Security Defaults article removes individual-protection management guidance from Microsoft Learn

The period contained two targeted Microsoft Learn updates. The Security Defaults article removed its section on individual protections, while the External ID federation customer example changed how the source tenant is represented in the issuer value.

Entra ID · Fundamentals Security Defaults guidance removes individual-protection details

The article no longer includes the section covering individual Security Defaults protections, including their preview availability, roles, behavior, and management steps. This removes those administration details from the article.

External ID · General Federation user-creation example now uses the source tenant’s primary domain

The Entra ID Federation Customers example replaces the source tenant ID with its primary domain name in the issuer value and defines the new placeholder using an example domain.

External ID guidance adds domain_hint routing for invited users

The period centers on new and revised administrator guidance. External ID now has documented invitation-redemption routing through domain_hint, while Entra ID guidance covers Arkose anti-bot verification before telephony-based sign-in. Additional updates clarify Connector Groups routing scope, atypical-travel risk timing, and the causes of a Deactivated application status.

External ID · Standards Invitation redemption can use domain_hint to select an identity provider

New External ID guidance explains how the domain_hint authorization parameter routes invited external-tenant users to configured OpenID Connect, SAML/WS-Federation, or social identity providers. It covers invitations through Microsoft Graph or the admin center and custom invitation emails, and lists the external tenant, registered application, associated user flow, configured provider, and domain_hint value as prerequisites.

Entra ID · Authentication Telephony sign-in guidance adds Arkose verification details

New Entra ID guidance says users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls. It documents the user experience, network requirements, and help-desk guidance; restrictive firewalls, proxies, or web filtering may require HTTPS access to the specified Arkose Labs domains.

Global Secure Access · Authentication Connector Groups guidance describes latency-based Performance mode

The updated Global Secure Access guidance describes Performance mode as routing user traffic to the connector with the lowest measured network latency. It also clarifies that connector load balancing applies only to Microsoft Entra Private Access applications, not application proxy applications, and identifies the routing behavior as preview guidance.

ID Protection · Fundamentals Atypical travel risk is now documented as real-time

The ID Protection risk table now lists Atypical travel as “Real-time” instead of “Offline.” Its Premium requirement and unlikelyTravel identifier are unchanged, so administrators reviewing operational expectations should use the updated processing description.

Entra ID · Developer Deactivated status now requires separate application and sign-in checks

Updated Entra ID application-property guidance says Deactivated can result from tenant-local sign-in disablement, app registration deactivation, or Microsoft disablement. These conditions can overlap and must be remediated independently, so the status label alone does not identify the underlying cause.

Microsoft-managed Conditional Access policy nears enforcement for high-risk user remediation

Microsoft is warning that a new Microsoft-managed Conditional Access policy for high-risk users will soon be enforced, while sensitivity labels for Entra cloud security groups are scheduled for mid-November 2026. The period also adds two meaningful ID Governance previews—PIM postapproval extensions and SAP Access Control integration—plus clearer Security Defaults guidance for selected Free tenants.

ID Protection · Conditional Access Microsoft-managed Conditional Access policy targets high-risk users

The message says a new Microsoft-managed “Require risk remediation for high-risk users” policy and a new security group were created in the tenant. The policy uses Microsoft Entra ID Protection to identify high-risk users and prompts them to self-remediate through adaptive risk remediation; enforcement is described as soon.

Entra ID · Governance Sensitivity labels for Entra cloud security groups are scheduled for mid-November

Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026. Labels can be assigned through multiple platforms, cannot yet be changed once applied, and require tenant configuration separate from Microsoft 365 groups.

ID Governance · Governance PIM role activation preview adds deferred postapproval checks

Updated preview guidance adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also documents collecting cost center or project code and requires the relevant Graph permissions and endpoint configuration. The capability requires Entra ID Governance or Entra Suite; Entra ID P2 alone does not include it.

ID Governance · Governance SAP Access Control preview maps business roles into entitlement management

New preview guidance describes governing SAP business roles through Microsoft Entra entitlement management catalogs, access packages, and My Access while retaining SAP Access Control workflows and approvals. The documented setup covers SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.

Entra ID · Authentication Security Defaults guidance enumerates four independently manageable protections

For selected Microsoft Entra ID Free tenants, the article now describes four separately manageable protections: administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking. It also explains their interaction with Conditional Access and which roles can manage them.

Cross-tenant access guidance adds a P1 prerequisite for redemption-order changes

The Cross Tenant Access Overview now states that changing the default redemption order requires a Microsoft Entra ID P1 license on the configured tenant, alongside trust or scoped access configuration.

External ID · Fundamentals P1 requirement documented for default redemption-order changes

The overview now identifies Microsoft Entra ID P1 on the configured tenant as a requirement for changing the default redemption order, in addition to configuring trust or scoped access settings.

Passkey campaign guidance separates platform nudges, attestation paths, and silent SSO

The 12 October Entra ID updates focused on authentication guidance. The most consequential clarifications define how registration-campaign profiles are evaluated across platforms, where attested Authenticator passkeys can be registered, and when campaign nudges appear; examples also distinguish Windows Hello for Business from passkey profile restrictions.

Entra ID · Authentication Campaign profiles have clearer platform-specific nudge rules

The guidance says unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation. AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.

Entra ID · Authentication Attested Authenticator passkeys follow different iOS and Android paths

iOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.

Entra ID · Authentication Campaign prompts are tied to interactive MFA-satisfying sign-ins

Eligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, including refresh token redemption, do not display registration-campaign nudges.

Entra ID · Authentication Windows Hello for Business is evaluated separately from passkey profiles

The guidance states that Windows Hello for Business registration doesn’t follow passkey profile restrictions, so administrators should evaluate it separately when interpreting nudge suppression.

Entra Agent ID preview introduces lifecycle policies for sponsors, inactivity, and enforcement

A new Agent ID capability is documented in preview, giving administrators lifecycle policies for governing agent identities through reconfirmation, sponsorship, inactivity monitoring, notifications, grace periods, and enforcement actions.

Agent ID · Governance Agent ID lifecycle policies enter preview

The policies support periodic reconfirmation, minimum sponsor requirements, inactivity monitoring, notifications, grace periods, and enforcement actions for agent identities.

Key rotation reaches general availability while baseline enforcement guidance adds a Graph query

The strongest changes affect trust authentication, Conditional Access scoping, and Agent ID troubleshooting. Updated What's New guidance describes key rotation for incoming trust referral flows as generally available, improving reliability and addressing failures when referral tickets use a secondary key. Enforcement Resource Exclusions guidance records that baseline-scope enforcement rollout began June 15, 2026, and adds a Microsoft Graph query. New Agent ID how-to articles cover autonomous and interactive sign-ins, while a separate Kerberos trust guide details setup and lifecycle operations. The standalone Kerberos Server Key Rotation article was removed, and access-package guidance now clarifies a limitation on overlapping automatic-assignment policies.

Entra ID · Authentication Generally available key rotation addresses secondary-key referral failures

The updated What's New guidance says key rotation for incoming trust referral flows is generally available. It describes the change as improving reliability and addressing authentication failures caused when referral tickets use a secondary key; no required administrator action is stated.

Entra ID · Conditional Access Baseline enforcement rollout gains a policy-discovery query

Enforcement Resource Exclusions guidance now states that baseline-scope enforcement rollout began June 15, 2026. It adds a Microsoft Graph query for finding affected Conditional Access policies and clarifies customization and sign-in review guidance.

Agent ID · Authentication Autonomous Agent ID sign-ins get preview health-investigation guidance

A new how-to explains Health Monitoring signals and alerts, impact criteria, log correlation, troubleshooting, and prerequisites for autonomous agent sign-ins. The monitoring and alerts are documented as being in preview, with guidance for identifying affected applications and investigating application-only authentication failures.

Entra ID · Authentication Kerberos trust guidance covers setup through trust removal

The new guide documents prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, trust removal, and required permissions for managing trust between Microsoft Entra ID and on-premises AD DS.

ID Governance · Governance Automatic assignment policies must not overlap for matched users

Entitlement Management guidance now clarifies that multiple automatic assignment policies for one access package are supported only when users do not match multiple policies simultaneously. Administrators should review overlapping policy scopes to avoid duplicate assignment paths.

Entra outlines late-October passkey expansion for B2B and first MFA registration

Two Microsoft Entra ID announcements point to a late-October 2026 authentication expansion. B2B users in resource tenants are slated to gain passkey registration and sign-in, while users generally will be able to register passkeys or passwordless sign-in as their first multifactor authentication method without setting up SMS or voice first. Documentation updates also remove September rollout language, and Verified ID partner material adds HYPR.

Entra ID · Conditional Access B2B users are slated to gain passkey registration and sign-in

Starting in late October 2026, resource tenants are expected to support passkey registration and sign-in for B2B users. Internal guest users will get Microsoft Authenticator app passkeys, while external users will not. The capability is described as enabled by default and intersecting with SMS and voice retirement policies.

Entra ID · Conditional Access Passkeys can become users’ first multifactor authentication method

A phased rollout beginning in late October 2026 will let users register passkeys or passwordless sign-in as their first multifactor authentication method, removing the need to establish SMS or voice authentication first. The announcement says no user action is required.

Entra ID · Authentication System-preferred authentication guidance removes September rollout wording

The article date changed to October 7, 2026, and the note describing gradual Microsoft-managed deployment through September 2026 was removed. The page no longer presents that September rollout language as ongoing.

