Daily.Entra.News
A cross-product view of Microsoft Entra changes related to Authentication.
Organizations can allow users to change cloud passwords after authenticating with a registered FIDO2 passkey or Windows Hello for Business credential, without knowing the current password or using SSPR. Temporary Access Pass isn't supported unless the user knows the existing password.
The entitlement management scenarios documentation no longer labels “Govern access for agents” as preview.
Microsoft Authenticator for iOS and Android will receive usability updates starting November 2026, including a refreshed home experience, clearer account restoration guidance, improved sign-in flows, and platform-specific prompts. Android improvements for restoration and battery optimization prompts will follow in January 2027. No action required.
The Entra ID Governance integrations table now lists Secure Cloud and distinguishes Zscaler ZSNet from Zscaler with separate links.
The overview page now uses a more specific section link and clearer descriptions of automated provisioning, SSO just-in-time provisioning, and additional application integrations.
Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.
The documentation section describing password changes after sign-in with CBA, FIDO2 passkeys, or Authenticator passwordless notifications was revised.
The documentation now uses the exact name of the secure sign-in setting related to changing cloud passwords after passwordless sign-in.
The documentation updates the name of the password-change flow available after CBA, passkey, or Authenticator passwordless sign-in.
The combined MFA and SSPR registration documentation updates its passwordless sign-in reference with a link to the relevant passwordless documentation.
The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.
The documentation now explains how users can change Microsoft Entra cloud passwords with FIDO2 passkeys or Windows Hello for Business, including the tenant-wide setting required to enable the experience and its limitation for on-premises password writeback.
The documentation now states that rollout across all clouds begins in late October 2026 and is expected to finish by the end of November 2026.
The page now labels the section “Allow password change after secure sign-in” and its subsection “Enable the setting,” replacing the previous “Passwordless authentication” heading.
The heading “Allow password change after secure sign-in” now ends with a period.
The documentation updates the section heading and setting label to “Allow password change after secure sign-in.”
The documentation now states that users need a Microsoft Entra ID P1 or P2 license to use this feature.
The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.
In hybrid environments, password changes made with passwordless authentication can be written to an on-premises directory when password writeback is configured.
The documentation now lists Microsoft Entra CBA, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change a cloud password without entering the current password.
Microsoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September to November 2026. SMS for MFA and password reset remains unaffected. Admins should review usage, notify users, and ensure alternate sign-in methods.
The guidance now documents provisioning the Microsoft Authenticator Credential Registration enterprise application and excluding it from Conditional Access policies scoped to All resources to unblock passkey registration.
Microsoft Authenticator for Android will improve backup and restore with clearer setup guidance and support for passkeys starting mid-January 2027. Users must enable Google One backup and screen lock. Work/school accounts aren’t backed up, and backup works only in the Android personal profile. No admin action needed.
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.
The article now explains that system-preferred authentication considers the user’s current device and browser, prioritizes accessible local passkeys, and handles device-bound credentials such as Windows Hello for Business and macOS Platform SSO by platform.
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
The documentation now shows an updated Android screenshot and describes selecting Approve or Deny instead of Yes or No for relevant number-matching prompts in Authenticator, Teams, and Outlook.
Starting October 30, 2026, Microsoft Entra ID allows organizations to choose a supported third-party telephony provider for SMS and voice authentication via Microsoft Security Store. Microsoft-provided SMS/voice authentication retires by February 1, 2027, except for some users until July 1, 2027. Organizations manage provider relationships directly.
The documentation expands access from limited availability and updates setup links. It also clarifies that the storage account app registration must use a lowercase `cifs` identifier URI for SMB mounting on macOS.
The page title was simplified, and the role descriptions now state that the Microsoft Enterprise SSO plug-in performs device and user registration with Microsoft Entra ID. Microsoft Entra ID is described as verifying credentials and proofs and issuing the PRT.
The FAQ now states that identity provider buttons cannot be hidden. Removing a provider from a user flow prevents users from signing up or redeeming invitations with that provider, and `domain_hint` does not change this.
