Daily.Entra.NewsThe strongest Entra guidance this period sets a February 1, 2027 retirement for Microsoft-provided SMS and voice authentication for users including internal guests, with Global Administrators and external users on July 1, 2027. Users relying only on those methods will receive a blocking passkey-registration prompt after their applicable deadline. Microsoft also added practical Cloud Sync migration and Connect Sync passwordless sign-in procedures, while most remaining activity involved Connect release-history, navigation, and command-path cleanup.
Entra ID · AuthenticationThe authentication guidance states that Microsoft-provided SMS and voice retire February 1, 2027, for users including internal guests. Global Administrators and external users follow July 1, 2027; after the applicable date, users whose only MFA method is SMS or voice receive a blocking passkey-registration prompt. Administrators should move them to phishing-resistant methods or configure a customer-managed telecom provider where needed.
Entra ID · GeneralThe version history replaces references to 2.6.90.0 with 2.6.91.0 and identifies 2.6.91.0 as the latest available version. Upgrades involving an existing ADSync database should use 2.6.91.0 or later, while installations of recalled version 2.6.79.0 should be uninstalled and replaced with 2.6.91.0.
Entra ID · ProvisioningA new article covers using the guided migration tool to assess an environment, create Cloud Sync configurations, run a preactivation check, and validate synchronization after migration. It also identifies required roles, credentials, eligibility limits, supported scenarios, and a two-week validation process.
Entra ID · AuthenticationA new how-to explains how to enable FIDO2 and passkey methods, register credentials, configure a registry setting, and sign into Microsoft Entra Connect Sync without a password. The procedure gives administrators a documented passwordless setup path for synchronization installations and configuration.
Entra ID · AuthenticationThe revised procedure replaces the custom OMA-URI profile process with an Intune Settings Catalog policy. Administrators now select Authentication > Allow Aad Password Reset and set the value to Allow.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft-provided SMS and voice authentication retires February 1, 2027, for users including internal guests. Global Administrators and external users follow a later July 1, 2027 retirement date. Users whose only MFA method is SMS or voice will receive a blocking passkey-registration prompt after their applicable date.
The documentation clarifies that Global Administrators and external users are affected on July 1, 2027, while internal guest users follow the February 1, 2027 date. Users can continue using phishing-resistant methods such as passkeys.
A how-to article explains how to enable FIDO2 and passkey methods, register credentials, configure a registry setting, and sign in to Microsoft Entra Connect Sync without a password.
The procedure now uses revised Microsoft Entra Connect paths and module-import commands, including the ADSync module and the AzureADSSO module. Step numbering and wording were also updated.
The instructions replace the custom OMA-URI profile process with a Microsoft Intune Settings Catalog policy. Administrators now select **Authentication > Allow Aad Password Reset** and set it to **Allow**.
The Microsoft Entra Connect version history page removes Learn more links from entries covering WAM and phishing-resistant authentication. The descriptions remain unchanged.
The authentication overview now shows “No” for Microsoft Authenticator push notifications in the affected status column; the method remains listed for MFA and SSPR.
The documentation page describing passwordless sign-in for Microsoft Entra Connect Sync, including setup, credential registration, registry configuration, and sign-in steps, was deleted.
The tutorial replaces the previous SCIM token steps with instructions to create an OAuth2 service account, copy its Client ID and Client Secret, and select OAuth2 Client Credentials Grant. Screenshots and navigation steps were also refreshed.
The documentation now states that Select Containers is read-only, clarifies the existing ADSync database error, and lists failures in version 2.6.84.0 plus a Connector Properties crash.
The version history page now uses “Learn more” as the link text to the cloud sync SSO instructions. The documented PowerShell import order is unchanged.
The version history entry now states that the Generic LDAP connector validates the TLS server certificate chain and server name, removing the detailed rejection conditions.
The Connect version history page no longer states that the Generic LDAP connector wizard validates the TLS server certificate chain and server name.
The documentation adds release notes for an upcoming version with Delos sovereign cloud support, authentication and connector behavior changes, bug fixes, and security improvements. The version and release date remain TBD.
The 2.6.90.0 release adds a guided migration workflow from Microsoft Entra Connect Sync to Cloud Sync, including assessment, agent setup, staged activation, validation, and rollback. It is available only in the Azure public cloud.
The entry now uses “phishing-resistant authentication” instead of “passwordless authentication” and updates the page date to September 14, 2026.
The version history table adds a Release date column for listed Microsoft Entra Connect versions while retaining end-of-support dates.
The documentation replaces version 2.6.90.0 with 2.6.91.0 and updates related guidance, including the 2.6.84.0 support timeline and fixes for existing-database upgrades and Synchronization Service Manager crashes.
The documentation replaces references to version 2.6.90.0 with 2.6.91.0, updates related fix guidance, and identifies 2.6.91.0 as the latest available version.
The documentation metadata and release entries now show September 16, 2026 instead of September 15, 2026 for version 2.6.91.0 and its related timeline.
Four references to version 2.6.91.0 now point to the correct documentation section, #26910, instead of #26900.
The documentation now records a fix for an issue where reopening the wizard and expanding a fully deselected domain could reselect it and enable synchronization for the entire domain.
The documentation now requires importing `ADSync.psd1` before `AzureADSSO.psd1` when configuring Seamless Single Sign-On with the standalone module.
The documentation now states that the Select Containers dialog remains available for viewing selections, while changes should be made through Customize synchronization options in the Microsoft Entra Connect wizard.
The article’s publication date changed from April 9, 2025, to September 15, 2026, and an AI-assisted usage marker was added.
Microsoft added documentation for using the guided migration tool to assess an environment, create Cloud Sync configurations, run a preactivation check, and validate synchronization after migration.
Microsoft Graph permissions have been added to Microsoft Entra Connect. Administrators using app-scoped Conditional Access policies should review policies targeting Microsoft.Azure.SyncFabric or Microsoft 365 Reporting Service.
The version history now refers to an additional sovereign cloud environment instead of naming Delos. Support for Pass-through Authentication, Seamless SSO, password writeback, and Health Agent monitoring remains listed.
The page now describes Connect Health as providing monitoring data in one place and directs administrators to the Microsoft Entra admin center for alerts, performance monitoring, usage analytics, synchronization errors, and service information.
The documented workflow now covers configuration assessment, provisioning agent setup, staged activation, and validation. Rollback is no longer included, and the workflow remains limited to the Azure public cloud.
The page now directs administrators to Microsoft Entra Connect Health in the Microsoft Entra admin center and documents updated navigation for Sync, AD FS, AD DS, settings, troubleshooting, and support. It also clarifies that agents must be installed before monitoring data appears.
The version history entry now links readers to the latest available Microsoft Entra Connect Sync version.
The article now documents configuring a SCIM endpoint that uses an OAuth2 client-credentials grant from a non-Entra issuer, including the token endpoint, client credentials, credential placement, and scopes.
The procedure now imports the ADSync PowerShell module before importing the Seamless SSO module, with updated command and path details.
The documentation now uses clearer wording for configuring LCW extensibility workflow mappings, creating an Azure Logic App and workflow, and configuring provisioning jobs with attribute mappings.