Entra ID · Authentication Registration campaign guidance drops its September completion estimate

The article no longer says the registration campaign rollout was expected to finish by the end of September 2026 or that tenant experiences might differ during the rollout. No administrator action is indicated in the supplied update.

Verified ID · General HYPR is added to the Verified ID identity-verification partner gallery

The gallery now lists HYPR, links to its documentation, and describes its integration for workforce identity verification. Administrators and developers comparing partners can evaluate it for remote onboarding, secure access, and account recovery.

Agent Conditional Access guidance now separates agent identities, user accounts, and OBO traffic

Agent Conditional Access is the clear center of the 7 October update: a new Entra ID guide covers agents operating through their own user accounts, while Agent ID guidance separates agent identities, agent user accounts, and delegated or on-behalf-of access. The guidance directs administrators to match policy targeting to the token subject and check the stated licensing, role, device, network, registration, and OAuth prerequisites. A separate authentication update refreshes FIDO2 attestation data.

Entra ID · Conditional Access New guide requires separate targeting for agent user accounts

The new Entra ID Conditional Access guide covers agent risk, compliant devices, and compliant networks for agents that use their own user accounts. It states that policies targeting all users do not include agent user accounts, so administrators must target agent users separately and satisfy the listed licensing, role, device, and network prerequisites.

Agent ID · Conditional Access OBO guidance assigns Conditional Access targeting to the signed-in user

Updated Agent ID guidance says the signed-in user is the token subject for on-behalf-of traffic, whether targeted directly or through groups, and directs administrators to user-targeted policies for those resources. Selecting an agent identity is documented for a different access pattern.

Agent ID · Conditional Access Autonomous-agent policy guidance adds prerequisites and report-only blocking

The revised guidance centers policies on agents using their own identities, adds licensing, role, registration, and OAuth prerequisites, and recommends report-only block policies for unapproved agents.

Entra ID · General Policy guidance lists current licensing options and an upcoming Agent 365 requirement

The Policy Autonomous Agents page lists Microsoft 365 E7, or Microsoft Agent 365 paired with Microsoft Entra P1 or Microsoft 365 E3, and says Agent 365 will soon be required.

Entra ID · Authentication FIDO2 attestation reference moves to MDS 285 and adds five models

The attestation page now references MDS version 285 instead of 279 and adds five FIDO2 security-key models with their AAGUIDs and capability indicators. Administrators evaluating key attestation should use the updated identifiers.

Cloud Sync supports hybrid-join device synchronization; Private Access 2.2.79 adds OTA updates

The most consequential updates clarify Cloud Sync support for Microsoft Entra hybrid join and document the Private Access Sensor 2.2.79 release, including its upgrade prerequisites. Entra administrators also get a more precise SSPR authentication-method count and stronger External ID passkey sample warnings. Most other changes were spelling, metadata, naming, or presentation edits.

Entra ID · Provisioning Cloud Sync migration now includes hybrid-join device synchronization

The migration decision guide now states that Cloud Sync supports device synchronization for Microsoft Entra hybrid join. Device synchronization must be enabled separately, with updated migration guidance and configuration steps. Administrators moving hybrid-joined devices should include this capability explicitly in their migration plan.

Private Access · General Private Access Sensor 2.2.79 adds OTA updates and Kerberos improvements

The release history records version 2.2.79, released September 29, 2026, with over-the-air sensor updates, enhanced Kerberos security and diagnostics, SID-based service matching, and corrected wildcard matching. Upgrading from version 2.2.42 requires a one-time full-installer deployment to enable OTA updates; inbound TCP and UDP port 1337 must be allowed, and IPv4 is required because IPv6 Kerberos traffic is blocked.

Entra ID · Authentication SSPR counts Authenticator and OATH variants as one method

The SSPR guidance now states that Microsoft Authenticator, software OATH tokens, and hardware OATH tokens count as one authentication method, regardless of Authentication methods policy migration status. Administrators should use that shared count when evaluating SSPR method requirements.

External ID · Authentication External ID passkey samples receive explicit high-privilege warnings

The updated guidance describes administrator-controlled passkey provisioning through the FIDO2 provisioning APIs and identifies the sample as testing-only. Its deletion flow uses high-privilege permissions and a client secret in browser code, so the sample should not be deployed in production.

External ID · Authentication External-tenant SMS guidance distinguishes first-factor and SSPR use

The FAQ now states that SMS is unavailable for first-factor authentication in external tenants while indicating availability for self-service password reset. SMS remains available for second-factor verification at additional cost, giving administrators a clearer basis for external-tenant SSPR planning.

Provisioning expression reference adds German diacritic normalization function

Microsoft updated the Entra application provisioning expression reference with `NormalizeDiacriticsByCulture(source, culture)`. For German (`de`), the documented transliteration converts `ä` to `ae` and `ß` to `ss`.

Entra ID · Provisioning German-aware normalization added to provisioning expression guidance

The reference now documents `NormalizeDiacriticsByCulture(source, culture)`, including German (`de`) transliteration examples such as `ä` to `ae` and `ß` to `ss`.

App instance property-lock guidance broadens as External ID documents passkey API setup

Updated Entra ID guidance now describes app instance property locks for both single-tenant and multitenant applications, including the stated default for new applications since June 2026. A new Microsoft Entra External ID credential-management API reference covers signed-in customer passkey listing and registration, while Connect Health installation guidance identifies Global Administrator as the default account with agent-registration permission. Sponsors are also directed from My Access to My Account for guest management. Most remaining edits are narrower documentation corrections.

Entra ID · Security App instance property-lock guidance covers single-tenant apps

The configuration article now says locks apply to an application's service principal for both single-tenant and multitenant applications. It also states that `Enable property lock` is enabled by default for new applications since June 2026 and points administrators to `servicePrincipalLockConfiguration`.

External ID · Authentication External ID documents customer passkey credential-management API

The new reference explains how signed-in customers can list and register passkeys through the credential-management API, covering delegated authentication, permissions, and setup. Using the API requires manually provisioning its service principal and granting the appropriate delegated permission.

Entra ID · General Connect Health agent-registration guidance names Global Administrator by default

The installation page now states that, by default, a Global Administrator account has permission to register the agent, replacing Hybrid Identity Administrator in the documented default.

ID Governance · Governance Sponsored-guest instructions now point to My Account

The instructions now direct sponsors to `myaccount.microsoft.com` and the `Sponsored guests` item in the left navigation instead of My Access.

SharePoint OTP retirement, Connect deadlines, and app-gallery onboarding reshape Entra administration

SharePoint One-Time Passcode authentication will retire across Microsoft 365 tenants starting in mid-October 2026, moving external sharing to Microsoft Entra B2B. Microsoft also opened self-service App Gallery onboarding in public preview ahead of general availability in mid-November, while Connect guidance separates a new AD FS/PingFederate hardening requirement from the broader Sync upgrade deadline.

External ID · Conditional Access SharePoint OTP moves external sharing to Entra B2B in mid-October

SharePoint One-Time Passcode authentication will retire starting in mid-October 2026 for all Microsoft 365 tenants. External users will need guest accounts under Microsoft Entra B2B, bringing SharePoint and OneDrive sharing under consistent governance and Conditional Access.

Entra ID · Standards App Gallery opens self-service onboarding ahead of November GA

ISVs can now validate SSO and provisioning integrations, manage submissions, and track status in the Microsoft Entra admin center. The capability is in public preview, with general availability beginning in mid-November 2026.

Workload ID · Provisioning AD FS and PingFederate hardening raises the Connect minimum

The documented requirement changes from Microsoft Entra Connect 2.5.79.0 to 2.6.84.0 or later. Application-based authentication is also required to maintain directory synchronization and avoid service disruptions.

Entra ID · Provisioning General Connect Sync upgrade deadline moves to April 2027

The minimum-version deadline shifts from September 30, 2026, to April 7, 2027. Microsoft Entra Connect Sync 2.5.79.0 or later is required; synchronization services will fail until the upgrade is completed if the requirement is missed.

Workload ID · Authentication SAP workload identities now require a matching API host

The updated guide removes its Preview label and states that workload identities are reusable only when their Application API host matches the provisioning app’s SAP SuccessFactors API host. It also adds the Application ID URI format and compatibility details for the September 15, 2026 update.

Chatwork SCIM provisioning ends October 1, 2026 as Entra sharpens agent-access guidance

Administrators using the Chatwork Enterprise App Gallery integration face a stated October 1, 2026 cutoff: SCIM provisioning will stop, and the integration will no longer provision users. The period also substantially expands Agent ID Conditional Access guidance around token subjects, agent-user targeting, prerequisites, and report-only rollout. Global Secure Access guidance records a Secure DNS limitation, while most remaining edits cover wording, links, terminology, or role documentation.

Entra ID · Provisioning Chatwork provisioning support has a firm October 1 cutoff

The Chatwork Provisioning Tutorial now states that SCIM provisioning support will end on October 1, 2026. After that date, the Microsoft Entra Enterprise App Gallery integration will stop provisioning users. The page also standardizes the product name to “Chatwork.”

Agent ID · Conditional Access Agent Conditional Access guidance now separates three identity patterns

The guidance distinguishes agents acting for signed-in users, agents using their own identity, and agents using an agent user account. It adds separate guidance links for autonomous agents and agent users and updates the listed licensing combinations, giving administrators a basis for selecting the relevant policy guidance.

