Daily.Entra.News
A cross-product view of Microsoft Entra changes related to Conditional Access.
Microsoft Entra passkeys on Windows will be generally available from late April 2026, enabling passwordless, phishing-resistant sign-in on Windows devices without requiring explicit admin allow-listing. It supports corporate, personal, and shared devices, with control via Authentication Methods policies and Conditional Access. No action is needed unless blocking is desired.
The documentation adds a tutorial for configuring Microsoft Entra agent identities to authenticate to Azure Database for PostgreSQL flexible server and access data through group-based authorization, entitlement management, and conditional access.
The documentation now states that the Microsoft Authenticator Credential Registration resource will be available in November 2026. It also retains the prerequisite to provision the enterprise application before excluding the resource from a Conditional Access policy.
Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations using MemberOf in dynamic groups, administrative units, or entitlement policies must replace it to avoid outdated memberships, access, and licensing issues. Action is required before this date to maintain proper functionality.
Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting early November 2026, allowing users to satisfy MFA without additional passkeys. No configuration changes are needed, but organizations should update onboarding and MFA registration guidance accordingly.
A new guide explains how to create policy plans from templates or from scratch, configure shared conditions and exclusions, review rules in report-only mode, and enable them.
Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins November 2026, aiming to simplify strong authentication adoption and reduce registration friction.
A new article explains how to consolidate selected Conditional Access policies into a policy plan, review shared conditions and generated rules, and validate the plan before enforcement. Original policies remain unchanged and continue evaluating independently.
The new documentation introduces Conditional Access policy plans, which group related rules under shared targeting and conditions. Plans can centralize exclusions and support multiple enforcement scenarios; the capability is marked preview.
To strengthen your organization's security posture, Microsoft created a new Microsoft‑managed Conditional Access (CA) policy—Require risk remediation for high‑risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self‑remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.
The documentation now states that baseline-scope enforcement rollout began June 15, 2026. It adds a Microsoft Graph query for finding affected Conditional Access policies and clarifies customization and sign-in review guidance.
Microsoft Entra ID will support passkey registration and sign-in for B2B users, enabling phishing-resistant MFA in resource tenants starting late October 2026. Internal guest users get Microsoft Authenticator app passkeys; external users do not. The feature is enabled by default, intersecting with SMS/voice retirement policies. No action required, but administrators should review policies.
The documentation now states that Conditional Access evaluates the signed-in user who is the token subject, including users targeted directly or through groups. Selecting an agent identity does not cover OBO traffic.
The documentation clarifies that Conditional Access policies targeting agent identities do not apply to on-behalf-of (OBO) traffic, because the user is the subject of that flow.
The Agent ID documentation now uses the correct anchor for the “Allow approved agents by using custom security attributes” policy example.
The policy example link now points to the `use-custom-security-attributes` section.
The Microsoft Agent 365 licensing prerequisite bullet was reformatted for consistency.
The documentation now states that Microsoft Entra ID Conditional Access for agents requires an eligible license plan, including Microsoft 365 E7 with Agent 365 and Microsoft Entra Suite. The explanatory governance phrase was removed.
The licensing requirements now list Microsoft 365 E7, or Microsoft Agent 365 paired with at least Microsoft Entra P1 or Microsoft 365 E3.
The documentation now refers to real-time risk information, rather than session risk information, among the signals used to determine access.
The overview now explains policy decisions, evaluation timing, token subjects and audiences, and supported agent access patterns. It also adds links to related identity-management and policy guidance.
The overview now explains how Conditional Access evaluates the token subject and resource, and distinguishes delegated, agent-identity, and agent-user-account scenarios. Licensing and network-control requirements remain documented.
The autonomous agents policy documentation now includes a section for custom security attributes in policies.
A new guide explains how to apply Conditional Access to agents using their own user accounts, including policies for agent risk, compliant devices, and compliant networks. It also documents agent-specific targeting and prerequisites.
The page now covers agent identities and additional policy options, including custom security attributes, agent execution environments, device compliance, network locations, and agent risk. It also updates policy creation steps and links.
The article now documents the enhanced object picker for selecting agent identities and blueprints, updates policy-creation steps, and notes that an Agent 365 license will soon be required.
The article now focuses on Conditional Access for agents using their own identities, adds prerequisites, clarifies that policies target agent identities rather than users, and recommends report-only block policies for unapproved agents.
The article now covers selecting agent identities or agent user accounts, explains that conditions and controls depend on the token subject, and updates related links and terminology.
Added a missing space between “authentication” and “and” in the documentation.
Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations must replace MemberOf in dynamic groups, administrative units, and entitlement policies to avoid outdated memberships, access, and licensing issues. After this date, MemberOf-based updates will stop, impacting Conditional Access and related services.