The page now explains self-service sign-up through a user flow and invitation redemption through a custom OIDC provider using the domain_hint authorization parameter.
Microsoft added a conceptual guide describing macOS Platform SSO registration, Secure Enclave device keys, the Platform SSO PRT, app SSO, and the roles of MDM, macOS, the Microsoft Enterprise SSO plug-in, and Microsoft Entra ID.
The documentation adds Performance mode, which routes user traffic to the connector with the lowest measured network latency. It also clarifies that connector load balancing applies only to Microsoft Entra Private Access applications, not application proxy applications.
The article now highlights testing the user flow as the primary next step and adds links for adding applications, managing custom attributes, and routing invited users to an external identity provider.
The article now explains that disabling sign-in sets the service principal’s `accountEnabled` property to `false` and changes Activation status to Deactivated. It also adds steps to restore tenant-local sign-in and notes that other deactivation conditions can still apply.
The documentation now describes adaptive learning for new users’ sign-in behavior and says detection is calculated in real time, replacing the previous learning-period and offline-calculation details.
The documentation explains when users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls, including user experience, network requirements, and help-desk guidance.
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
The documentation describes four separately manageable protections—administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking—for selected Microsoft Entra ID Free tenants. It also explains how these protections work with Conditional Access and which roles can manage them.
Microsoft Entra will enable users to change passwords after secure sign-in using strong credentials (passkey, FIDO2, Windows Hello) without knowing the current password or using SSPR. This feature, disabled by default, requires admin activation and will roll out globally from October to November 2026.
Starting November 4, Microsoft Entra will stop automatically granting the AgentIdentity.CreateAsManager permission to agent blueprints. Admin consent will be required for agents to create identities. This change, rolling out worldwide in November 2026, enhances control and auditability of agent identity creation.
The documentation now states that iOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.
The documentation now states that Android users can register attested passkeys directly in the Authenticator app or through a cross-device registration flow. iOS registration remains direct through the Authenticator app.
The documentation now separately states that Android users can register attested passkeys through a cross-device registration flow, while iOS users register them directly in the Authenticator app.
The documentation now states that iOS cross-device registration does not support attestation, while Android does. Attested passkeys can also be registered through Android cross-device flows.
The example now specifies a device-bound profile with attestation enforced and an eligible attested passkey. It states that the nudge is suppressed across operating systems and browsers, without using the platform table.
The example now explicitly states that User 1 signs in on macOS with Chrome and is nudged to register a compatible passkey.
The example now specifies that the user’s only registered passkey is Windows Hello for Business; the nudge is suppressed when they sign in on Windows with Chrome.
The documentation now refers to registered passkeys and available passkey types instead of credentials in the platform-specific nudge suppression guidance and table.
The documentation now states that Windows Hello for Business registration doesn’t follow passkey profile restrictions.
The documentation now states that Windows Hello for Business registration behavior is separate from passkey profile restrictions.
The MFA registration campaign documentation now links directly to the passkey profile eligibility guidance for the Microsoft managed registration campaign.
The documentation explains how unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation, while AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
The documentation now states that eligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, such as refresh token redemption, do not display nudges.
The documentation now covers prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, and trust removal.
The health scenario alerts guide now links to guidance for Agent ID interactive sign-ins and autonomous sign-ins.
Adds a how-to article explaining Health Monitoring signals and alerts, log correlation, impact criteria, troubleshooting, and prerequisites for autonomous agent sign-ins. The monitoring and alerts are documented as being in preview.
A new how-to explains how to interpret Health Monitoring signals, correlate agent properties with sign-in and audit logs, and mitigate common failures. It also identifies the relevant non-interactive sign-in logs and documents licensing and role prerequisites.
The standalone article describing Kerberos server-key rotation, prerequisites, dual-key behavior, and the Set-AzureADKerberosServer procedure was deleted.
The documentation states that generally available key rotation improves reliability for incoming trust referral flows and addresses authentication failures caused when referral tickets used a secondary key.
The article no longer states that the registration campaign rollout is expected to finish by the end of September 2026 or that tenant experiences may differ during the rollout.
