Thursday, 29 October 2026

Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.

Microsoft Authenticator for iOS and Android will receive usability updates starting November 2026, including a refreshed home experience, clearer account restoration guidance, improved sign-in flows, and platform-specific prompts. Android improvements for restoration and battery optimization prompts will follow in January 2027. No action required.

The documentation now explains how users can change Microsoft Entra cloud passwords with FIDO2 passkeys or Windows Hello for Business, including the tenant-wide setting required to enable the experience and its limitation for on-premises password writeback.

Organizations can allow users to change cloud passwords after authenticating with a registered FIDO2 passkey or Windows Hello for Business credential, without knowing the current password or using SSPR. Temporary Access Pass isn't supported unless the user knows the existing password.

The documentation now lists Microsoft Entra CBA, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change a cloud password without entering the current password.

The page now labels the section “Allow password change after secure sign-in” and its subsection “Enable the setting,” replacing the previous “Passwordless authentication” heading.

The documentation section describing password changes after sign-in with CBA, FIDO2 passkeys, or Authenticator passwordless notifications was revised.

The documentation updates the name of the password-change flow available after CBA, passkey, or Authenticator passwordless sign-in.

The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.

In hybrid environments, password changes made with passwordless authentication can be written to an on-premises directory when password writeback is configured.

The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.

The documentation now states that rollout across all clouds begins in late October 2026 and is expected to finish by the end of November 2026.

The documentation updates the section heading and setting label to “Allow password change after secure sign-in.”

The documentation now states that users need a Microsoft Entra ID P1 or P2 license to use this feature.

The documentation now uses the exact name of the secure sign-in setting related to changing cloud passwords after passwordless sign-in.

The combined MFA and SSPR registration documentation updates its passwordless sign-in reference with a link to the relevant passwordless documentation.

The callout was changed from Note to Important.

The heading “Allow password change after secure sign-in” now ends with a period.

The title no longer includes “(Preview),” and the publication date changed from August 11, 2026, to October 29, 2026.

The documentation now requires all writable domain controllers to meet specified Windows Server update levels and requires ADSyncTools version 2.6.0 or later. It also adds a warning that enforcement cannot be configured if any writable domain controller is unsupported.

The tutorial now links to Brivo’s contact page instead of its quote page for obtaining a Brivo Onair Identity Connector tenant.

The documentation now explains that reported last activity can include incomplete sign-ins absent from sign-in logs. A timestamp does not confirm successful authentication or token issuance, and some partial activity may be misclassified as app-only during preview.

The documentation adds a tutorial for configuring Microsoft Entra agent identities to authenticate to Azure Database for PostgreSQL flexible server and access data through group-based authorization, entitlement management, and conditional access.

The overview’s guidance on managing agent identities and viewing their access and activity information was updated.

The agent identity overview revises wording about automatically assigning identities to Microsoft Copilot Studio agents and creating the related identity blueprint.

The entitlement management scenarios documentation no longer labels “Govern access for agents” as preview.

The Entra ID Governance integrations table now lists Secure Cloud and distinguishes Zscaler ZSNet from Zscaler with separate links.

The overview page now uses a more specific section link and clearer descriptions of automated provisioning, SSO just-in-time provisioning, and additional application integrations.

The page replaces the Mississippi Division of Medicaid customer example with the Digital Security and Resilience team at Microsoft and updates the accompanying wording and link.

The entitlement management overview removes “preview” from references to assigning groups and API permissions to agents, and from the related license-requirements heading.

The overview heading and linked page title now refer to “Identity governance for agent identities” and “Governing agent identities,” with the “preview” label removed.

The heading for license requirements when requesting on behalf of agent identities no longer includes “(preview).”

The identity governance use-cases page no longer labels the Microsoft Entra Agent ID governance topic as “preview.”

The documentation now explains that Continue is a preview default action used when no enabled enforcement rule matches. It passes evaluation to the next applicable security profile in priority order, while Allow and Block stop V2 evaluation. It also adds cross-profile examples and clarifies Baseline and V1 behavior.

The documentation now consistently labels the Continue default action as “in preview” and describes how unmatched traffic passes to the next applicable security profile.

The article title and preview notice for configuring custom headers were removed.