Agent ID · Conditional Access Autonomous-agent policy guidance adds prerequisites and report-only rollout

The updated autonomous-agent guidance presents Conditional Access as a scenario-based pattern, adds prerequisites, and recommends starting block policies in report-only mode. It also states that an Agent 365 license will soon be required.

Entra ID · Conditional Access Broad Conditional Access targeting does not include agent users

New guidance for securing agent users states that all-user and group targeting do not include agent users. It documents prerequisites, risk controls, device and network conditions, and blocking risky agent user accounts, so administrators should use the dedicated agent-user pattern rather than assume broad targeting covers these accounts.

Global Secure Access · General Global Secure Access documents Secure DNS and macOS tunneling limits

The known-limitations guidance now states that the Global Secure Access client does not support Secure DNS variants including DoH, DoT, and DNSSEC. It also says the macOS client bypasses Secure DNS to enforce FQDN-based tunneling.

Connect Sync guidance sets a 2.6.84.0 minimum and April 7, 2027 authentication deadline

Most of the period is low-impact documentation maintenance involving terminology, metadata, links, and examples. The meaningful administrator-facing changes are updated Connect Sync requirements, removal of the Cloud Sync device-sync Preview label, new GitHub federation claim guidance, clearer Kerberos prerequisites, and more precise PIM eligibility duration behavior.

Entra ID · Security Connect Sync guidance raises the minimum to 2.6.84.0

The updated Security Updates Pks guidance changes the stated required version from 2.5.79.0 to 2.6.84.0 or later. It also requires application-based authentication by April 7, 2027; synchronization services stop after that date when either requirement is unmet.

Entra ID · Provisioning Cloud Sync device sync loses its Preview designation

The device-sync article removes the Preview label and preview legal notice, while also updating its publication date. The supplied guidance specifies no administrator action.

Workload ID · Security GitHub federation guidance adopts immutable repository subject claims

Starting July 15, 2026, GitHub automatically uses immutable subject claims for newly created, renamed, or transferred repositories. Existing repositories retain name-based claims unless they opt in.

Workload ID · Authentication Kerberos guidance separates directory provisioning from passwordless access

Users and groups provisioned to Active Directory with Cloud Sync can access Kerberos-protected resources through Microsoft Entra Kerberos, Windows Hello for Business, or FIDO2. Provisioning alone does not enable Kerberos or passwordless access.

ID Governance · Governance PIM documents 365-day expiration for eligible assignments

The `duration: P365D` value makes an eligible assignment expire after 365 days. Permanent eligibility requires the target scope's role-management policy to allow it.

Global Secure Access connector guidance defines non-overlapping TCP ranges

All 11 entries were Microsoft Learn updates. The substantive changes tighten Global Secure Access connector port guidance, clarify the weakness of device-platform signals in Conditional Access, and revise Exchange role-assignment instructions; several other pages contain Workplace or Meta Workplace reference cleanup.

Global Secure Access · Fundamentals Connectors get explicit dynamic and AutoReuse TCP ranges

Global Secure Access connector guidance specifies non-overlapping dynamic TCP ports 49152–65535 and AutoReuse TCP ports 10000–49151. It adds Windows Server 2016+ prerequisites and configuration and verification commands, and clarifies that AutoReuse applies only to TCP.

Entra ID · Conditional Access Conditional Access guidance warns that device-platform data is unverified

The conditions guidance says device-platform information, including user-agent strings, can be modified and is not verified. It recommends combining device-platform conditions with Microsoft Intune device-compliance policies or using them in a block statement.

Entra ID · Fundamentals Exchange role assignments through dynamic groups move to updated guidance

The groups guidance directs administrators to the Exchange admin center for role assignments through dynamic membership groups. When the old Exchange admin center is required, it says to assign the eligible role directly to the user rather than through role-assignable groups; Exchange PowerShell cmdlets continue to work as expected.

Entra ID · Standards Partner-driven integration examples add Dropbox and Snowflake

The partner-driven integrations page now lists Dropbox and Snowflake as examples and removes its reference to Workplace by Facebook. No configuration change is indicated.

Microsoft Entra daily update for 26 September 2026

No substantive Microsoft Entra documentation changes were detected for this report.

Defender App Governance permissions change for three Entra roles in mid-October

Microsoft’s main operational notice is a mid-October 2026 Defender for Cloud Apps App Governance permission update for three Microsoft Entra roles. The other substantive entries are documentation updates: Global Secure Access now spells out Basic filtering risks and policy coverage, identity guidance records 700- and 1,200-entry manifest limits, and FIDO2 attestation references MDS version 279 plus a new FEITIAN model.

Entra ID · Governance App Governance RBAC permissions change for three Entra roles

Defender for Cloud Apps is updating App Governance permissions to align with Defender XDR Unified RBAC. The change affects the Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles starting in mid-October 2026.

Global Secure Access · Security Basic content filtering warns against blocking HTML or JSON

Global Secure Access guidance now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It warns that blocking HTML or JSON may disrupt normal web and API traffic and updates the stated coverage from HTTP/1.1 to HTTP/S.

Entra ID · Microsoft identity platform Validation guidance lists 700 permission definitions and 1,200 manifest entries

The updated Supported Accounts Validation page lists a default limit of 700 shared permission definitions for app roles and exposed delegated scopes, plus an aggregate manifest limit of 1,200 collection entries.

Global Secure Access · Developer Policy guidance details real-time controls for AI and unmanaged apps

The create-content-policies guidance now describes real-time controls for content shared with generative AI applications, unmanaged cloud apps, and other internet destinations. It adds details on Basic content filtering and Purview-based inspection of files and text.

Entra ID · Authentication FIDO2 attestation data adds the FEITIAN FT-JCOS BioCard

The FIDO2 hardware vendor reference now uses MDS version 279 instead of 275 and adds the FEITIAN FT-JCOS BioCard, including its AAGUID and feature capabilities. Administrators checking attestation support have updated reference data; no action is required.

New apps face COOP enforcement after January 31, 2027

Microsoft Entra guidance sets a January 31, 2027 milestone for COOP policy enforcement on new applications, while Cloud Sync guidance expands coverage of provisioning Microsoft Entra users and groups into AD DS. The period also brings a concrete ChatWork SCIM retirement date and documents an Entra Connect hotfix for a Pass-through Authentication setup issue.

Entra ID · General COOP policy gives new applications a January 31, 2027 compatibility deadline

New applications will be subject to Microsoft Entra COOP policy across web protocols after January 31, 2027. Popup-based sign-in may fail unless applications use a COOP-compatible flow such as MSAL.js v5. Applications that are not ready can temporarily opt out through the Microsoft Graph coopEnforcement property, then re-enable enforcement after migration.

Entra ID · Fundamentals Cloud Sync guidance distinguishes preview user provisioning from generally available group provisioning

A new article documents groups-only, users-only, and users-and-groups provisioning from Microsoft Entra ID to AD DS. User provisioning is marked Preview, while group provisioning is generally available; the guidance also covers per-domain configuration limits and performance considerations.

Entra ID · Fundamentals Cloud-managed users cannot use password writeback for password-based applications

Updated provisioning guidance states that password writeback is not supported for users created in Microsoft Entra ID. Password-based applications, including applications using LDAP binds, must be updated to Kerberos for cloud-managed users to use passwordless authentication.

Entra ID · Provisioning ChatWork SCIM provisioning integration is scheduled for October 1 retirement

The ChatWork provisioning guide warns that SCIM-based provisioning will be discontinued on October 1, 2026, retiring the Microsoft Entra Enterprise App Gallery integration. Existing customers will no longer be able to provision users to ChatWork after that date.

Entra ID · General Entra Connect 2.6.92 fixes a Pass-through Authentication setup failure

The version history identifies 2.6.92.0 as a fix for a 2.6.91.0 issue that could prevent Pass-through Authentication setup through the Microsoft Entra Connect wizard. Administrators on 2.6.79.0 are directed to uninstall it and install 2.6.92.0; those affected by the 2.6.91.0 issue can use the hotfix.

Soprano and Telesign named initial private-preview SMS and voice providers

The most consequential update concerns the transition away from Microsoft-provided SMS and voice authentication: Entra guidance names Soprano and Telesign as initial private-preview providers and says selection and configuration through Microsoft Security Store begins October 30, 2026. Other changes add Workload ID setup detail, clarify a save requirement for SAML certificate notifications, define PIM for Groups protection scope, and correct Rootly provisioning instructions.

Entra ID · Authentication SMS and voice guidance names initial providers and reinforces the passkey transition

The updated Entra authentication guidance identifies Soprano and Telesign as initial private-preview providers and states that provider selection and configuration through Microsoft Security Store begins October 30, 2026. It also frames passkeys as the default while Microsoft-provided SMS and voice authentication retire, directing affected administrators toward a provider or passkeys and another phishing-resistant method.

Workload ID · Security Flexible federated credential preview guidance adds managed identity setup

The setup guidance now covers both applications and user-assigned managed identities, using Microsoft Graph for applications and Azure Resource Manager for managed identities. It also documents credential properties including claimsMatchingExpression.

Entra ID · General SAML certificate notification setup requires confirmation and Save

Administrators who configure notification email addresses through Microsoft Graph or PowerShell are instructed to re-confirm the address under SAML Certificates and select Save in the Microsoft Entra admin center. Without re-saving the SAML settings, certificate expiration notification emails might not be sent.

ID Governance · Fundamentals PIM for Groups guidance explicitly includes owners and inactive eligible assignments

The updated guidance says credential protection for role-assignable groups covers members and owners, including eligible members and owners who have not yet activated their assignments.

