Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The period’s main operational change is an authentication transition: passkeys became the default Microsoft Entra authentication on September 1, 2026, while Microsoft-provided SMS and voice authentication will retire on February 1, 2027. Other updates are targeted guidance for External ID browser authentication, registration campaigns, and HR provisioning null-value handling.
Entra ID · Conditional AccessPasskeys became the default Microsoft Entra authentication on September 1, 2026. Microsoft-provided SMS and voice authentication will retire on February 1, 2027, after which customers must use telecom providers from the Microsoft Security Store. Microsoft recommends transitioning to passkeys for phishing-resistant security.
External ID · AuthenticationThe new guidance describes handing external-IdP authentication from an embedded WebView to the system browser, enabling external-IdP passkeys, browser SSO, and identity providers that block WebViews. It lists the required platform, broker, application-version, federation-protocol, and cloud-support considerations.
Entra ID · AuthenticationThe updated guidance distinguishes Microsoft-managed from enabled campaigns, specifies the MFA method required for each targeted authentication method, and broadens eligible users from those signing in with SMS or voice to users signing in with any MFA method.
Entra ID · ProvisioningPreview guidance covers clearing mapped target attributes when Workday or SAP SuccessFactors inbound provisioning returns null or empty values, with configuration, schema, testing, and troubleshooting material for the behavior.
Entra ID · TroubleshootingTarget attributes are cleared only when Flow null values is enabled for both the source attribute and the target mapping. The updated guidance also documents choices to clear, preserve, or replace empty values.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation adds preview support for clearing mapped target attributes through Workday and SAP SuccessFactors inbound provisioning, with configuration, schema, testing, and troubleshooting guidance.
The reference explains how optional single-valued source attributes can clear mapped target attributes when Workday returns null or empty values, with configuration guidance linked.
The documentation now explains how optional single-valued source attributes can clear mapped target attributes when SAP SuccessFactors returns null or empty values.
The documentation now explains how to configure attribute value clearing, fallback values, or ignored values when HR applications return null or empty attributes during provisioning.
The documentation now explains that target attributes are cleared only when **Flow null values** is enabled for both the source attribute and target mapping. It also documents options to clear, preserve, or replace empty values.
The documentation now distinguishes Microsoft-managed and enabled campaigns. It specifies the MFA method required for each targeted authentication method and broadens eligible users from SMS or voice sign-ins to users signing in with any MFA method.
Passkeys became the default Microsoft Entra authentication on September 1, 2026. Microsoft-provided SMS and voice authentication will retire February 1, 2027, requiring customers to use telecom providers from the Microsoft Security Store. Transition to passkeys is recommended for stronger, phishing-resistant security.
Microsoft Entra can hand brokered external-IdP authentication from an embedded WebView to the system browser, enabling external-IdP passkeys, browser SSO, and IdPs that block WebViews. The documentation lists supported platforms, brokers, versions, apps, and cloud availability.
