Daily.Entra.News
A cross-product view of Microsoft Entra changes related to Security.
The article now links to a sample app demonstrating passkey listing and registration with delegated permissions and warns that its deletion flow uses high-privilege application permissions and a client secret in browser code.
The Microsoft Entra External ID credential management API reference was deleted, including guidance for passkey listing and registration, delegated permissions, authentication, and sample usage.
Corrected a spelling error in the explanation of “Report-only: Failure” results for the “Require app protection policy” control.
The documentation corrects “Web respositories” to “Web repositories” in an example of security rules.
The documentation now states that locks apply to an application's service principal for both single-tenant and multitenant applications. Since June 2026, Enable property lock is enabled by default for new applications.
Microsoft is updating Microsoft Defender for Office 365's Unified RBAC mapping for the Microsoft Entra Security Operator role, removing default access to email threat policies and Tenant Allow/Block List. This change starts November 2026 and requires manual permission assignment for continued access when Unified RBAC is enabled.
The documentation now emphasizes app instance lock for multitenant applications and also mentions single-tenant applications.
The required Microsoft Entra Connect Sync version changed from 2.5.79.0 to 2.6.84.0 or later. Application-based authentication must still be configured by April 7, 2027.
The warning is bolded: upgrade Microsoft Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Synchronization services will stop working after that date if these requirements are not met.
The deadline changed to April 7, 2027. Administrators must upgrade to version 2.5.79.0 or later and configure application-based authentication; synchronization stops after the deadline if requirements are unmet.
The required Microsoft Entra Connect Sync version increased from 2.5.79.0 to 2.6.84.0. Administrators must also configure application-based authentication by April 7, 2027.
The documentation now bolds the mandatory upgrade warning: upgrade Entra Connect Sync to version 2.5.79.0 or later and configure application-based authentication by April 7, 2027. Legacy authentication will be retired, and synchronization will stop after that date if requirements are unmet.
The documentation now requires version 2.5.79.0 or later and application-based authentication by April 7, 2027. Synchronization services will stop afterward if these requirements are unmet.
The page now notes that, starting July 15, 2026, GitHub will automatically use immutable subject claims for newly created, renamed, or transferred repositories. Existing repositories will retain name-based claims unless opted in.
The documentation replaces the Source type condition with Session type, adds a known internet access limitations reference, and revises guidance for WebSocket filtering, API rate limiting, and Purview inspection failures.
The documentation now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It adds a warning that blocking HTML or JSON can disrupt normal web and API traffic, and updates the stated coverage from HTTP/1.1 to HTTP/S.
The guide now states that users without a registered or enrolled device are prompted to register it, and documents a different message for users who have not installed the latest September 2026 Windows update.
The guidance now covers applications and user-assigned managed identities, including Azure Resource Manager setup instructions and updated GitLab claim-matching requirements.
The documentation now explains setup for applications and user-assigned managed identities, using Microsoft Graph for applications and Azure Resource Manager for managed identities. It also adds details about credential properties, including claimsMatchingExpression.
The version history entry now links readers to the latest available Microsoft Entra Connect Sync version.
The Windows token protection guide now refers to Microsoft Copilot instead of Microsoft 365 Copilot.
The Microsoft Entra External ID credential management API reference was deleted. It previously documented how applications let signed-in customers list, register, and delete passkeys.
The new article explains how to use Quick setup, register applications, create credentials, and issue and verify credentials in a Microsoft Entra External ID tenant. It documents prerequisites and limits, including custom-domain requirements, shared signing keys, two requests per second per tenant, and six-month credential validity.
The guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The capability is in preview, and the private key remains protected by Microsoft.
The article now focuses on bringing your own certificate authority for TLS inspection, including CSR creation, PKI signing, and certificate upload. It also links to separate Microsoft-managed certificate guidance.
Starting late September 2026, Microsoft Viva Engage will require Microsoft Entra permissions—Yammer Administrator role or Community Admin assignment—for community and membership management tasks previously allowed to Verified or Network Admins. Administrators should review and update role assignments accordingly.
The AI prompt injection protection documentation now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before configuring TLS inspection policies.
The TLS inspection documentation now explains how to configure either a Microsoft-managed certificate or your own certificate authority.
Enhanced synchronization can source sAMAccountName for hybrid users from onPremisesSamAccountName in Microsoft Entra ID. Existing domains retain current behavior until enabled; enabling updates existing hybrid users during synchronization, while cloud-only users without the source value continue using mailNickname-based generation.
The guide now presents the V1-to-V2 migration procedure and migration options as numbered steps.
The documentation now states that GitHub flexible federated identity credentials must match `sub` and at least one immutable claim: `repository_id` or `repository_owner_id`. It also updates examples and operator support details.