Entra ID · Provisioning Rootly provisioning now uses the rootly.com SCIM endpoint

The Rootly provisioning tutorial changes the Tenant URL from https://docs.rootly.com/integrations/scim to https://rootly.com/scim. Administrators configuring Rootly SCIM provisioning should use the new endpoint.

Private Access guidance adds prioritized custom profiles with a 10-profile preview limit

The period centers on new and updated guidance for Microsoft Entra Private Access traffic-forwarding profiles. The material covers profile creation, assignments, priority, prerequisites, and deletion, while a separate Continuous Access Evaluation edit removes a note about SharePoint Online and user risk events. A Netskope provisioning tutorial received a screenshot and alternative-text refresh.

Private Access · General New procedure covers custom profile creation

A new Microsoft Learn procedure explains how to create up to 10 custom Private Access profiles, configure application acquisition rules, assign users and devices, and set profile priority.

Private Access · General Management guidance documents the 10-profile preview ceiling

The updated management article describes default and custom profiles, profile settings, assignments, prerequisites, and a preview limit of 10 custom profiles. It also names the Application Administrator and Conditional Access Administrator roles and applicable licensing.

Global Secure Access · General Assignment guidance defines combined conditions and priority

Updated guidance covers assigning profiles to users, groups, devices, and device platforms. User or device conditions and platform conditions are evaluated together, with the highest-priority applicable profile selected.

Private Access · General Deletion guidance distinguishes default and custom profiles

The new procedure says Global Secure Access Administrators can delete custom Private Access profiles, while default profiles cannot be deleted. Deleted custom profiles cannot be restored and no longer apply to assigned users or devices.

Entra ID · Fundamentals Continuous Access Evaluation guidance removes a SharePoint risk-event note

The article no longer includes the note that SharePoint Online doesn't support user risk events. Administrators reviewing documented Continuous Access Evaluation support should use the updated article.

Entra guidance adopts “Choose Your Own Telephony Provider” and removes rollout advice

Microsoft updated three Entra ID Authentication pages covering SMS and voice authentication providers. The changes standardize provider terminology, rename customer-managed provider guidance, and remove specific pilot and fallback-planning recommendations from the Phone Providers page.

Entra ID · Authentication “Telecommunications providers” becomes “telephony providers”

The provider-selection page now refers to selected providers as “telephony providers” instead of “telecommunications providers.”

Entra ID · Authentication Pilot and continuity recommendations were removed

The Phone Providers page no longer recommends piloting with a limited group or preparing a fallback authentication method and support process for delivery interruptions.

Entra ID · Authentication Customer-managed provider guidance is renamed

The provider-selection page now uses “Choose Your Own Telephony Provider” for customer-managed telephony providers and updates related headings and descriptions. It continues to list September 18, 2026, for provider information availability and October 30, 2026, for configuration availability.

Microsoft sets February 2027 deadline for SMS first-factor sign-in retirement

Microsoft’s major update sets a worldwide February 1, 2027 start date for retiring SMS first-factor sign-in in Microsoft Entra ID workforce tenants. The period also adds preview-oriented ID Governance guidance for access drift and records the coming deprecation path for the AD FS Risky IP report. Most remaining changes refresh Microsoft Entra Connect Health navigation, monitoring, and troubleshooting procedures.

Entra ID · Conditional Access SMS first-factor sign-in retirement begins February 1, 2027

A Microsoft 365 Message Center major update says SMS first-factor sign-in will be retired for Microsoft Entra ID workforce tenants worldwide starting February 1, 2027. Microsoft advises identifying affected users, migrating them to phishing-resistant methods such as passkeys, and updating policies to prevent sign-in disruption.

ID Governance · Governance Entitlement Management guidance adds preview access package drift reporting

The updated guidance describes preview drift reports for groups and enterprise applications, including detection, remediation, export, refresh timing, and limitations. Viewing or downloading the reports requires Microsoft Entra ID Governance or Microsoft Entra Suite licensing and an appropriate directory role.

Entra ID · Monitoring The AD FS Risky IP report is moving toward deprecation

The Risky IP report guidance now notes that the AD FS report is being deprecated and points administrators to the Risky IP report workbook. It also documents Download Manager as the export path and limits export requests to one per hour.

Entra ID · Troubleshooting Connect Health guidance details guided remediation for duplicate attributes

The updated sync-error procedure directs administrators to find affected objects, open Error Details, select Troubleshoot, review proposed resolutions, and apply supported fixes. Cases outside the supported workflow still require manual resolution.

ID Governance · Fundamentals A new ID Governance overview frames reconciliation and access drift

The new overview defines access drift, account discovery, access package drift detection, and enforcement and remediation approaches for unmanaged, missing, or orphaned access, including tenant-wide analysis through drift reports.

Global Secure Access guidance details preview device signals and composable web filtering

The period’s substantive updates clarify two Global Secure Access capabilities. Universal Continuous Evaluation guidance now covers preview signals for deleted, disabled, or noncompliant devices, while Web Filtering (v2) guidance describes a preview Continue Evaluation action that passes unmatched traffic between profiles. Additional edits establish the Web Filtering (v2) prerequisite for custom HTTP headers, remove “preview” labels from two filtering conditions, and standardize SSPR terminology.

Global Secure Access · Fundamentals CAE guidance adds preview device signals and a two-minute tunnel cutoff

The Universal Continuous Evaluation guidance now covers preview signals for deleted, disabled, and noncompliant devices. Reauthentication uses a GSA client notification, and the tunnel disconnects after two minutes if reauthentication is incomplete. Device Compliance and User Risk signals should be paired with their corresponding Conditional Access policies.

Internet Access · Fundamentals Web Filtering (v2) documents Continue Evaluation across security profiles

The guidance now describes a preview Continue Evaluation default action: unmatched traffic passes to the next applicable security profile, while matching rules and Allow or Block stop evaluation. The Baseline Profile must use Allow or Block.

Global Secure Access · General Custom HTTP headers require Web Filtering (v2) policies

The custom HTTP headers guidance now states that the capability is available only with Web Filtering (v2) policies and links to the related guidance. Administrators configuring headers must account for that policy prerequisite.

Internet Access · Conditional Access Filtering guidance drops “preview” labels from two request conditions

The web content filtering guidance removes “preview” from the source traffic type and HTTP method request filtering conditions, and updates their headings and links. Administrators with internal references to the former labels should update them.

Entra ID · Authentication SSPR policy guidance adopts Microsoft Entra administrator terminology

The SSPR policy page now uses “Microsoft Entra administrators” instead of “Azure administrators.” No administrator action is required.

Microsoft-provided SMS and voice authentication face phased 2027 retirement deadlines

The strongest Entra guidance this period sets a February 1, 2027 retirement for Microsoft-provided SMS and voice authentication for users including internal guests, with Global Administrators and external users on July 1, 2027. Users relying only on those methods will receive a blocking passkey-registration prompt after their applicable deadline. Microsoft also added practical Cloud Sync migration and Connect Sync passwordless sign-in procedures, while most remaining activity involved Connect release-history, navigation, and command-path cleanup.

Entra ID · Authentication Phased retirement guidance gives SMS and voice two deadlines

The authentication guidance states that Microsoft-provided SMS and voice retire February 1, 2027, for users including internal guests. Global Administrators and external users follow July 1, 2027; after the applicable date, users whose only MFA method is SMS or voice receive a blocking passkey-registration prompt. Administrators should move them to phishing-resistant methods or configure a customer-managed telecom provider where needed.

Entra ID · General Connect version guidance now identifies 2.6.91.0 as latest

The version history replaces references to 2.6.90.0 with 2.6.91.0 and identifies 2.6.91.0 as the latest available version. Upgrades involving an existing ADSync database should use 2.6.91.0 or later, while installations of recalled version 2.6.79.0 should be uninstalled and replaced with 2.6.91.0.

Entra ID · Provisioning Cloud Sync migration guidance documents staged assessment and validation

A new article covers using the guided migration tool to assess an environment, create Cloud Sync configurations, run a preactivation check, and validate synchronization after migration. It also identifies required roles, credentials, eligibility limits, supported scenarios, and a two-week validation process.

Entra ID · Authentication Connect Sync gets a documented FIDO2 and passkey sign-in path

A new how-to explains how to enable FIDO2 and passkey methods, register credentials, configure a registry setting, and sign into Microsoft Entra Connect Sync without a password. The procedure gives administrators a documented passwordless setup path for synchronization installations and configuration.

Entra ID · Authentication Windows SSPR guidance moves from OMA-URI to Settings Catalog

The revised procedure replaces the custom OMA-URI profile process with an Intune Settings Catalog policy. Administrators now select Authentication > Allow Aad Password Reset and set the value to Allow.

Passkeys are now Entra’s default as Microsoft-provided SMS and voice retire

The period’s main operational change is an authentication transition: passkeys became the default Microsoft Entra authentication on September 1, 2026, while Microsoft-provided SMS and voice authentication will retire on February 1, 2027. Other updates are targeted guidance for External ID browser authentication, registration campaigns, and HR provisioning null-value handling.

Entra ID · Conditional Access Microsoft-provided SMS and voice authentication face a February 2027 retirement

Passkeys became the default Microsoft Entra authentication on September 1, 2026. Microsoft-provided SMS and voice authentication will retire on February 1, 2027, after which customers must use telecom providers from the Microsoft Security Store. Microsoft recommends transitioning to passkeys for phishing-resistant security.

