoft Entra Joined Device Local Administrator role. In Microsoft Graph, this setting is represented by the `azureADJoin.localAdmins.registeringUsers` property of the [device registration policy](/graph/api/resources/deviceregistrationpolicy).

> [!NOTE]

> These Microsoft Entra admin center steps require the signed-in user to be able to access the Microsoft Entra admin center. Entitlement management roles, such as Access package assignment manager, authorize assignment-management actions within entitlement management, but they don't by themselves change tenant-wide access settings for the admin center. If the **Restrict access to Microsoft Entra administration portal** user setting is enabled, verify that the delegated user can access the admin center, or use an authorized programmatic method. For more information about this setting, see [Default user permissions](../fundamentals/users-default-permissions.md).

 

> [!NOTE]

> Managing guest user lifecycle from access package assignments in the Microsoft Entra admin center requires the signed-in user to be able to access the admin center. Entitlement management roles, such as Access package assignment manager, authorize assignment-management actions within entitlement management, but they don't by themselves change tenant-wide access settings for the admin center. If the **Restrict access to Microsoft Entra administration portal** user setting is enabled, verify that the delegated user can access the admin center, or use an authorized programmatic method. For more information about this setting, see [Default user permissions](../fundamentals/users-default-permissions.md).

 

> [!NOTE]

> Entitlement management roles authorize actions within entitlement management, but they don't by themselves change tenant-wide access settings for the Microsoft Entra admin center. If the **Restrict access to Microsoft Entra administration portal** user setting is enabled, a delegated user might need to be allowed to access the Microsoft Entra admin center before they can complete admin center tasks such as viewing, adding, removing, or reprocessing access package assignments. For more information about this setting, see [Default user permissions](../fundamentals/users-default-permissions.md).