The guidance now documents provisioning the Microsoft Authenticator Credential Registration enterprise application and excluding it from Conditional Access policies scoped to All resources to unblock passkey registration.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Qualifying Entra tenants face SMS first-factor sign-in disablement through November
Microsoft will disable SMS first-factor sign-in in tenants with no successful or only unsuccessful SMS sign-ins during the previous 30 days, with rollout timing from mid-September through November 2026; SMS MFA and password reset remain unaffected. The period also documents an Agent ID inactivity-policy preview, sets a 31 March 2027 OAuth migration deadline for Vonage and Puzzel provisioning, gives Authenticator passkey setup November 2026 availability timing, and clarifies cross-tenant synchronization licensing.
- SMS first-factor sign-in faces disablement for low-use tenants
Entra ID · AuthenticationMicrosoft says it will disable SMS first-factor sign-in in tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, with timing from mid-September through November 2026. SMS used for MFA and password reset is unaffected; administrators should review usage, notify users, and ensure alternate sign-in methods.
- Agent ID preview policy sets 60-, 90-, and 455-day milestones
Agent ID · GovernanceThe preview policy notifies owners after 60 days of inactivity, disables identities after 90 days, and deletes them after 455 days. It can be enabled without a license, with configurable scope and fallback notification recipients; seasonal or limited-use agents should be excluded if they must remain inactive.
- Vonage provisioning must move to OAuth client credentials by March 2027
Entra ID · ProvisioningVonage provisioning will stop supporting OAuth 2.0 Authorization Code Grant after 31 March 2027. The revised procedure uses OAuth 2.0 Client Credentials Grant; affected user and group synchronization jobs should migrate by the deadline to avoid provisioning stoppage or eventual job removal. SSO is unaffected.
- Authenticator passkey setup guidance names November 2026 resource availability
Entra ID · Conditional AccessThe setup guidance states that the Microsoft Authenticator Credential Registration resource will be available in November 2026. Administrators must provision the enterprise application before excluding the resource from a Conditional Access policy.
- Cross-tenant group synchronization carries Governance or Suite licensing requirements
ID Governance · FundamentalsThe updated guidance distinguishes direct user synchronization, which requires Microsoft Entra ID P1, from synchronizing a group and its members, which requires Microsoft Entra ID Governance or Microsoft Entra Suite for each synchronized user in the source tenant. Group-synchronization planners should verify those licenses.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
10 updates
Microsoft Entra ID
7 updatesMicrosoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in
NewMicrosoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September to November 2026. SMS for MFA and password reset remains unaffected. Admins should review usage, notify users, and ensure alternate sign-in methods.
Configure Puzzel for automatic user provisioning with Microsoft Entra ID
RetirementAction requiredThe documentation states that OAuth 2.0 Authorization Code Grant is being retired for Puzzel provisioning. Affected jobs should use OAuth 2.0 Client Credentials Grant; otherwise provisioning may stop working after the deadline.
Configure Vonage for automatic user provisioning with Microsoft Entra ID
RetirementAction requiredVonage provisioning will stop supporting OAuth 2.0 Authorization Code Grant after March 31, 2027. The updated procedure generates and uses client credentials; SSO is unaffected.
Snowflake Provisioning Tutorial
Doc updateAction requiredThe tutorial now links to Snowflake SCIM documentation, specifies using an account administrator, explains the SQL script, emphasizes that `AAD_PROVISIONER` is case-sensitive and uppercase, and adds related authentication links.
Snowflake Provisioning Tutorial
Doc updateThe tutorial’s task lists were changed from numbered items to bullet points; the instructions and screenshots remain the same.
Enable Authenticator Passkey
Doc updateThe documentation now states that the Microsoft Authenticator Credential Registration resource will be available in November 2026. It also retains the prerequisite to provision the enterprise application before excluding the resource from a Conditional Access policy.
Microsoft Entra Agent ID
2 updatesThe documentation now directs administrators to **Agent ID (Preview)** instead of **Agent IDs**, and updates the introductory wording about agent identity lifecycle risks.
The documentation describes a preview policy that notifies owners after 60 days of inactivity, disables identities after 90 days, and deletes them after 455 days. Administrators can enable it, configure its scope, and set fallback notification recipients.
Microsoft Entra ID Governance
1 updateCross Tenant Synchronization Overview
Feature updateThe documentation now states that direct cross-tenant user synchronization requires Microsoft Entra ID P1, while synchronizing a group and its members requires Microsoft Entra ID Governance or Microsoft Entra Suite for each synchronized user in the source tenant.