SharePoint One-Time Passcode (SPO OTP) authentication will retire starting mid-October 2026, transitioning external sharing and authentication to Microsoft Entra B2B. This change affects all Microsoft 365 tenants, requiring guest accounts for external users and enabling consistent governance and Conditional Access across SharePoint and OneDrive.
The documentation now distinguishes agents acting for signed-in users, using their own identity, or using an agent user account. It adds separate guidance links for autonomous agents and agent users and updates the listed licensing combinations.
The guidance explains prerequisites, policy targeting, risk controls, device and network conditions, and blocking risky agent user accounts. It notes that all-user and group targeting don't include agent users.
The article now presents Conditional Access for autonomous agents as a scenario-based pattern, adds prerequisites, and recommends starting block policies in report-only mode. It also notes that an Agent 365 license will soon be required.
The article now uses a scenario-based structure, explains that conditions and controls depend on the token subject, and links separately to guidance for agent identities and agent user accounts. Terminology, metadata, and related links were also updated.
The documentation now warns that device platform information, such as user agent strings, can be modified and isn't verified. It recommends using device platform with Microsoft Intune device compliance policies or in a block statement.
On August 24, 2026, we initiated the gradual roll out of self-service migrations to Microsoft Entra Agent IDs for Copilot Studio agents in Power Platform Advisor. Beginning on September 2026, automatic migrations of agents without Entra Agent ID to Microsoft Entra Agent ID were also initiated.
To strengthen your organization's security posture, Microsoft will create a new Microsoft-managed Conditional Access (CA) policy—Require risk remediation for high-risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self-remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention.
Microsoft is retiring SMS first-factor sign-in for Microsoft Entra ID workforce tenants worldwide starting February 1, 2027, to enhance security. Organizations must identify affected users, migrate them to phishing-resistant methods like passkeys, and update policies to avoid sign-in disruptions and comply with new requirements.
The documentation removes “preview” from the source traffic type and HTTP method request filtering conditions, updates their headings and links, and refreshes the page date.
Passkeys became the default Microsoft Entra authentication on September 1, 2026. Microsoft-provided SMS and voice authentication will retire February 1, 2027, requiring customers to use telecom providers from the Microsoft Security Store. Transition to passkeys is recommended for stronger, phishing-resistant security.
Microsoft Purview DLP integrates with Entra Global Secure Access Internet Access to filter sensitive files at the network layer, preventing data leaks to unmanaged cloud apps. Public preview starts mid-November 2025; general availability by October 2026. Admins must configure policies, TLS inspection, and activate Purview pay-as-you-go.
On August 24, 2026, we initiated the gradual roll out of self-service migrations to Microsoft Entra Agent IDs for Copilot Studio agents in Power Platform Advisor. Copilot Studio agents created before May 2026 may still use legacy app-registration identities.
Microsoft Single Sign-on for Linux version 2.0.2 and later uses Microsoft Entra join for device trust instead of device registration. The documentation also adds MSAL integration support guidance and updates device removal terminology.
The guide removes the Preview designation, adds Microsoft Scout to the support matrix, and replaces detailed storage-flag instructions with updated Apple SSO plugin and Platform SSO guidance.
Microsoft Entra will update federatedTokenValidationPolicy by mid-August 2026 to block federated sign-ins when internalDomainFederation doesn't match the user's UPN domain, enhancing security. This affects federated domains configured before December 2025. Admins can customize the policy via Microsoft Graph but it's discouraged.
The token protection article removes a screenshot of a Conditional Access policy requiring token protection as a session control. The Primary Refresh Token link remains.
The documentation now lists two supported licensing options: Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite, or Microsoft Agent 365 paired with at least Microsoft Entra P1 or Microsoft 365 E3.
The documentation now states that Conditional Access for agents requires a Microsoft Agent 365 license to apply policies through Microsoft Entra Agent ID, replacing “Starting soon.”
Adds a guide for deploying and enforcing Token Protection with Conditional Access for supported browser-based applications accessing Azure Resource Manager. Web application support is explicitly in preview and limited to listed apps, platforms, browsers, and device configurations.
Microsoft Entra ID will retire the MemberOf rule operator by November 3, 2026. Organizations using MemberOf in dynamic groups, administrative units, or entitlement policies must replace these rules to avoid stale access, licensing, and policy enforcement issues. Review and update configurations before the deadline.
Starting June 15, 2026, Conditional Access policies targeting All resources with exclusions will be enforced for sign-ins requesting only certain OIDC or directory scopes. Some users may face new challenges like MFA. Most organizations need no action, but custom apps requesting only these scopes should be evaluated.
Microsoft Purview extends data loss prevention to the network layer via integration with Entra Internet Access, enabling inspection and protection of sensitive data in AI interactions and cloud services. It supports policy enforcement, alerts, and auditing, with rollout from July to October 2026, affecting Purview, Entra, and Defender administrators.