External ID · Authentication External ID guidance documents system-browser handoff for brokered identity providers

The new guidance describes handing external-IdP authentication from an embedded WebView to the system browser, enabling external-IdP passkeys, browser SSO, and identity providers that block WebViews. It lists the required platform, broker, application-version, federation-protocol, and cloud-support considerations.

Entra ID · Authentication Registration Campaign guidance separates managed and enabled campaign requirements

The updated guidance distinguishes Microsoft-managed from enabled campaigns, specifies the MFA method required for each targeted authentication method, and broadens eligible users from those signing in with SMS or voice to users signing in with any MFA method.

Entra ID · Provisioning HR provisioning preview adds clearing for emptied Workday and SAP values

Preview guidance covers clearing mapped target attributes when Workday or SAP SuccessFactors inbound provisioning returns null or empty values, with configuration, schema, testing, and troubleshooting material for the behavior.

Entra ID · Troubleshooting HR provisioning guidance makes the dual Flow null values requirement explicit

Target attributes are cleared only when Flow null values is enabled for both the source attribute and the target mapping. The updated guidance also documents choices to clear, preserve, or replace empty values.

Enterprise State Roaming shifts to Windows policies as Entra passkeys expand

The period’s strongest administrator change is the move of Enterprise State Roaming management out of the Entra admin center, alongside two scheduled passkey rollouts beginning in October 2026. Microsoft also tightened self-service App Gallery onboarding guidance for v1 endpoint applications and expanded Account Discovery guidance to groups, with preview and matching-attribute limitations. Most remaining edits refine licensing, troubleshooting, and operational requirements, including Private Access alert eligibility.

Entra ID · General Enterprise State Roaming management moves to Windows policies

As of July 2026, Enterprise State Roaming can no longer be managed in the Microsoft Entra admin center. Administrators must use Windows settings backup and restore policies; supported settings remain unchanged, and existing controls are honored for one year.

Entra ID · Conditional Access B2B users gain resource-tenant passkey registration and sign-in

The announced rollout starts in October 2026 and will let B2B users register and sign in with resource-tenant passkeys for phishing-resistant MFA. Eligible users will be enabled automatically.

Entra ID · Conditional Access Passkeys can become a user’s first multifactor method

A phased rollout from October 2026 through February 2027 will allow users to register passkeys or passwordless sign-in as their first MFA method, removing the need to set up weaker methods first.

Entra ID · General Self-service App Gallery validation excludes v1 endpoint applications

Applications using Microsoft identity platform v1 endpoints cannot be validated through self-service App Gallery onboarding. The guidance recommends migrating those applications to v2 endpoints before validation.

Entra ID · Governance Account Discovery guidance adds group coverage with preview limits

The updated guidance covers users and groups, classifying identities as local, unassigned, or assigned. Group discovery is in preview, and correlation requires a direct matching attribute.

ID Protection guidance separates export categories from six KQL table names

A focused ID Protection troubleshooting update clarifies that diagnostic setting categories and KQL table names serve different purposes. It maps six ID Protection signals to their corresponding AAD-prefixed Log Analytics tables.

ID Protection · Troubleshooting Export guidance now distinguishes categories from destination tables

The updated page maps six ID Protection signals to AAD-prefixed Log Analytics tables, while directing administrators to use diagnostic setting categories to enable export and the mapped table names for KQL queries.

Purview DLP targets network-level file filtering for Entra Internet Access

Purview DLP is being integrated with Entra Global Secure Access Internet Access to filter sensitive files at the network layer and prevent leaks to unmanaged cloud apps; the announcement lists public preview from mid-November 2025 and general availability by October 2026. Entra is also retiring legacy app-launcher and My Staff feature settings, while External ID consolidates identity-provider setup into a central user-flow procedure. Most remaining changes are documentation consolidation, Copilot naming cleanup, and more explicit integration guidance.

Internet Access · Conditional Access Purview DLP pairs with Entra Internet Access for network-layer file filtering

The Message Center announcement describes filtering sensitive files at the network layer to prevent data leaks to unmanaged cloud apps. It lists public preview from mid-November 2025 and general availability by October 2026; deployment requires policies, TLS inspection, and Purview pay-as-you-go activation.

Entra ID · Developer Legacy app-launcher settings no longer affect user behavior

The documentation now states that legacy preview and experience settings no longer affect app launchers or user behavior and are being removed from the Microsoft Entra admin center. Administrators should use application assignments and My Apps collections to control visibility.

Entra ID · General My Staff access now follows roles and administrative-unit scope

My Staff access is now determined by administrative role assignments and their administrative-unit scope. The legacy controls under Manage user feature settings no longer affect behavior and are being removed.

External ID · Authentication External ID centralizes identity-provider setup in one user-flow procedure

A new central article documents how to add configured OIDC, SAML/WS-Fed, or social identity providers to an External ID user flow, including prerequisites, permissions, portal steps, and testing.

Workload ID · Authentication SAP SuccessFactors workload identity guidance adds explicit prerequisites

The integration guide now spells out required Microsoft Entra and SAP permissions, SAP IAS OIDC and JWT Trust-by-Issuer configuration, and the token flow and revocation process. Administrators should review these requirements before configuring the integration.

Passkey guidance now points applications to Microsoft Graph FIDO2 provisioning APIs

External ID’s passkey-management guidance now directs applications away from the preview credential management API and toward Microsoft Graph FIDO2 provisioning APIs, while identifying low-privilege passkey APIs as roadmap work. A related credential-management API reference was removed, and the device code flow exclusion procedure now uses a more specific resource-selection path.

External ID · Authentication External ID passkey guidance replaces preview API direction

The Sign In With Passkey page no longer directs applications to the preview credential management API. It now recommends Microsoft Graph FIDO2 provisioning APIs and says low-privilege passkey credential-management APIs are on the roadmap. No immediate administrator action is stated.

Entra ID · Security Credential management API reference is removed

The Microsoft Entra External ID credential management API reference was deleted; it had covered listing, registering, and deleting passkeys for signed-in customers. Use the redirected Microsoft Graph documentation and update internal links or bookmarks that point to the old page.

Entra ID · Monitoring Device code flow exclusions now use specific resource selection

The policy procedure now directs administrators through Exclude > Select resources > Select specific resources before adding Device Registration Service. Follow this path when configuring the exclusion, which the guide says is required to prevent device registration through device code flow from being blocked.

Entra optimizes passkey campaigns with automatic prompts for eligible users

Microsoft Entra is enhancing passkey registration campaigns to improve the user experience and increase adoption of phishing-resistant authentication. The early-September 2026 rollout will automatically prompt eligible users based on qualifying passkey profiles.

Entra ID · Authentication Eligible users will receive automatic passkey prompts

The optimized campaign experience automatically prompts eligible users according to qualifying passkey profiles as the rollout begins in early September 2026.

Verified ID setup limits and DUSI tracing sharpen Microsoft Entra administration

The period’s substantive updates center on a newly published Microsoft Entra Verified ID setup article, clearer trust behavior for B2B direct connect, and DUSI-based correlation of sign-ins with administrative activity. The remaining change is a low-impact Workload ID example correction that changes “GitHub Actions” to take the singular verb “needs”; no administrator action is stated.

External ID · Security Verified ID setup guidance documents prerequisites and operating limits

The new External ID article covers Quick setup, application registration, credential creation, and credential issuance and verification. It also documents required roles, custom-domain requirements, shared signing keys, a limit of two requests per second per tenant, and six-month credential validity.

External ID · General B2B direct connect guidance explains external device-claim trust

The updated guidance explains how Microsoft Entra ID accepts compliant-device claims from an external user’s home tenant, how Conditional Access evaluates those claims, the trust implications, and the behavior when the setting is disabled.

Entra ID · Authentication DUSI guidance connects sign-ins with administrative activity

Supported audit events can include DUSI, with the guidance mapping linkable identifiers to audit-log attributes and providing steps to correlate sign-ins with administrative activity. Some events may not include DUSI.

When Cloud Sync and Connect Sync share a domain, SSPR guidance names Cloud Sync

Updated Entra ID SSPR writeback guidance states that Cloud Sync processes password writeback for users synchronized from a domain when Cloud Sync and Connect Sync are both configured for it.

Entra ID · Authentication Same-domain password writeback is attributed to Cloud Sync

The SSPR writeback guidance now specifies that Cloud Sync processes password writeback for users synchronized from a domain where both Cloud Sync and Connect Sync are configured.

Passkey campaign states and granular SCIM permissions sharpen Entra guidance

September 5 was documentation-led: all nine supplied entries were updates, with no new or removed items and no Message Center notices. The substantive guidance covers passkey and Authenticator registration campaigns, SCIM query and permission design, and a Workload ID namespace distinction. The remaining edits are mostly link, schema, and reference maintenance.

Entra ID · Authentication Registration campaign guidance now defines three campaign states

The Entra ID guidance describes Microsoft managed, Enabled, and Disabled states, along with method-specific eligibility and prompting conditions. It also lists prerequisites for Authenticator and passkey campaigns and says the updated experience is rolling out through the end of September 2026, so tenant behavior may vary during rollout.

Entra ID · Standards SCIM reference documents 999-user pages and additional filters

The reference documents up to 999 users per page when the projection excludes the manager attribute. It also covers filters for active users, negated suffix matches, group membership, and group ownership.

Entra ID · Standards SCIM permissions guidance maps least privilege to operations

The reference adds operation-specific permissions for basic user reads, user creation and updates, group creation and membership changes, and selected user attributes. Provisioning applications can align consent more closely with the operations their workflows perform.