The guidance now requires GitHub flexible federated identity credentials to match `sub` plus `repository_id`, `repository_owner_id`, or both. Portal and Microsoft Graph examples include these claims and optional workflow matching.
The documentation now recommends creating agent identities from an agent identity blueprint instead of using standard app registrations or service principals. It also adds .NET usage guidance and lists required roles and permission.
The documentation updates its C# examples, separating app-only, on-behalf-of-user, and user-identification scenarios. Samples now configure agent identity options and pass the credential to the Blob client correctly.
The guide updates “Entra” to “Microsoft Entra” in the diagram alt text, setup heading, and TENANT_ID descriptions. No technical procedure or feature change is shown.
The documentation now links to guidance on mutable subjects and migrating GitHub Actions federated credentials to immutable subjects.
The setup documentation now links to guidance on mutable subjects and migrating GitHub Actions federated credentials to immutable subjects.
"audiences": ["api://AzureADTokenExchange"]
Learn how to migrate a Microsoft Entra federated identity credential for GitHub Actions from a mutable subject to GitHub's immutable subject format.
Learn how mutable OIDC subject claims expose Microsoft Entra federated identity credentials to subject recycling, and how immutable claims reduce the risk.
> If you have a highly locked-down and restricted environment, you need to add more URLs than the URLs the table lists for Internet Explorer enhanced security. Also add URLs that are listed in the table in the next section.
Learn how assignment restrictions scope a user-assigned managed identity to one or more resource providers to improve security and resilience.
We are announcing the ability to manage users through Microsoft Entra security groups in Dynamics 365 Contact Center. This feature will reach general availability on July 24, 2026.
Discover how to configure network content filtering with Global Secure Access to enforce data protection policies for files and text content in real time.
Microsoft Entra ID Protection provides unified risk signals that aggregate correlated risk signals from Microsoft Entra ID Protection, Microsoft Defender, and other Microsoft security products. Instead of evaluating alerts in isolation, this capability correlates identity-related signals across products and evaluates them together within the same time window to calculate a compounded user risk score.
Learn how assignment restrictions scope a user-assigned managed identity to one or more resource providers to improve security and resilience.
- [Microsoft Entra Security Operations Guide](https://aka.ms/AzureADSecOps)
Security operations guide for Microsoft Entra Global Secure Access covering detection patterns and Sentinel analytics for Private Access, Internet Access, Remote Networks, and Microsoft Traffic.
>The licensing options on this page aren't comprehensive. You can get detailed information about the various options at the [Microsoft Entra pricing page](https://www.microsoft.com/security/business/microsoft-entra-pricing) and at the [Compare Microsoft 365 Enterprise plans and pricing page](https://www.microsoft.com/microsoft-365/enterprise/microsoft365-plans-and-pricing).
Starting soon, ID Protection for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to extend protection to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).
- The Service Principal Names (SPNs) of the private apps you want to protect. You add these SPNs in the policy for Private Access Sensors that are installed on the DCs.
Starting soon, ID Protection for agents will require a [Microsoft Agent 365 license](https://www.microsoft.com/microsoft-agent-365#plans-and-pricing) to extend protection to agents through [Microsoft Entra Agent ID](../agent-id/what-is-microsoft-entra-agent-id.md#how-to-get-started).
**Has filter** indicates whether the policy has app filters that use custom security attributes.
Protect your enterprise generative AI apps from prompt injection attacks with Microsoft's AI Gateway prompt injection protection.
Understand consent request evaluation and tenant-wide admin consent in Microsoft Entra ID. Essential guidance for administrators managing application permissions and security.
Learn about the best practices and general guidance for protecting frontline workers in an organization
Include file with a common configuration in web apps and web APIs calling downstream web APIs (ASP.NET Core and ASP.NET OWIN).
A Microsoft Entra documentation page was updated: Configure Acronis Cyber Protect Cloud for Single Sign-On with Microsoft Entra ID.
Learn how to configure and use cloud firewall to protect against unauthorized internet access from branch offices using Remote Networks for Internet Access.
Learn how to build a protected web API and configure your application's code.
Learn how to disable and enable risk-based step-up consent to reduce user exposure to malicious apps that make illicit consent requests.
Learn how to configure a Transport Layer Security inspection policy and assign it to users in your organization.
Learn how to configure a Transport Layer Security inspection certificate authority
Learn how to protect your organization with a custom Data Loss Prevention (DLP) profile powered by Netskope.
In this article, you learn how to integrate IMPAC Risk Manager with Microsoft Entra ID. When you integrate IMPAC Risk Manager with Microsoft Entra ID, you can:
In this article, you learn how to integrate IriusRisk with Microsoft Entra ID. When you integrate IriusRisk with Microsoft Entra ID, you can:
In this article, you learn how to integrate KnowBe4 Security Awareness Training with Microsoft Entra ID. When you integrate KnowBe4 Security Awareness Training with Microsoft Entra ID, you can:
In this article, you learn how to integrate Menlo Security with Microsoft Entra ID. When you integrate Menlo Security with Microsoft Entra ID, you can:
In this article, you learn how to integrate Riskware with Microsoft Entra ID. When you integrate Riskware with Microsoft Entra ID, you can:
Learn how to use Security Store in Microsoft Entra to discover, purchase, and deploy AI agents and security solutions for identity and access management.