Explicit Forward Proxy for Microsoft Entra Internet Access relies on IP affinity, among other mechanisms, for session management. Although a Conditional Access policy isn't required, we recommend that you configure one that restricts the use of Explicit Forward Proxy to networks that your organization trusts. Additionally, you use Conditional Access policies to assign the Microsoft Entra Internet Access security profiles to users.
Explicit Forward Proxy uses Microsoft Entra ID authentication and authorization to validate user access before allowing network traffic. This validation method allows for adaptive policies in Microsoft Entra Conditional Access, modern credentials like passkeys, and Continuous Access Evaluation with session revocation. Classic proxy authorization methods, such as basic, digest, NTLM, or Kerberos, aren't supported.
- **Conditional Access**: The new policy evaluated and granted access
Microsoft Entra ID is retiring Custom Controls in Conditional Access by May 2027, replacing them with External MFA for standardized third-party MFA integration. Administrators must migrate policies by September 2026, updating Conditional Access to use External MFA to ensure continued support and security.
Organizations that are deploying passkeys and have Conditional Access policies that require phishing-resistant authentication when accessing **All resources (formerly 'All cloud apps')** can run into a looping issue when users attempt to add a passkey to Microsoft Authenticator. For more information and possible workarounds, see [Workarounds for an authentication strength Conditional Access policy loop](~/identity/authentication/how-to-enable-authenticator-passkey.md#workarounds-for-an-authentication-strength-conditional-access-policy-loop).
Conditional Access enforcement update completed in your tenant
- [Office 365 app in Conditional Access](concept-conditional-access-cloud-apps.md#office-365)
Learn how to review and apply suggestions provided by the Security Copilot for Microsoft Entra optimization agent.
Learn how to configure a Conditional Access policy that requires a compliant network with Global Secure Access.
Learn how admins can create custom authentication strengths with advanced options for passkey (FIDO2) security keys and certificate-based authentication.
Learn how to use the Conditional Access Optimization Agent to safely deploy a passkey program to roll out phishing-resistant authentication methods.
Microsoft Teams for the web will respect Microsoft Entra ID's "Keep Me Signed In" (KMSI) settings starting late June 2026. Sessions will persist only if users choose to stay signed in; otherwise, sessions clear on browser close, enhancing security on shared devices. No immediate action is required.
Upcoming Conditional Access change in your tenant
ID Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user is compromised. If a user has risky user sign-in behavior, or their credentials were leaked, ID Protection uses these signals to calculate the user risk level. Administrators can configure risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as:
This series of exercises covers the fundamentals of Internet Access. The exercises assume that you follow them in order. If you skip around, you might miss a step. For example, in the baseline web-filtering tutorial, you create a security profile and assign it to a Microsoft Entra Conditional Access policy. Subsequent labs instruct you to assign the new policy to this existing security profile rather than creating a new security profile and Conditional Access policy each time.
Microsoft Entra Suite includes all Microsoft Entra Conditional Access features. Microsoft 365 E7 also includes Conditional Access features through the Entra Suite.
In this flow, the agent can't reuse the user's original token because it was issued for a different audience. Instead, the agent uses the OBO flow to exchange tokens with Microsoft Entra ID, obtaining a new token scoped to the target resource. This token exchange is also evaluated by Conditional Access, letting admins enforce granular controls over which resources agents can access on behalf of the user.
Learn how to manage agent identities across your organization. View, disable, govern, and monitor agents using the Microsoft Entra admin center and Conditional Access.
Microsoft is adding new Entra service plans—Conditional Access for Agents and ID Protection for Agents—to Microsoft Agent 365 and Microsoft 365 E7, enabling secure agent identity management. Rollout starts July 2026, with automatic enabling and no policy changes. No action required, but license review is recommended.
Learn how admins can use Microsoft Entra Conditional Access to distinguish which authentication methods users can use based on relevant security factors.
Learn about the chat feature for the Security Copilot for Microsoft Entra Conditional Access Optimization Agent.
Learn how Knowledge Bases help the Conditional Access Optimization Agent create tailored policy recommendations based on your organization's unique standards.
Learn about the phased rollout capability for the Security Copilot for Microsoft Entra optimization agent.
Learn how to configure a Conditional Access policy for Explicit Forward Proxy.
A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I need to know how many users in my tenant are using per-user MFA so I can make a plan to switch to Conditional Access MFA..
Learn how to use the Conditional Access Optimization Agent to safely deploy a passkey program to roll out phishing-resistant authentication methods.
Developer guidance and scenarios for Microsoft Entra Conditional Access and Microsoft identity platform.
Developer guidance and scenarios for Microsoft Entra Conditional Access authentication context
Learn how to handle errors and exceptions, Conditional Access claims challenges, and retries in MSAL.js applications.
