Daily.Entra.NewsThe period is led by an operational deadline and a migration constraint: Entra’s SMS and voice authentication path opens to third-party telephony on October 30, 2026, while Device Sync remains a blocker for guided Cloud Sync migration. Substantive guidance also covers staged migration validation, Global Secure Access client behavior, a newly described Identity Protection risk detection, and cross-tenant consequences for disabling Agent ID blueprints. Remaining updates are mostly navigation, metadata, links, screenshots, or terminology maintenance.
Entra ID · AuthenticationStarting October 30, 2026, organizations can select a supported third-party telephony provider for SMS and voice authentication through the Microsoft Security Store. Microsoft-provided SMS and voice authentication retires by February 1, 2027, with some users covered until July 1, 2027; organizations manage provider relationships directly.
Entra ID · GeneralThe updated migration guide says migration must start from the active Connect Sync server, identifies Device Sync as a blocker for guided migration, and adds readiness, validation, and support-evidence guidance. Administrators are told to keep Connect Sync installed during the two-week validation period and not bypass readiness blockers.
Global Secure Access · GeneralThe client release notes now cover Web sign-in support, Conditional Access sign-in frequency for Private Access applications, updated firewall behavior, clearer forwarding-profile names, and private-network bypass changes. Conditional Access sign-in-frequency support is rolling out gradually.
ID Protection · FundamentalsThe updated page describes a real-time detection for suspiciously added authentication methods that raises user risk and can trigger configured risk-based policies. It lists Microsoft Entra ID P2 as required, with that requirement marked pending confirmation.
The documented procedure now uses Disable > Disable in all tenants and specifies that the impact applies to multi-tenant blueprints. Disabling a blueprint can cause related agents in other tenants to fail or lose functionality.
Plan the telephony provider relationship around October 30 and the February 1, 2027 retirement, while accounting for the July 1 exception for some users. For Cloud Sync, assess Device Sync eligibility, begin from the active Connect Sync server, follow readiness results, keep Connect Sync installed through the two-week validation, and avoid bypassing blockers. Review Global Secure Access client changes before Windows deployment decisions, including the gradual rollout of Private Access sign-in-frequency support. Include suspicious authentication-method additions in Identity Protection risk-policy reviews and review the stated P2 licensing requirement, which is marked pending confirmation. For Agent ID, assess cross-tenant impact before using Disable > Disable in all tenants.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The article now explains that system-preferred authentication considers the user’s current device and browser, prioritizes accessible local passkeys, and handles device-bound credentials such as Windows Hello for Business and macOS Platform SSO by platform.
Starting October 30, 2026, Microsoft Entra ID allows organizations to choose a supported third-party telephony provider for SMS and voice authentication via Microsoft Security Store. Microsoft-provided SMS/voice authentication retires by February 1, 2027, except for some users until July 1, 2027. Organizations manage provider relationships directly.
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
The documentation now shows an updated Android screenshot and describes selecting Approve or Deny instead of Yes or No for relevant number-matching prompts in Authenticator, Teams, and Outlook.
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
The documentation expands access from limited availability and updates setup links. It also clarifies that the storage account app registration must use a lowercase `cifs` identifier URI for SMB mounting on macOS.
The prerequisites now explain how incorrect DNS, subnet-to-site mappings, or site configuration can cause provisioning synchronization failures, performance issues, and intermittent connectivity. It directs administrators to correctly map agent server subnets in Active Directory Sites and Services.
The guide now clarifies that migration must start from the active Connect Sync server, identifies device synchronization as a guided-migration blocker, explains readiness results, and adds validation and support-evidence checklists.
The tutorial now emphasizes manual migration for test or pilot environments, directs eligible customers to the guided migration tool, adds scope-removal and source-anchor guidance, clarifies device migration coverage, and links related migration resources.
The article now explains that it covers configuring Device Sync in Microsoft Entra Cloud Sync, not transferring Device Sync with the guided migration tool. It links to the tool’s prerequisites.
New documentation explains how to inspect or remove stored source-to-target connections for provisioning jobs, including required identifiers, permissions, and recovery steps. The API is available through Microsoft Graph beta and deleting a connection does not delete either object.
A new reference lists source and target identifiers for provisioning scenarios, their required formats, and how to use them with Microsoft Graph to inspect or delete connections.
The documentation now directs administrators to a migration decision guide, guided-tool eligibility checks, or manual phased migration guidance. It also clarifies scope protection, reference validation, and migration-result verification.
The guide now distinguishes platform capability comparisons from what the guided migration tool can transfer. It identifies device synchronization as a current guided-tool blocker and adds separate guidance for guided, manual, or deferred migration paths.
The documentation now describes validation for both single-tenant and multitenant OIDC applications, including configuration-specific endpoint requirements and eligibility guidance.
The page author and manager metadata were changed.
The document author was changed from hkinyunyu to HildaK-pm.
The documentation now states that tenant administrators cannot reverse Microsoft disablement by enabling tenant-local sign-in or reactivating the app registration.
The page now directs Connect Sync users to review the decision guide, validate guided-tool prerequisites, and choose a supported guided or manual migration path. It also links the migration FAQ and separates Device Sync review from guided-tool eligibility.
Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.
The documentation now explains that Connect Sync and Cloud Sync may coexist during a phased migration, but must not simultaneously export normal changes for the same object and attribute set. It adds links to manual migration steps and scope-removal planning.
The documentation explains that tenant administrators cannot reverse Microsoft disablement by setting `accountEnabled` to `true` or reactivating the app registration. It also provides support guidance for application publishers and users.
A new article explains how to diagnose intermittent timeouts and slow provisioning from Workday, SAP SuccessFactors, and API-driven HR integrations to on-premises Active Directory. It covers job status, provisioning agents, matching attributes, domain controllers, DNS, connectivity, and relevant logs.
The documentation now explains that globally disabling a blueprint can cause related agents in other tenants to fail or lose functionality. It also adds steps for disabling a blueprint in the Microsoft Entra admin center.
The documented procedure now uses **Disable** > **Disable in all tenants** and specifies that the impact applies to multi-tenant blueprints.
The documentation now describes a real-time Identity Protection detection for suspiciously added authentication methods. It raises user risk and can trigger configured risk-based policies; the page lists Microsoft Entra ID P2 as required, pending confirmation.
The documentation now lists the `suspiciousCredentialAddition` risk event type instead of `TBD` and revises the detection description. Metadata and customer intent were also updated.
The documentation now links to the Microsoft Graph accessDriftSummary API and separately identifies review through the Microsoft Entra admin center. The page date was also updated.
The entitlement management reports documentation now uses an updated link for the List accessDriftSummary API.
The page title and heading for Microsoft Entra SAP IAG integration no longer include “(Preview).”
Updated October 19, 2026: We have identified that this message did not reach it's intended audience. You can safely disregard this message, and we apologize any confusion this may have caused.
The migration partners page now lists Fortytwo and updates its publication date.
The Edgile listing now links to its Microsoft Entra External ID page instead of its previous blog post.
A new article compares three identity verification patterns: Verified ID credentials, direct REST API claims, and OIDC federation. It explains partner-based proofing, External ID authentication, setup considerations, and handling of longer-running verification journeys.
The page now documents a scenario where Global Secure Access handles private application and Microsoft 365 traffic while Netskope captures internet traffic. It includes configuration, verification, and traffic-testing steps for Windows and macOS.
The documentation now notes that switching to v2 is non-reversible, while previous configurations carry over without changes to end-user traffic.
A new how-to explains configuring Microsoft Entra Private Access with Infoblox Threat Defense, including prerequisites, DNS bypasses, internal domains, category filters, endpoint groups, and security policies.
The documentation now states that tenant administrators or Microsoft can revoke application credentials, including credentials stolen or added by a threat actor.
A new guide explains revoked-credential error codes, how to inspect tokenRevocations on applications and service principals using Microsoft Graph beta, and how to assess revocation effects and possible compromise.
The configuration instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy instead of Session management.
The documented path changed from Global Secure Access > Session management > Explicit Forward Proxy to Global Secure Access > Connect > Explicit Forward Proxy.
The release notes now document Web sign-in support, Conditional Access sign-in frequency for Private Access applications, updated firewall behavior, clearer forwarding-profile names, private-network bypass changes, and other improvements.
The fifth Netskope coexistence scenario is now correctly numbered as item 5.
The instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy, replacing the previous Session Management path and tab selection.