The article date was updated to October 7, 2026, and the note about gradual Microsoft-managed deployment through September 2026 was removed.
The documentation now references MDS version 285 instead of 279 and adds five FIDO2 security key models with their AAGUIDs and capability indicators.
The username/password token acquisition article no longer includes the author, manager, and ms.author fields.
The Android custom headers tutorial no longer includes the author, manager, and ms.author metadata fields.
The page no longer includes the `ms.author: justinha` metadata entry.
The article fixes the spelling of “OpenID Connect” and replaces an empty .NET NuGet link with an Azure Functions API link, along with other wording corrections.
The documentation now states that SMS is unavailable only for first-factor authentication in external tenants, indicating availability for self-service password reset. SMS remains available for second-factor verification at additional cost.
The article was edited for spelling, headings, and presentation while retaining its documented enforcement phases, dates, affected applications, account scope, and break-glass guidance.
The page title and description now use Microsoft Entra External ID terminology. Passkey sample links were updated from listing and registration to sign-in and management, and the sample table was revised.
The native authentication API reference was updated with spelling corrections. The supplied examples, links, endpoints, error details, and configuration guidance remain unchanged.
The guidance now states that Microsoft Authenticator, software OATH tokens, and hardware OATH tokens count as one authentication method for SSPR, regardless of Authentication methods policy migration status.
The passwordless authentication documentation no longer includes the `author` and `ms.author` fields.
The documentation now describes a sample where signed-in customers list and register their own passkeys. It warns that the deletion flow uses high-privilege permissions and a client secret, so the sample is for test tenants only.
The page now describes administrator-controlled passkey provisioning with the FIDO2 provisioning APIs and identifies the sample as testing-only with high-privilege permissions.
The documentation fixes minor formatting in the scope notes and corrects the image text from `HKEY_LOCAL_MACHIEN` to `HKEY_LOCAL_MACHINE`.
The tutorial’s code comment was corrected from “Thge” to “The” and from “rquired” to “required.”
Microsoft Entra External ID applications can use the credential management API to let signed-in customers list and register passkeys. The reference covers delegated authentication, permissions, and setup.
The documentation now directs applications to use the credential management API, with low-privilege delegated permissions, so signed-in customers can list and register their own passkeys.
The guide removes the Preview label and documents that workload identities are reusable only when their Application API host matches the provisioning app’s SAP SuccessFactors API host. It also adds the Application ID URI format and compatibility details for the September 15, 2026 update.
The tutorial replaces references to Zidentity and Zscaler Provisioning with Zscaler Authentication Service and updates related titles, prerequisites, app-role guidance, and provisioning steps. The page date was also updated.
The documentation now states that agent user accounts can be assigned custom roles, while privileged administrator roles remain restricted.
The documentation corrects an internal section link and improves grammar, spelling, punctuation, and wording throughout the rollout guidance.
The page now describes how Windows Hello for Business cloud Kerberos trust uses Microsoft Entra Kerberos to provide passwordless access to Active Directory resources and links to a deployment guide.
The documentation now states that users accessing Active Directory-protected resources need corresponding Active Directory accounts. Cloud-managed users should be provisioned from Microsoft Entra ID, including required group memberships.
The page now explains how Microsoft Entra ID users and groups provisioned to Active Directory with Cloud Sync can access Kerberos-protected resources through Microsoft Entra Kerberos, Windows Hello for Business, or FIDO2. It also clarifies that provisioning alone does not enable Kerberos or passwordless access.
The SSPR documentation now refers to a “Microsoft Entra administrator role” instead of an “Azure administrator role” when describing enforcement of the strong two-gate password policy.
The backup authentication system documentation no longer lists Workplace from Facebook in its integration table.
Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026. Only trusted Microsoft scripts will run, affecting organizations using script-injecting tools on login.microsoftonline.com. No action needed if such tools aren't used.
The provision-on-demand article no longer includes references to Meta Workplace. The displayed guidance about stopping provisioning for OAuth-based applications remains unchanged.
