Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The period’s strongest administrator change is the move of Enterprise State Roaming management out of the Entra admin center, alongside two scheduled passkey rollouts beginning in October 2026. Microsoft also tightened self-service App Gallery onboarding guidance for v1 endpoint applications and expanded Account Discovery guidance to groups, with preview and matching-attribute limitations. Most remaining edits refine licensing, troubleshooting, and operational requirements, including Private Access alert eligibility.
Entra ID · GeneralAs of July 2026, Enterprise State Roaming can no longer be managed in the Microsoft Entra admin center. Administrators must use Windows settings backup and restore policies; supported settings remain unchanged, and existing controls are honored for one year.
Entra ID · Conditional AccessThe announced rollout starts in October 2026 and will let B2B users register and sign in with resource-tenant passkeys for phishing-resistant MFA. Eligible users will be enabled automatically.
Entra ID · Conditional AccessA phased rollout from October 2026 through February 2027 will allow users to register passkeys or passwordless sign-in as their first MFA method, removing the need to set up weaker methods first.
Entra ID · GeneralApplications using Microsoft identity platform v1 endpoints cannot be validated through self-service App Gallery onboarding. The guidance recommends migrating those applications to v2 endpoints before validation.
Entra ID · GovernanceThe updated guidance covers users and groups, classifying identities as local, unassigned, or assigned. Group discovery is in preview, and correlation requires a direct matching attribute.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
As of July 2026, ESR can no longer be managed in the Microsoft Entra admin center. Administrators must use Windows settings backup and restore policies; the supported settings remain unchanged.
The documentation now states that applications using Microsoft identity platform v1 endpoints cannot be validated through self-service App Gallery onboarding. It recommends migrating to v2 endpoints.
The configuration guide no longer includes the note about synchronization service account creation and possible errors involving multifactor or interactive authentication.
Microsoft Entra ID will support passkey registration and sign-in for B2B users, enabling phishing-resistant MFA using resource tenant passkeys. Rollout begins October 2026, with automatic enablement for eligible users. Administrators should review authentication policies and configurations; no immediate action is required.
Users can now register passkeys or passwordless sign-in as their first multifactor authentication method in Microsoft Entra, eliminating the need to set up weaker methods first. This change, rolling out in phases from October 2026 to February 2027, aims to increase adoption of phishing-resistant sign-in.
The troubleshooting guidance for SEC_E_NO_AUTHENTICATING_AUTHORITY now links to Windows Server 2025 build 26100.6905 information.
The troubleshooting guide now uses `-vAuth` instead of `-v` when starting `Start-auth.ps1`.
Account discovery now covers users and groups, classifying them as local, unassigned, or assigned identities. Group discovery is identified as being in preview, and correlation requires a direct matching attribute.
The tutorial now requires Microsoft Entra ID P1, P2, or Governance licenses for every identity sourced through API-driven provisioning.
The Tenant Governance licensing page now links to Microsoft Agent 365 licensing FAQs and guidance for using governance relationships with Microsoft Defender.
The access package creation documentation now explains that the search box can find matching SharePoint Online roles that are not initially displayed, especially on sites with many roles.
The documentation now recommends using the search box to find SharePoint Online roles when adding them to an access package. Search returns matching roles even when they are not initially displayed.
The licensing documentation’s Microsoft author alias was updated from `tafra00` to `tazkiaafra`.
The licensing fundamentals page was updated to align the Account Discovery section and state that the feature requires the Microsoft Entra ID Governance add-on or Microsoft Entra Suite.
The page now lists the Microsoft Agent 365 Licensing FAQs and governance relationships links without the previous section heading and introductory text.
The Internet Access health-signal article now lists licensing, roles, Microsoft Graph permissions, and log access requirements. It also adds steps for investigating alerts and reviewing filtering and forwarding policies.
The documentation now requires a non-trial Microsoft Entra P1 or P2 license plus at least 100 monthly active users to view alerts and receive notifications. It also clarifies Private Access licensing, least-privilege roles, Graph permissions, and expanded signal and alert investigation guidance.
The article now distinguishes tunnel and BGP connectivity scenarios and adds investigation steps, licensing requirements, least-privilege roles, and Microsoft Graph permissions for viewing and managing signals and alerts.
