Whats New
New featureThe June 2026 update adds the Entra SOC Identity Responder role and updates the Security Operator and AI Administrator roles.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
SOC Identity Responder guidance names containment actions; Agent ID sponsors cannot restore agents
Role and permission references dominate 4 September: the June 2026 update records the Entra SOC Identity Responder role and changes to Security Operator and AI Administrator definitions, while companion pages spell out SOC containment and privileged-account boundaries. Agent ID pages define what sponsors can disable or delete and who must restore agents. Two same-day permissions-reference edits also give opposing descriptions of Security Administrator’s containment authority.
The Permissions Reference now describes the role’s identity-containment actions as disabling users, revoking active sign-in sessions, and resetting passwords.
- Containment roles are documented as unable to act on privileged accounts
Entra ID · MonitoringPrivileged Roles Permissions now lists Security Administrator, Security Operator, and Entra SOC Identity Responder as limited to non-administrative user accounts and unable to act on privileged accounts.
- Security Administrator containment wording diverges across permissions references
Entra ID · AuthenticationOne updated reference removes the statement that Security Administrators can perform identity-containment actions and instead describes reading security information and reports and managing Microsoft Entra ID and Office 365 configuration. A separate same-day entry says the role description now states that Security Administrators can perform identity containment during security incidents.
- Agent ID sponsors can disable and soft-delete resources but cannot restore them
Agent ID · GovernanceSponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities.
- Agent ID re-enablement falls to owners or administrators
Agent ID · GeneralThe end-user guidance says sponsors cannot re-enable disabled agents; an owner or administrator must help re-enable them.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
9 updates
Microsoft Entra ID
7 updatesDelegate By Task
Feature updateThe documentation now lists Security Administrator, alongside Helpdesk Administrator and User Administrator, for invalidating non-admin users’ refresh tokens.
Permissions Reference
Doc updateThe permissions reference now documents the Entra SOC Identity Responder role and its identity-containment actions, including disabling users, revoking active sign-in sessions, and resetting passwords.
Least privileged roles by task
New featureThe task delegation table now maps identity containment actions for SOC incident response to the Entra SOC Identity Responder role.
Permissions Reference
Doc updateThe permissions reference no longer states that Security Administrators can perform identity containment actions during security incidents. It now describes the role as reading security information and reports and managing configuration in Microsoft Entra ID and Office 365.
Permissions Reference
Doc updateThe role description now states that Security Administrators can perform identity containment actions during security incidents.
Privileged Roles Permissions
Doc updateThe documentation now lists Security Administrator alongside Security Operator and Entra SOC Identity Responder as limited to non-administrative user accounts and unable to act on privileged accounts.
Microsoft Entra Agent ID
2 updatesManage Agent Identities End User
Doc updateThe documentation now states that sponsors cannot re-enable disabled agents; an owner or administrator must help re-enable them.
Agent Owners Sponsors Managers
Doc updateSponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities.