Daily.Entra.NewsThis week brought two immediate Entra ID priorities: Microsoft-provided SMS and voice authentication will begin retiring on February 1, 2027, while MemberOf rule configurations face a November 3, 2026 retirement. Microsoft also published preview guidance for Conditional Access policy plans, clarified that Global Secure Access cannot filter DNS through Internet Access forwarding in preview, and documented a new Agent ID inactivity lifecycle policy.
Entra ID · Conditional AccessMicrosoft’s final reminder says the MemberOf rule operator will be retired by November 3, 2026. Organizations using it in dynamic groups, administrative units, or entitlement policies must replace it to avoid outdated memberships, access, and licensing issues.
Entra ID · AuthenticationMicrosoft Entra will begin retiring Microsoft-provided SMS and voice authentication on February 1, 2027. Organizations must move users to passkeys or other methods, or configure a customer-managed telecom provider, to avoid sign-in disruptions. Microsoft recommends passkeys because SMS and voice are vulnerable to attacks.
Entra ID · Conditional AccessNew preview guidance covers consolidating selected Conditional Access policies into a policy plan, reviewing shared conditions and generated rules, and validating the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
Internet Access · GeneralInternet Access traffic forwarding does not acquire DNS traffic in preview, including when wildcard acquisition rules or FQDN destinations are used. Cloud Firewall policies therefore cannot filter DNS queries; FQDN rules apply to connections to named destinations.
Agent ID · GovernanceThe documented preview policy notifies owners after 60 days of inactivity, disables identities after 90 days, and deletes them after 455 days. Administrators can enable and scope it without a license, while excluding seasonal or limited-use agents that must remain inactive.
Prioritize remediation for MemberOf configurations and SMS or voice authentication dependencies. Affected authentication flows must move to passkeys or other methods, or use a customer-managed telecom provider. Test policy plans in report-only mode before enforcement, and do not rely on Internet Access Cloud Firewall policies to acquire or filter DNS traffic in preview.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.
Microsoft Authenticator for iOS and Android will receive usability updates starting November 2026, including a refreshed home experience, clearer account restoration guidance, improved sign-in flows, and platform-specific prompts. Android improvements for restoration and battery optimization prompts will follow in January 2027. No action required.
The documentation now explains how users can change Microsoft Entra cloud passwords with FIDO2 passkeys or Windows Hello for Business, including the tenant-wide setting required to enable the experience and its limitation for on-premises password writeback.
Organizations can allow users to change cloud passwords after authenticating with a registered FIDO2 passkey or Windows Hello for Business credential, without knowing the current password or using SSPR. Temporary Access Pass isn't supported unless the user knows the existing password.
The documentation now lists Microsoft Entra CBA, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change a cloud password without entering the current password.
The page now labels the section “Allow password change after secure sign-in” and its subsection “Enable the setting,” replacing the previous “Passwordless authentication” heading.
The documentation section describing password changes after sign-in with CBA, FIDO2 passkeys, or Authenticator passwordless notifications was revised.
The documentation updates the name of the password-change flow available after CBA, passkey, or Authenticator passwordless sign-in.
The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.
In hybrid environments, password changes made with passwordless authentication can be written to an on-premises directory when password writeback is configured.
The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.
The documentation now states that rollout across all clouds begins in late October 2026 and is expected to finish by the end of November 2026.
The documentation updates the section heading and setting label to “Allow password change after secure sign-in.”
The documentation now states that users need a Microsoft Entra ID P1 or P2 license to use this feature.
The documentation now uses the exact name of the secure sign-in setting related to changing cloud passwords after passwordless sign-in.
The combined MFA and SSPR registration documentation updates its passwordless sign-in reference with a link to the relevant passwordless documentation.
The callout was changed from Note to Important.
The heading “Allow password change after secure sign-in” now ends with a period.
The guidance now documents provisioning the Microsoft Authenticator Credential Registration enterprise application and excluding it from Conditional Access policies scoped to All resources to unblock passkey registration.
Microsoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September to November 2026. SMS for MFA and password reset remains unaffected. Admins should review usage, notify users, and ensure alternate sign-in methods.
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.
Microsoft Authenticator for Android will improve backup and restore with clearer setup guidance and support for passkeys starting mid-January 2027. Users must enable Google One backup and screen lock. Work/school accounts aren’t backed up, and backup works only in the Android personal profile. No admin action needed.
Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations using MemberOf in dynamic groups, administrative units, or entitlement policies must replace it to avoid outdated memberships, access, and licensing issues. Action is required before this date to maintain proper functionality.
The documentation now states that the Microsoft Authenticator Credential Registration resource will be available in November 2026. It also retains the prerequisite to provision the enterprise application before excluding the resource from a Conditional Access policy.
Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting early November 2026, allowing users to satisfy MFA without additional passkeys. No configuration changes are needed, but organizations should update onboarding and MFA registration guidance accordingly.
A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
A new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins November 2026, aiming to simplify strong authentication adoption and reduce registration friction.
The title no longer includes “(Preview),” and the publication date changed from August 11, 2026, to October 29, 2026.
The documentation now requires all writable domain controllers to meet specified Windows Server update levels and requires ADSyncTools version 2.6.0 or later. It also adds a warning that enforcement cannot be configured if any writable domain controller is unsupported.
The tutorial now links to Brivo’s contact page instead of its quote page for obtaining a Brivo Onair Identity Connector tenant.