Entra ID · Standards SCIM schema guidance limits ownership attributes to filtering

User:ownedGroups and Group:owners are documented as read-only, multi-valued attributes. Their IDs can be used in filter queries but are never returned in response bodies; the page also corrects the groups members.value response-body description.

Workload ID · General Managed-identity restriction guidance separates API and portal namespaces

Workload ID guidance says Azure CLI commands and infrastructure-as-code templates must use Microsoft.Storage. Microsoft.Storage/* is only the Azure portal display convention and is not accepted by the API.

Entra adds SOC Identity Responder as passkey registration optimization rolls out

The period brings a meaningful Entra role addition and a live passkey-registration rollout, plus new HiBob-to-Active Directory hybrid provisioning guidance. Remaining updates sharpen permissions and recovery boundaries: Security Administrator references diverge on identity containment, while Agent ID sponsors cannot restore resources they disable or delete.

Entra ID · General Entra SOC Identity Responder gets explicit containment permissions

The permissions reference documents the Entra SOC Identity Responder role for SOC incident response, including disabling users, revoking active sign-in sessions, and resetting passwords.

Entra ID · Authentication Passkey registration optimization runs through mid-September

Microsoft Entra will better follow administrator policies, prioritize local-device passkeys, and improve successful registration without UI changes. The rollout began in late August 2026 and is scheduled to complete by mid-September; no action is required.

Entra ID · Provisioning New HiBob guidance connects Entra provisioning to on-premises AD

New guidance covers HiBob provisioning and updating users in on-premises Active Directory through Entra API-driven provisioning and the provisioning agent, including prerequisites, permissions, connection setup, and synchronization flow.

Entra ID · Authentication Security Administrator containment guidance now needs reconciliation

One updated permissions reference describes Security Administrators as reading security information and reports and managing Entra ID and Office 365 configuration while removing identity-containment language; another same-day update says the role can perform containment actions. A separate role table limits the role to non-administrative accounts and excludes action on privileged accounts.

Agent ID · Governance Agent ID sponsors cannot restore identities they disable

Sponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities. Owners or administrators must handle recovery.

MCP server protection and a 98% managed-identity quota threshold anchor Entra guidance

The strongest changes are new implementation guidance for securing Model Context Protocol servers with Microsoft Entra ID and integrating Entitlement Management with ServiceNow. The period also adds a specific managed-identity creation limit at 98% of tenant directory quota, improves PIM audit correlation guidance, and clarifies the Partner One ID requirement for App Gallery publishers. The passkey page now omits “(preview)” from its title and heading, with the supplied evidence indicating a label change.

Entra ID · Standards New MCP server protection procedure uses Entra OAuth and Agent ID

A new Entra ID how-to explains registering an MCP server as an OAuth 2.0 protected resource, enabling v2 access tokens, and connecting MCP clients through Microsoft Entra Agent ID. An app registration with required permissions and an HTTPS MCP server are prerequisites.

Entra ID · Governance Entitlement Management documents ServiceNow access-package workflows

New guidance covers ServiceNow access package requests, request history, and approvals, along with installation, configuration, licensing, and user workflows. Microsoft Entra ID Entitlement Management remains the system of record, and a Microsoft Entra ID P2 or Microsoft Entra Suite license is required.

Workload ID · General Managed identity creation is blocked at 98% directory quota usage

The updated guidance states that creating a managed identity is blocked when directory usage reaches or exceeds 98% of the tenant quota, including for new or recreated service principals. Existing identities and assignments continue to work; soft-deleted objects count toward the quota, and reducing usage or increasing the quota enables retries.

ID Governance · Governance PIM audit tracing now pivots on roleAssignmentRequestId

Related PIM activation and deactivation events can have different CorrelationId values. The updated audit-log guidance recommends roleAssignmentRequestId for tracing a complete request and adds Log Analytics query examples.

Entra ID · Developer App Gallery publishing guidance now requires the Partner One ID

The publishing prerequisites now instruct app publishers to provide a Partner One ID associated with the Microsoft AI Cloud Partner Program organization listed as the publisher, and explain where to get help if the identifier is unknown.

Microsoft-managed system-preferred authentication rollout extends through September 2026

The documented timeline for Microsoft-managed system-preferred authentication deployment now runs through September 2026, rather than August. Microsoft also added a troubleshooting article for intermittent STATUS_ACCOUNT_DISABLED errors on hybrid joined Windows devices and refreshed links in the Sample V2 Code guidance.

Entra ID · Authentication System-preferred authentication deployment continues through September 2026

The Microsoft Entra ID documentation now says Microsoft-managed system-preferred authentication deployment will continue through September 2026, revising the previous August 2026 timeline.

Entra ID · Authentication New guidance diagnoses STATUS_ACCOUNT_DISABLED on hybrid joined Windows devices

A new Microsoft Entra troubleshooting article covers intermittent STATUS_ACCOUNT_DISABLED sign-in and unlock errors, including relevant event logs and stale-cache or connectivity conditions that can cause them.

Entra ID · Microsoft identity platform Sample V2 Code updates Node.js Express and web app references

The Sample V2 Code documentation refreshed the Node.js Express and web application entries, including their linked sample resources. Administrators using these examples should follow the updated references; no configuration change is required.

Viva Engage will require Entra permissions as Global Secure Access adds TLS certificate guidance

Microsoft’s clearest administrator-impacting change is a late-September Viva Engage authorization update: community and membership management will require the Microsoft Entra Yammer Administrator role or a Community Admin assignment, replacing access previously available to Verified or Network Admins. Global Secure Access guidance now covers both certificate paths for TLS inspection, including a preview Microsoft-managed root CA workflow and a clarified customer-provided CA procedure. An iOS Authenticator passkey-restore improvement is scheduled worldwide for mid-September with no policy changes or required administrator action. Remaining entries are mainly documentation maintenance involving links, screenshots, URLs, download IDs, spacing, and troubleshooting text.

Entra ID · Security Viva Engage is changing community and membership administration permissions

Starting late September 2026, community and membership management tasks will require the Microsoft Entra Yammer Administrator role or a Community Admin assignment. The requirement applies to tasks previously available to Verified or Network Admins.

Global Secure Access · Security Global Secure Access documents Microsoft-managed root CA setup in preview

A new preview guide describes creating a tenant-specific Microsoft-managed root CA, deploying its public certificate to client devices, and then enabling it for Microsoft Entra Internet Access TLS inspection. Microsoft protects the private key.

Global Secure Access · Security Customer-provided TLS certificate workflow is now explicitly documented

The updated Global Secure Access guide focuses on bringing your own certificate authority, including CSR creation, PKI signing, and certificate upload, and links to separate Microsoft-managed certificate guidance.

Entra ID · Authentication Authenticator adds a guided iOS passkey restore flow

Microsoft says the iOS Microsoft Authenticator app will receive a clearer, guided device-migration flow for passkey restoration worldwide in mid-September 2026. The change affects users with iCloud backup and includes updated user guidance without policy changes.

Cloud Sync group provisioning guidance shifts to focused AD DS workflows and constraints

The period is dominated by a substantial restructuring of Microsoft Entra Cloud Sync guidance for provisioning groups to Active Directory. Microsoft added a dedicated AD DS tutorial, rewrote setup and testing material, documented tighter topology requirements, and removed seven older pages covering combined provisioning, prerequisites, deployment options, and test-and-enable procedures. Separately, Global Secure Access guidance now describes preview custom HTTP headers through Web Content Filtering v2 rules.

Entra ID · Provisioning Cloud Sync adds a dedicated group-provisioning tutorial for AD DS

The new tutorial covers provisioning groups to on-premises Active Directory Domain Services in both Entra-to-AD and AD-to-Entra scenarios, including how source of authority and membership affect provisioning. It recommends Selected security groups as the default scoping filter to help prevent performance issues.

Entra ID · Provisioning Cloud Sync topology guidance specifies group membership and identifier requirements

The guidance now states that cloud-synced groups can contain only on-premises synchronized users and additional cloud-created security groups, and that all users must have `onPremisesObjectIdentifier`.

Entra ID · Provisioning On-demand provisioning tests now select groups and up to five members

The revised procedure instructs administrators to select a group and up to five members for testing. User-specific instructions and result-review details were removed, and references were updated for provisioning from Microsoft Entra ID to Active Directory.

Entra ID · Provisioning Cloud Sync test-and-enable reference guidance has been removed

The former how-to page for testing and enabling Entra-to-Active Directory provisioning was deleted. It had covered on-demand tests, default properties, enabling configurations, quarantines, restarting synchronization, and removing configurations.

Global Secure Access · General Global Secure Access guidance documents preview custom HTTP headers

New guidance describes adding custom HTTP headers to matching outbound web requests through Web Content Filtering v2 rules, including tenant restrictions and other header-aware services. TLS inspection and the documented Global Secure Access prerequisites are required.

App Gallery SCIM publishing guidance adds a 25-test Logic Apps validation workflow

Microsoft published new preview guidance for validating SCIM user and group provisioning before Microsoft Entra App Gallery review. The workflow uses an Azure Logic Apps template, runs 25 tests, and requires submission of the results with a Logic App run ID. Related guidance now distinguishes ordinary SCIM endpoint testing from the validation evidence required for App Gallery publishing. Global Secure Access guidance separately flags version 1.5.612.0 or earlier as unsupported and recommends immediate updating. Most remaining changes were metadata, navigation, and cross-linking edits.