The Microsoft Entra FIDO2 hardware vendor documentation now references MDS version 279 instead of 275 and adds the FEITIAN FT-JCOS BioCard, including its AAGUID and feature capabilities. The page date was also updated.
The documentation now identifies affected accounts as cloud-managed users and explains that password writeback is unavailable for them. It also states that they can access Kerberos-based applications through passwordless authentication using the AD account created by provisioning.
The documentation now specifies that password writeback isn't available for users created in Microsoft Entra. These users can authenticate to Kerberos-based applications only through passwordless authentication using the provisioned AD account.
The documentation now identifies Soprano and Telesign as initial providers and links to their commercial offers. Configuration begins October 30, 2026.
The documentation identifies Soprano and Telesign as initial private-preview providers for SMS and voice authentication. It also states that provider selection and configuration through Microsoft Security Store will begin October 30, 2026.
The page now refers to customer-managed telephony providers as Choose Your Own Telephony Provider and updates related headings and descriptions. The availability dates remain September 18, 2026, for provider information and October 30, 2026, for configuration.
The documentation now refers to selected providers as “telephony providers” instead of “telecommunications providers.”
The documentation no longer includes recommendations to pilot with a limited group or prepare a fallback authentication method and support process for delivery interruptions.
The SSPR policy documentation now uses “Microsoft Entra administrators” instead of “Azure administrators.”
The authentication overview now shows “No” for Microsoft Authenticator push notifications in the affected status column; the method remains listed for MFA and SSPR.
The documentation page describing passwordless sign-in for Microsoft Entra Connect Sync, including setup, credential registration, registry configuration, and sign-in steps, was deleted.
The Microsoft Entra Connect version history page removes Learn more links from entries covering WAM and phishing-resistant authentication. The descriptions remain unchanged.
The version history page now uses “Learn more” as the link text to the cloud sync SSO instructions. The documented PowerShell import order is unchanged.
The Connect version history page no longer states that the Generic LDAP connector wizard validates the TLS server certificate chain and server name.
The version history entry now states that the Generic LDAP connector validates the TLS server certificate chain and server name, removing the detailed rejection conditions.
The documentation now states that Select Containers is read-only, clarifies the existing ADSync database error, and lists failures in version 2.6.84.0 plus a Connector Properties crash.
The instructions replace the custom OMA-URI profile process with a Microsoft Intune Settings Catalog policy. Administrators now select **Authentication > Allow Aad Password Reset** and set it to **Allow**.
The procedure now uses revised Microsoft Entra Connect paths and module-import commands, including the ADSync module and the AzureADSSO module. Step numbering and wording were also updated.
The tutorial replaces the previous SCIM token steps with instructions to create an OAuth2 service account, copy its Client ID and Client Secret, and select OAuth2 Client Credentials Grant. Screenshots and navigation steps were also refreshed.
Microsoft-provided SMS and voice authentication retires February 1, 2027, for users including internal guests. Global Administrators and external users follow a later July 1, 2027 retirement date. Users whose only MFA method is SMS or voice will receive a blocking passkey-registration prompt after their applicable date.
A how-to article explains how to enable FIDO2 and passkey methods, register credentials, configure a registry setting, and sign in to Microsoft Entra Connect Sync without a password.
The documentation clarifies that Global Administrators and external users are affected on July 1, 2027, while internal guest users follow the February 1, 2027 date. Users can continue using phishing-resistant methods such as passkeys.
Microsoft Entra can hand brokered external-IdP authentication from an embedded WebView to the system browser, enabling external-IdP passkeys, browser SSO, and IdPs that block WebViews. The documentation lists supported platforms, brokers, versions, apps, and cloud availability.
The documentation now distinguishes Microsoft-managed and enabled campaigns. It specifies the MFA method required for each targeted authentication method and broadens eligible users from SMS or voice sign-ins to users signing in with any MFA method.
A single article now documents how to add a configured OIDC, SAML/WS-Fed, or social identity provider to an External ID user flow, including prerequisites, permissions, portal steps, and testing.
The article now links to the authentication methods overview and the consolidated “Add an identity provider to a user flow” article instead of listing the Apple-specific setup steps inline.