Enable HSC mode on your Azure AD B2C tenant to adopt Microsoft Entra External ID endpoints while keeping existing users and credentials in place.
Enable single sign-on for an enterprise application that has a relying party security token service in Microsoft Entra ID.
Learn how you can adopt Microsoft's Security Service Edge (SSE) solution via Microsoft services partners.
Learn about Microsoft Entra Workload ID Flexible federated identity credentials and its capabilities.
How to increase app security by configuring property modification locks for sensitive properties of the application.
Learn how to enforce TLS 1.2 for a Microsoft Entra Domain Services managed domain.
Increase app security and resilience by adding support for Continuous Access Evaluation, enabling long-lived access tokens that can be revoked based on critical events and policy evaluation.
Learn how the principle of least privilege can help increase the security of an application and its data.
Integrate F5 BIG-IP with Microsoft Entra ID for secure hybrid access (SHA) to improve access and security.
Strengthen your organization's security posture by integrating Global Secure Access with Microsoft Sentinel using preconfigured workbooks and analytics rules.
Use Microsoft Security Copilot and Microsoft Entra skills to quickly investigate potential risky applications.
Learn about Microsoft Entra agents, AI-powered automation tools that enhance identity and access management operations.
Discover how to configure network content filtering with Global Secure Access to enforce data protection policies and secure sensitive files in real time.
Use this PowerShell script to generate and sign Transport Layer Security (TLS) certificates using OpenSSL in a test environment.
Learn ways of mitigating against application-based consent phishing attacks using Microsoft Entra ID.
A Microsoft Entra documentation page was updated: Protecting Tokens Microsoft Entra Id.
In this quickstart, you learn how a .NET sample app can use the client credentials flow to get a token and call Microsoft Graph.
Find partner solutions to integrate your legacy on-premises, public cloud, or private cloud applications with Microsoft Entra ID.
Learn about the best practices and general guidance for security related application properties in Microsoft Entra ID.
Learn how to set up a Flexible Federated identity credential in the Azure portal or Microsoft Graph Explorer.
Transition to Microsoft Entra External ID for CIAM: Learn how to migrate your legacy customer identity solutions to enhance security, compliance, and scalability.
Learn how to access Azure Storage from a web app in Azure App Service using managed identities. Simplify security and avoid managing secrets.
Learn how to configure groups and user roles in your external tenant, so you can receive them as claims in a security token for your Node.js application
Verify that the API is only called by applications on behalf of users who have the right scopes and by daemon apps that have the right application roles.
Important considerations and restrictions for creating a federated identity credential on an app.
Learn how to configure single sign-on between Microsoft Entra ID and Acronis Cyber Protect Cloud.
Learn how to configure single sign-on between Microsoft Entra ID and Banyan Security Zero Trust Remote Access Platform.
Learn how to configure single sign-on between Microsoft Entra ID and Cequence Application Security Platform.
Learn how to configure single sign-on between Microsoft Entra ID and Contrast Security.
Learn how to configure single sign-on between Microsoft Entra ID and Coupa Risk Assess.
Learn how to configure single sign-on between Microsoft Entra ID and Coverity Static Application Security Testing.
Learn how to configure single sign-on between Microsoft Entra ID and CylancePROTECT.
Learn how to configure single sign-on between Microsoft Entra ID and Datto File Protection Single Sign On.
Learn how to configure single sign-on between Microsoft Entra ID and Directory Services Protector.
Learn how to configure single sign-on between Microsoft Entra ID and Guardium Data Protection.
Learn how to configure single sign-on between Microsoft Entra ID and IMPAC Risk Manager.
Learn how to configure single sign-on between Microsoft Entra ID and Imperva Data Security.
Learn how to configure single sign-on between Microsoft Entra ID and IriusRisk.
Learn how to configure single sign-on between Microsoft Entra ID and Kisi Physical Security.
Learn how to configure single sign-on between Microsoft Entra ID and KnowBe4 Security Awareness Training.
Learn how to configure single sign-on between Microsoft Entra ID and Menlo Security.
Learn how to configure single sign-on between Microsoft Entra ID and Netskope Administrator Console.
Learn how to configure single sign-on between Microsoft Entra ID and Palo Alto Networks - GlobalProtect.
Learn how to configure single sign-on between Microsoft Entra ID and Proofpoint Security Awareness Training.
Learn how to configure single sign-on between Microsoft Entra ID and Riskware.