Entra ID · Standards Preview guidance defines the App Gallery validation workflow

The new guide explains how to validate SCIM user and group provisioning with an Azure Logic Apps template, run 25 tests, and submit the results with a Logic App run ID for App Gallery review. It documents both AI-agent and Azure portal setup methods.

Entra ID · Standards SCIM Validator guidance separates endpoint tests from gallery evidence

The updated tutorial says the Microsoft Entra SCIM Validator is for endpoint testing, while App Gallery publishing requires running the Azure Logic Apps validation template and submitting its results.

Entra ID · Standards Portal instructions add the provisioning test-app setup sequence

The new setup guide covers creating an Entra Gallery Provisioning Test App, deploying the Azure Logic Apps validation template, configuring permissions and parameters, and running SCIM provisioning tests. It also points supporting teams to a verified tenant domain and Azure PowerShell or CLI workflow.

Entra ID · Standards Troubleshooting guidance covers failed Logic Apps validation runs

A companion preview article explains how to inspect failed validation runs and address common SCIM endpoint, authentication, permissions, filtering, and conflict errors before submission.

Global Secure Access · General Global Secure Access flags older client versions for immediate updates

The version-history guidance now uses an “Unsupported versions” section and recommends immediately updating Global Secure Access version 1.5.612.0 or earlier to a newer version.

Cloud-to-AD provisioning guidance separates generally available groups from preview users

Microsoft Entra’s Cloud Sync material now forms an end-to-end guide for provisioning users, groups, and memberships from Entra ID to on-premises AD DS. The new overview labels group provisioning generally available and user provisioning preview; companion guidance covers groups-only, users-only, and users-and-groups scoping, limits, filters, mappings, performance, prerequisites, and on-demand testing. A separate preview procedure preserves a group’s original distinguished name with a GroupDN directory extension when its source of authority changes to Microsoft Entra ID. Elsewhere, Global Secure Access marks four versions deprecated and tells users of version 1.5.612.0 or earlier to update immediately. Cloud Sync guidance also removes the obsolete Repair-AADCloudSyncToolsAccount procedure, while Conditional Access guidance states that Android Authenticator uses Google Play Integrity for jailbreak detection and denies requests when the API is unavailable unless the policy is disabled. Most remaining changes are routine example-ID, link, and reference maintenance.

Entra ID · Fundamentals Cloud Sync overview sets group GA and user preview boundaries

The new overview covers provisioning users, groups, and memberships from Microsoft Entra ID to on-premises AD, including supported scenarios, configuration options, synchronization behavior, and limitations. It explicitly states that group provisioning is generally available while user provisioning is in preview.

Entra ID · Fundamentals Three provisioning scopes are documented with filters and limits

The preview guidance compares groups-only, users-only, and users-and-groups provisioning through scoping filters. It also records availability, domain and tenant configuration limits, and performance guidance to help administrators choose an appropriate scope and avoid unnecessary processing.

Entra ID · Provisioning On-demand testing can validate objects before broad synchronization

The new testing guide covers testing users or groups on demand, reviewing safeguards and notifications, enabling configurations, handling quarantines, restarting synchronization, and removing configurations. A group test can include up to five members.

Entra ID · General GroupDN setup preserves distinguished names across source-of-authority changes

The preview how-to explains how to create and populate a GroupDN directory extension so a group’s original distinguished name is retained when its source of authority changes to Microsoft Entra ID. The one-time setup includes Universal scope, extension creation, and attribute mapping.

Global Secure Access · General Global Secure Access version history marks four versions deprecated

Versions 1.5.612.0, 1.5.402.0, 1.5.132.0, and 1.5.36.0 are marked deprecated. Users of version 1.5.612.0 or earlier are instructed to update immediately.

LES Writeback, Android Play Integrity, and SCIM mailNickname rules sharpen Entra guidance

The period was dominated by ordinary documentation maintenance—sample GUIDs, example identifiers, a corrected link, and PowerShell example syntax. The substantive updates were clearer Conditional Access guidance for Android integrity checks, new Exchange Hybrid detail on LES Writeback, and a precise SCIM description of how Entra ID handles mailNickname during user creation.

Entra ID · Authentication Conditional Access guidance documents Android Play Integrity enforcement

The Assignment Network guidance now says Microsoft Authenticator for Android uses the Google Play Integrity API for jailbreak detection and denies access when the API is unavailable, unless the policy is disabled. Use this detail when troubleshooting blocked Android access under Conditional Access.

Entra ID · General Exchange Hybrid guidance adds Entra2ADExchangeOnlineAttributeWriteback detail

The article now documents Entra2ADExchangeOnlineAttributeWriteback, also called LES Writeback, including its cloud-managed attribute flow, distinction from Exchange hybrid writeback, supported attributes, mappings, and related guidance.

Entra ID · Standards SCIM reference clarifies mailNickname creation and PATCH limits

When creating a user, mailNickname may be omitted, null, or empty. Entra ID derives it from the characters before the first @ in userName, and after creation it cannot be removed with PATCH.

Entra ID · Developer Consent policy examples replace documented application IDs

The Manage App Consent Policies guidance replaces the application IDs shown for Apple Mail, Spark Email, eM Client, Android-Samsung, Android-Mail, and Thunderbird. Administrators using those identifiers in consent-policy rules should verify them against the updated examples.

Entra self-service identity management shifts to cloud.microsoft worldwide in late November

Microsoft Entra will move its self-service identity management domain from myaccount.microsoft.com to myaccount.cloud.microsoft worldwide in late November 2026. Global Secure Access release notes also set out automatic Windows Update upgrades for eligible clients beginning in November, while new App Gallery guidance and revised administration documentation clarify publishing, group creation, and tenant-creation requirements.

Entra ID · General Self-service identity sites move to cloud.microsoft in late November

Microsoft Entra is updating the self-service identity management domain from myaccount.microsoft.com to myaccount.cloud.microsoft and consolidating related sites. The worldwide rollout is planned for late November 2026; users need no action, but administrators should allow *.cloud.microsoft in network policies.

Global Secure Access · General Eligible Global Secure Access Windows clients will receive automatic upgrades

Starting in November 2026, eligible Windows clients will receive Global Secure Access upgrades through Windows Update. Version 2.32.294 adds Prefer local network, faster tunnel creation, and other fixes and improvements. Administrators opting out must use the documented installer parameter and maintain updates manually.

Entra ID · General New App Gallery workflow details validation, submission, and review

A new tutorial documents the self-service publishing workflow: complete validation prerequisites, create a submission, select capabilities, provide required application details, submit for Microsoft review, and track drafts. The guidance is primarily relevant to administrators supporting application publishers.

ID Governance · Governance Tenant Creator is required regardless of the tenant restriction setting

The Create Tenant guidance now states that the Tenant Creator role is required regardless of the “Restrict non-admin users from creating tenants” setting. Accounts expected to create add-on tenants therefore need that role.

Entra ID · Standards SSGM guidance scopes its control to the My Groups portal

The Groups Settings V2 guidance now states that standard users can create groups by default regardless of SSGM, and that SSGM controls behavior only in the My Groups portal. The MSODS reference was removed from the documentation.

Linux broker 2.0.2 now uses Entra join for device trust

The most consequential update affects Microsoft Single Sign-On for Linux: version 2.0.2 and later uses Microsoft Entra join instead of device registration for device trust, and existing upgraded devices must be re-joined and re-enrolled. New Entra ID guidance also details enhanced synchronization for sourcing sAMAccountName. Most remaining updates are mechanical example-ID, browser-reference, or wording changes.

Entra ID · General Linux broker 2.0.2 switches device trust from registration to join

Microsoft Single Sign-On for Linux version 2.0.2 and later uses Microsoft Entra join for device trust. Existing upgraded devices must be re-joined and re-enrolled, with the documented upgrade process covering broker-state removal, reinstallation, and device re-join.

Entra ID · Security Enhanced synchronization can source sAMAccountName for hybrid users

New guidance documents sourcing hybrid users’ sAMAccountName from onPremisesSamAccountName. Existing domains retain current behavior until the setting is enabled; enabling it updates existing hybrid users during synchronization. Cloud-only users without the source value continue using mailNickname-based generation.

Entra ID · Authentication Arc sign-in guidance limits the scenario to machines without another domain

The revised guidance states that enabling sign-in joins an Arc-enabled machine to Microsoft Entra and is intended for machines not planned to join another domain, including on-premises Active Directory or Microsoft Entra Domain Services. Administrators should confirm domain-join plans before enabling the capability.

First-factor system-preferred authentication rolls out as Lifecycle Workflow guidance expands to 365 days

Microsoft Entra is applying system-preferred authentication to first-factor sign-ins for tenants in the Microsoft-managed state, with rollout continuing through late September 2026. ID Governance guidance now documents 365-day event offsets and clarifies the Time based attribute V2 trigger, while Global Secure Access records an August macOS client release with new controls and deployment considerations. Most remaining updates are documentation maintenance, including Connect Health version and download references and lifecycle-page reorganization.

Entra ID · Authentication System-preferred authentication now covers first-factor sign-ins

For tenants in the Microsoft-managed state, Microsoft Entra now selects the most secure registered authentication method for first-factor sign-ins. Rollout runs from late June through late September 2026; administrators can keep or change the setting and should update user guidance.

ID Governance · Governance Lifecycle Workflow guidance documents 365-day event offsets

The updated Execution Conditions page now states that the limits for Days from event, and Days to event when using Between, increased from 180 to 365 days. It describes conditions up to one year before or after an event and states that no administrator action is required.

