Friday, 15 May 2026

15 May 2026: passkey recovery and Agent ID migration guidance stand out

This was a documentation-heavy Entra update: all 13 supplied items were updates, with no new or removed entries. The most consequential guidance concerns FIDO2 passkeys after UPN changes, the lack of an in-place path from Copilot Studio agents to Agent ID, and Authenticator Lite prerequisites. Other edits primarily clarify authentication behavior and setup instructions rather than announce new availability.

• Entra ID · Authentication

  UPN changes require passkey replacement

  The updated Entra ID guidance states that an existing FIDO2 passkey can no longer be modified after the user’s UPN changes. The documented recovery path is for the user to open Security info, delete the old passkey, and add a new one. This is an important identity-renaming dependency, but the evidence presents it as documentation of the behavior rather than a new feature or rollout.

• Agent ID · Governance

  Agent ID migration is recreate-only today

  The updated Agent ID guidance explains how to recreate Microsoft Copilot Studio agents with Microsoft Entra Agent ID for enhanced governance and security, while explicitly stating that no in-place migration path exists today. Administrators should not plan on directly converting existing agents.

• Entra ID · Authentication

  Authenticator Lite prerequisites and exclusions are explicit

  The Entra ID guidance says the organization must enable Authenticator second-factor push notifications for all users or selected groups, with the modern Authentication methods policy recommended through the admin center or Microsoft Graph. Authenticator Lite is not eligible for on-premises user accounts or organizations with an active MFA server. This is a configuration and eligibility clarification, not evidence of a new availability announcement.

• Entra ID · Authentication

  System-preferred authentication behavior is clarified

  The updated fundamentals guidance explains that Entra ID evaluates available authentication methods and prompts users with the most secure sign-in option for both primary authentication and multifactor authentication. The supplied evidence describes how the behavior works but does not indicate that a tenant-wide default changed.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.