The documentation states that OAuth 2.0 Authorization Code Grant is being retired for Puzzel provisioning. Affected jobs should use OAuth 2.0 Client Credentials Grant; otherwise provisioning may stop working after the deadline.
Vonage provisioning will stop supporting OAuth 2.0 Authorization Code Grant after March 31, 2027. The updated procedure generates and uses client credentials; SSO is unaffected.
Microsoft added a step-by-step tutorial for configuring automatic user and group provisioning, updates, synchronization, and deprovisioning between Microsoft Entra ID and Secure Cloud using SCIM 2.0.
The tutorial now links to Snowflake SCIM documentation, specifies using an account administrator, explains the SQL script, emphasizes that `AAD_PROVISIONER` is case-sensitive and uppercase, and adds related authentication links.
The tutorial’s task lists were changed from numbered items to bullet points; the instructions and screenshots remain the same.
A new article explains how to configure Secure Cloud User Integration with Microsoft Entra ID using OIDC, including prerequisites, consent-based onboarding, authentication settings, fallback passwords, and SSO verification.
The tutorial now uses single quotes in the Snowflake ALTER SECURITY INTEGRATION commands and links to Snowflake’s SAML2 security integration guide.
The tutorial now uses the Account Administrator role, reorganizes the SQL setup steps, updates Snowflake URL parameters, and links to automated user provisioning and deprovisioning.
The documentation now explains that reported last activity can include incomplete sign-ins absent from sign-in logs. A timestamp does not confirm successful authentication or token issuance, and some partial activity may be misclassified as app-only during preview.
The Agent ID default inactivity policy page updates links to related lifecycle policy and end-user agent management documentation.
The documentation now directs administrators to **Agent ID (Preview)** instead of **Agent IDs**, and updates the introductory wording about agent identity lifecycle risks.
The documentation describes a preview policy that notifies owners after 60 days of inactivity, disables identities after 90 days, and deletes them after 455 days. Administrators can enable it, configure its scope, and set fallback notification recipients.
The documentation adds a tutorial for configuring Microsoft Entra agent identities to authenticate to Azure Database for PostgreSQL flexible server and access data through group-based authorization, entitlement management, and conditional access.
The overview’s guidance on managing agent identities and viewing their access and activity information was updated.
The agent identity overview revises wording about automatically assigning identities to Microsoft Copilot Studio agents and creating the related identity blueprint.
The page replaces the Mississippi Division of Medicaid customer example with the Digital Security and Resilience team at Microsoft and updates the accompanying wording and link.
The entitlement management overview removes “preview” from references to assigning groups and API permissions to agents, and from the related license-requirements heading.
The overview heading and linked page title now refer to “Identity governance for agent identities” and “Governing agent identities,” with the “preview” label removed.
The documentation now states that direct cross-tenant user synchronization requires Microsoft Entra ID P1, while synchronizing a group and its members requires Microsoft Entra ID Governance or Microsoft Entra Suite for each synchronized user in the source tenant.
The entitlement management scenarios documentation no longer labels “Govern access for agents” as preview.
The Entra ID Governance integrations table now lists Secure Cloud and distinguishes Zscaler ZSNet from Zscaler with separate links.
The overview page now uses a more specific section link and clearer descriptions of automated provisioning, SSO just-in-time provisioning, and additional application integrations.
The documentation no longer includes the note that nested group drift is excluded and that reports compare assignments with users directly assigned to a group.
The heading for license requirements when requesting on behalf of agent identities no longer includes “(preview).”
The identity governance use-cases page no longer labels the Microsoft Entra Agent ID governance topic as “preview.”
The custom policies guidance now includes a screenshot of the Migration Policy Analyzer UI and updated author metadata.
A new article explains configuring traffic acquisition, Allow and Block firewall rules, security profiles, and enforcement verification for client traffic in Microsoft Entra Internet Access. It also lists required roles, licensing, forwarding profiles, and client prerequisites.
The documentation now states that the Internet Access traffic forwarding profile does not acquire DNS traffic in preview. Wildcard acquisition rules and FQDN destinations do not enable DNS acquisition, so cloud firewall policies do not filter DNS traffic.
The documentation now states that Internet Access traffic forwarding does not acquire DNS traffic in preview, including with wildcard rules. Cloud Firewall cannot filter DNS queries; FQDN rules apply to connections to named destinations.
The documentation now explains that acquisition rules determine which traffic is forwarded, while cloud firewall policies allow or block it. It adds client and remote-network configuration links, wildcard acquisition examples for TCP and UDP, bypass and routing precedence details, and QUIC limitations.
The documentation now explains that Continue is a preview default action used when no enabled enforcement rule matches. It passes evaluation to the next applicable security profile in priority order, while Allow and Block stop V2 evaluation. It also adds cross-profile examples and clarifies Baseline and V1 behavior.
The article title and heading now explicitly focus on configuring cloud firewall for remote networks.
The Private Access operations page no longer includes the row describing a connector offline condition, related Sentinel analytics guidance, or the Windows service check.
The documentation now consistently labels the Continue default action as “in preview” and describes how unmatched traffic passes to the next applicable security profile.
The article title and preview notice for configuring custom headers were removed.
The configuration guide no longer includes the note that a special Entra Admin Center link might be needed during the September 2026 rollout to view custom header details in Global Secure Access traffic logs.