ID Governance · Fundamentals Time based attribute V2 guidance clarifies comparisons and catch-up behavior

The documentation describes Exactly, Less than or equal to, and Between comparisons with offsets from 0 to 180 days before or after supported date attributes. It also says both the workflow and schedule must be enabled, V2 has no three-day catch-up window, and the preview admin center may show two choices representing the same trigger.

Global Secure Access · General Global Secure Access macOS release adds controls and Secure DNS bypass

Release notes for August 21, 2026 list Home Network traffic controls, a Connections page, agentic detection support, and Secure DNS bypass, along with connectivity, sign-in, tunnel, cache-reset, and crash fixes. Administrators should review the release when planning macOS deployments.

Global Secure Access · General macOS installation guidance flags an Intune detection conflict

The installation page states that client version 1.1.26060207 includes com.microsoft.autoupdate2 and that an existing installation may conflict with Intune detection rules. It advises optionally removing that app from the Included apps list.

External ID guidance details delegated API for customer-owned passkeys

A new External ID reference describes delegated credential management for signed-in customers’ passkeys, while ID Governance guidance now spells out the billing, role, and policy prerequisites for governed workforce tenant creation. Global Secure Access also records macOS client version 1.1.26060207, including Home Network traffic control, a Connections page, agentic detection support, Secure DNS bypass, and fixes. Most remaining changes refine terminology, links, and procedures; one Rouse Sales provisioning tutorial was removed.

External ID · Authentication Delegated passkey management API is now documented for External ID customer apps

Applications can use delegated access tokens to list, register, and delete signed-in customers’ passkeys. The service principal must be provisioned manually, and app-only tokens aren't supported.

ID Governance · Governance Governed workforce tenant guidance now specifies paid billing and role prerequisites

The guidance specifies a paid Azure subscription associated with an Enterprise Agreement or pay-as-you-go billing account, along with the required tenant-creation permission, role, and default governance-policy prerequisites. Free or trial tenants cannot create additional tenants.

ID Governance · Governance Governing-tenant default policy template is now optional in creation guidance

The governing tenant’s default governance policy template is labeled optional rather than required. The tenant-creation service still uses only the template with ID `default`.

Global Secure Access · General Global Secure Access macOS notes add version 1.1.26060207 deployment details

The release notes document version 1.1.26060207, released August 21, 2026, with Home Network traffic control, a Connections page, agentic detection support, Secure DNS bypass, and several fixes. The Intune deployment guidance says to remove `com.microsoft.autoupdate2` from detection rules.

Custom CSS branding faces late-October retirement after July 21 new-use cutoff

Microsoft Entra’s most consequential change is the planned retirement of custom CSS layout and positioning properties in company branding by late October 2026. The schedule blocks new use from July 21, 2026, and affected branding will revert to default layouts after retirement. Other updates primarily refresh FIDO2 hardware references and clarify authentication terminology.

Entra ID · Authentication Custom CSS company-branding properties will retire in late October

Microsoft Entra will retire custom CSS layout and positioning properties in company branding by late October 2026 to enhance security and reduce phishing risks. New use is blocked from July 21, 2026, and branding will revert to default layouts after retirement.

Entra ID · Authentication FIDO attestation data now reflects Metadata Service version 275

The FIDO2 hardware reference now reflects FIDO Metadata Service version 275, with updated model entries, AAGUIDs, capability indicators, and newly listed authenticators. Use the refreshed table to verify hardware eligibility and supported capabilities.

Entra ID · Authentication Compatibility indicators change for several FIDO2 vendor entries

Compatibility indicators were updated for several Arculus, Feitian, Hyper FIDO, and IDmelon authenticators, while multiple vendor entries were removed. Use the revised compatibility table when evaluating or deploying FIDO2 authenticators.

Entra ID · Standards SAML guidance now labels synced passkeys as phishing-resistant MFA

The SAML protocol reference now labels synced passkeys as phishing-resistant MFA and clarifies that the certificate-based authentication designation applies to multi-factor CBA. The associated SAML mappings are unchanged.

Entra ID · General Optional claims reference explicitly identifies PRMFA authentication entries

The Optional Claims Reference now labels synced passkeys as PRMFA and specifies that the PRMFA certificate-based authentication entry applies to multi-factor CBA. The clearer labels help distinguish authentication methods when interpreting optional claims.

Custom CSS branding guidance spells out July 21 cutoff and property retirement

Most of the day's entries were documentation maintenance, but several updates have direct planning or configuration implications. Entra ID branding guidance says tenants created after January 5, 2026, cannot use custom CSS, older tenants not already using it cannot configure it after July 21, 2026, and custom CSS layout and positioning properties are being retired. A new federated sign-in page documents cross-root-domain blocking and related Microsoft Graph beta APIs; provisioning, Token Protection, and Lifecycle Workflows also received substantive guidance.

Entra ID · Authentication Company branding CSS restrictions and retirement

Updated Entra ID branding guidance says tenants created after January 5, 2026, cannot use custom CSS. After July 21, 2026, older tenants that were not already using it cannot configure it; support for custom CSS layout and positioning properties is being retired.

Entra ID · Authentication Federated sign-in security policy guidance

A new Entra ID page explains that the policy blocks federated sign-ins when the trusted realm and mapped user account have different root domains. It also documents related Microsoft Graph beta APIs, which are subject to change and unsupported for production applications.

Entra ID · Provisioning Inbound provisioning null-value clearing preview

New Entra ID provisioning guidance documents clearing an existing target attribute when the source value is null or empty. The capability is opt-in, requires enabling “Flow null values” on both source and target mappings, and supports only single-valued attributes in specified inbound scenarios.

Entra ID · Fundamentals Apple Token Protection support status

The Entra ID Token Protection reference now lists token protection for iOS/iPadOS and macOS as generally available. Supported web apps accessing Azure Resource Manager on macOS remain in preview.

ID Governance · Fundamentals Mover workflow access-removal timing

ID Governance task guidance now applies “Remove all access package assignments for user” to both leaver and mover templates. For mover templates, scheduled removal defaults to 15 days; administrators can customize the timing or choose immediate removal.

Global Secure Access V2 guidance now spells out profile order and migration differences

The period's clearest administrator-relevant update concerns Global Secure Access web filtering: V2 selects the first applicable profile containing a V2 policy, individual rules do not support user or group targeting, and enforcement may differ from V1 during migration. ID Governance guidance also expands delegation coverage to multi-resource access reviews, while Entra ID clarifies the scope of application-owner permissions.

Internet Access · Fundamentals V2 profile selection and rule-targeting limits are now explicit

Updated web-filtering guidance says V2 selects the first applicable profile containing a V2 policy. It also states that individual rules do not support user or group targeting and that enforcement may differ from V1 during migration.

ID Governance · Governance My Access guidance adds delegated multi-resource access reviews

The updated preview guidance covers delegating multi-resource access reviews in addition to access package approvals. Administrators can control delegation to a manager, specific groups, or any directory user, apply delegate-selection restrictions, set maximum delegation duration, and require expiration dates. Single-resource access reviews are not included.

Entra ID · Fundamentals Application-owner permissions are clarified by application scope

The Assign App Owners guidance now compares application owners with application administrators, stating that owners can manage only the enterprise applications they own and have equivalent permissions within that application's scope.

Global Secure Access · Security V1-to-V2 migration instructions are now presented as numbered steps

The migration guide now presents the V1-to-V2 procedure and migration options as numbered steps, making the sequence clearer to follow. No administrator action is required.

Federated sign-in validation tightens as Windows Hello and macOS SSO gain standalone MFA

The day’s consequential changes are two Entra authentication behavior updates. Microsoft says the federatedTokenValidationPolicy default will block federated sign-ins when internalDomainFederation does not match the user’s UPN domain for federated domains configured before December 2025. Starting in October 2026, Windows Hello for Business and macOS Platform SSO will count as standalone MFA factors. Workload ID’s flexible federated identity credential preview guidance also tightens GitHub claim matching, while the remaining updates are lower-impact synchronization and licensing reference maintenance.

External ID · Conditional Access FederatedTokenValidationPolicy default will block mismatched federated domains

Microsoft’s Message Center notice describes a mid-August 2026 default change affecting federated domains configured before December 2025. Federated sign-ins will be blocked when internalDomainFederation does not match the user’s UPN domain. Administrators can customize the policy through Microsoft Graph, although Microsoft discourages customization.

Entra ID · Conditional Access Windows Hello and macOS Platform SSO become standalone MFA factors

Starting in October 2026, Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors, allowing users to satisfy MFA requirements without an additional passkey. Microsoft says no configuration changes are required, but onboarding and MFA-registration guidance should be updated.

Workload ID · Security GitHub flexible FIC preview guidance requires immutable repository claims

The updated preview documentation says GitHub flexible federated identity credentials must match sub and at least one immutable claim: repository_id or repository_owner_id. The examples and operator guidance now use these claims with the eq operator when defining or reviewing trust.

Entra ID · Provisioning Synchronization guidance adds sAMAccountName coverage for Domain Services

The Synchronization page now describes enhanced support for synchronizing sAMAccountName with Microsoft Entra Domain Services and links to dedicated guidance for that scenario.

Entra ID · General Licensing reference adds Windows 10 ESU identifiers to Windows 365 entries

The reference, updated August 14, 2026, adds Windows 10 ESU service-plan identifiers to two Windows 365 plan entries. No administrator action is stated beyond using the updated reference when matching those plans.