Microsoft Entra will enable users to change passwords after secure sign-in using strong credentials (passkey, FIDO2, Windows Hello) without knowing the current password or using SSPR. This feature, disabled by default, requires admin activation and will roll out globally from October to November 2026.
Day in brief
Cross-tenant access guidance adds a P1 prerequisite for redemption-order changes
The Cross Tenant Access Overview now states that changing the default redemption order requires a Microsoft Entra ID P1 license on the configured tenant, alongside trust or scoped access configuration.
- P1 requirement documented for default redemption-order changes
External ID · FundamentalsThe overview now identifies Microsoft Entra ID P1 on the configured tenant as a requirement for changing the default redemption order, in addition to configuring trust or scoped access settings.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
5 updates
Microsoft Entra ID
1 update
Microsoft Entra Agent ID
2 updatesStarting November 4, Microsoft Entra will stop automatically granting the AgentIdentity.CreateAsManager permission to agent blueprints. Admin consent will be required for agents to create identities. This change, rolling out worldwide in November 2026, enhances control and auditability of agent identity creation.
Starting November 4, 2026, default users in Microsoft Entra can create agent blueprints unless administrators disable this via the "Users can create agent blueprints" setting. Admins can restrict this by toggling the setting to No in the Entra admin center before rollout completes in late November.
Microsoft Entra External ID
2 updatesCross Tenant Access Overview
Doc updateThe overview now states that a Microsoft Entra ID P1 license is required on the configured tenant to change the default redemption order, in addition to configuring trust or scoped access settings.
Cross Tenant Access Overview
Feature updateThe documentation now states that changing the default redemption order, like configuring trust or access settings, requires Microsoft Entra ID P1 on the configured tenant.