Learn how admins can use authentication strength requirements for external users in Microsoft Entra ID.
Learn about the Security Copilot for Microsoft Entra Conditional Access Optimization Agent metrics and events in audit logs.
Learn how to manage agent identities across your organization. View, disable, govern, and monitor agents using the Microsoft Entra admin center and Conditional Access.
Learn how the Microsoft Entra Conditional Access Optimization Agent with Microsoft Security Copilot can help secure your organization.
Explore the settings available for the Microsoft Entra Conditional Access Optimization Agent with Microsoft Security Copilot.
Learn how to migrate from custom controls to external multifactor authentication in Microsoft Entra Conditional Access.
Learn how to review and apply suggestions provided by the Security Copilot for Microsoft Entra optimization agent.
Learn how to resolve errors when you're using Microsoft Entra Conditional Access authentication strengths.
Configure Conditional Access to enforce application and user policies in Cloudflare Access.
- High-level overview of Conditional Access: [What is Conditional Access?](overview.md)
The agent settings described in this article cover standard options like triggers, notifications, and scope. But the settings also include advanced options like custom instructions, Intune integrations, and permissions.
Learn how Knowledge Bases help the Conditional Access Optimization Agent create tailored policy recommendations based on your organization's unique standards.
Conditional Access policies for agent identities let you control how AI agents access corporate resources. As your organization deploys more agents, you need policies that target the right agents, evaluate the right signals, and enforce the right controls. To learn more about how Conditional Access policies for agents work for different scenarios, see [Conditional Access policies for agents](agent-id.md).
The [What If Evaluation API](/graph/api/conditionalaccessroot-evaluate) is a Microsoft Graph API that is called by the Conditional Access experience. The API is different from the legacy What If evaluation in a few ways:
When an organization deploys AI agents, those agents acquire access tokens to access organizational resources on every interaction, but without an interactive user session and device, location, or MFA signals that classic Conditional Access uses to make trust decisions for human users. Microsoft Entra Agent ID introduces two distinct identity types:
When an organization enables AI agents in Microsoft Entra, [agent identities](/entra/agent-id/agent-identities) can access tokens to access organizational resources without an interactive user session and device, location, or MFA signals that classic Conditional Access uses to make trust decisions for human users. Microsoft Entra ID Protection for agents continuously evaluates each agent's behavior and emits a risk level that is driven by signals such as:
Conditional Access is an intelligent policy engine that helps organizations control how users and agents access corporate resources. It brings together real-time signals such as user's and agent's context, device, location, and session risk information to determine when to allow, block, or limit access, or require more verification steps.
Control internet access based on website categories, URLs, and FQDNs. Configure granular, user-aware filtering policies using security profiles and Conditional Access.
Plan your Conditional Access policies to balance security and productivity. Learn how to design and deploy effective policies for your organization.
- Contractors are governed by their own policies separate from the baseline
Conditional Access policies will apply to Windows Hello for Business and macOS Platform SSO registration starting July 6, 2026, enforcing policy requirements like MFA and trusted locations during enrollment. Organizations should review and test policies, update documentation, and ensure users can meet requirements before rollout completes July 13, 2026.
Learn how custom controls in Microsoft Entra Conditional Access work.
Learn how to migrate from custom controls to external multifactor authentication in Microsoft Entra Conditional Access.
- After the agent starts, you can't stop or pause the run. It might take a few minutes to run.
Learn how Conditional Access for agent identities in Microsoft Entra ID extends Zero Trust principles to AI agents, ensuring secure access and governance.
- **Risky sign-ins**: The agent suggests a policy to require multifactor authentication for high risk sign-ins. Requires Microsoft Entra ID P2 license.
Deep analysis performs an in-depth review of Conditional Access policies for scenarios such as blocking legacy authentication, blocking device control flow, and policies that require device or MFA controls. It evaluates the targeted users, groups, and roles to identify coverage gaps, overlapping or redundant policies, and consolidation opportunities. It also analyzes exclusions—flagging policies that exclude a large portion of users and recommending explicit exclusion of break‑glass accounts to reduce the risk of accidental lockout.
- [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator)
- [Security Reader](~/identity/role-based-access-control/permissions-reference.md#security-reader)
* An account with at least the [Conditional Access Administrator](~/identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role. Some MFA settings can also be managed by an [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator).
Explicit Forward Proxy uses Microsoft Entra ID authentication and authorization to validate user access before allowing network traffic. This validation method allows for adaptive policies in Microsoft Entra Conditional Access, modern credentials like passkeys, and Continuous Access Evaluation with session revocation. Classic proxy authorization methods, such as basic, digest, NTLM, or Kerberos, aren't supported.
- **Conditional Access for agents**: Microsoft Entra ID P1 or Microsoft 365 E3.
author: kenwith
