Wednesday, 23 September 2026

Soprano and Telesign named initial private-preview SMS and voice providers

The most consequential update concerns the transition away from Microsoft-provided SMS and voice authentication: Entra guidance names Soprano and Telesign as initial private-preview providers and says selection and configuration through Microsoft Security Store begins October 30, 2026. Other changes add Workload ID setup detail, clarify a save requirement for SAML certificate notifications, define PIM for Groups protection scope, and correct Rootly provisioning instructions.

• Entra ID · Authentication

  SMS and voice guidance names initial providers and reinforces the passkey transition

  The updated Entra authentication guidance identifies Soprano and Telesign as initial private-preview providers and states that provider selection and configuration through Microsoft Security Store begins October 30, 2026. It also frames passkeys as the default while Microsoft-provided SMS and voice authentication retire, directing affected administrators toward a provider or passkeys and another phishing-resistant method.

• Workload ID · Security

  Flexible federated credential preview guidance adds managed identity setup

  The setup guidance now covers both applications and user-assigned managed identities, using Microsoft Graph for applications and Azure Resource Manager for managed identities. It also documents credential properties including claimsMatchingExpression.

• Entra ID · General

  SAML certificate notification setup requires confirmation and Save

  Administrators who configure notification email addresses through Microsoft Graph or PowerShell are instructed to re-confirm the address under SAML Certificates and select Save in the Microsoft Entra admin center. Without re-saving the SAML settings, certificate expiration notification emails might not be sent.

• ID Governance · Fundamentals

  PIM for Groups guidance explicitly includes owners and inactive eligible assignments

  The updated guidance says credential protection for role-assignable groups covers members and owners, including eligible members and owners who have not yet activated their assignments.

• Entra ID · Provisioning

  Rootly provisioning now uses the rootly.com SCIM endpoint

  The Rootly provisioning tutorial changes the Tenant URL from https://docs.rootly.com/integrations/scim to https://rootly.com/scim. Administrators configuring Rootly SCIM provisioning should use the new endpoint.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.