Daily.Entra.NewsThe week’s most consequential change is Microsoft’s planned retirement of Microsoft-provided SMS and voice authentication for self-service password reset starting February 2027, with a 50-day transition for each user group. Microsoft Entra Private Access also introduced a sign-in-every-time preview requiring Conditional Access and Global Secure Access Windows client version 2.34.222 or later. Other meaningful updates added an end-to-end customer-owned telephony setup guide, documented a December 1, 2026 Salesforce provisioning requirement, and clarified an Entra SSH failure mode after RHEL upgrades. Much of the remaining activity involved documentation maintenance, links, and command examples.
Entra ID · Conditional AccessMicrosoft-provided SMS and voice authentication for self-service password reset will retire starting in February 2027. Each user group receives a 50-day transition, after which those methods will no longer be available for SSPR; organizations need alternative recovery methods.
Private Access · Conditional AccessThe preview depends on Conditional Access, requires the Global Secure Access Windows client version 2.34.222 or later, and uses a five-minute reauthentication window. Administrators should verify client coverage and use device-platform exclusions for non-Windows users where needed.
Entra ID · AuthenticationThe new end-to-end guide covers purchasing and activating a telecom provider, deploying the Azure integration, configuring authentication method profiles, validating evaluation mode, and gradually rolling out SMS and voice delivery. It also identifies the Azure resources, tools, permissions, and testing steps to review.
Entra ID · ProvisioningThe Salesforce provisioning tutorial now requires SOAP API login() to be enabled and the Admin Username account to have Use Any API Auth. It also records Salesforce’s December 1, 2026 requirement; enabling the setting and granting the permission helps prevent credential-validation failures.
Entra ID · AuthenticationIn-place upgrades from RHEL 8.x to 9.x can remove the aadsshlogin package and cause Permission denied (publickey) errors. If Entra SSH sign-in fails, the documented remedy is to uninstall and reinstall the AADSSHLoginForLinux extension.
Prepare alternative SSPR recovery methods and plan around the 50-day user-group transition. For Private Access, verify supported Windows clients and use device-platform exclusions where non-Windows users need different handling. Use the new Microsoft Entra admin center guide for customer-owned SMS and voice, grant Salesforce’s required permission before December 1, 2026, and check the AADSSHLoginForLinux extension if Entra SSH sign-in fails after an affected RHEL upgrade.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now describes Every time strict, including its 10-second validity window, application session-management requirements, targeting guidance, and Office 365 warning. It also explains Global Secure Access reauthentication for sensitive private applications using a five-minute window.
The table now lists External multifactor authentication as method 3, Certificate-based authentication as method 4, and Microsoft Authenticator notifications as method 5. The External MFA entry also has updated dash formatting.
The article now says the passkey sample demonstrates listing, registration, and deletion flows, and removes the previous Microsoft Graph deletion-flow warning.
The documentation now explains that in-place upgrades from RHEL 8.x to 9.x can remove the `aadsshlogin` package, causing `Permission denied (publickey)` errors. It provides steps to uninstall and reinstall the AADSSHLoginForLinux extension.
The documentation now directs administrators through Function App → Functions → SendOtp → Invocations when checking the latest transaction and HTTP 200 result.
The documentation now links Infobip’s Microsoft Security Store offer and directs administrators to the Microsoft Entra admin center setup guide instead of the API setup guide.
The documentation adds an end-to-end guide for purchasing and activating a telecom provider, deploying the Azure integration, configuring authentication method profiles, validating evaluation mode, and gradually rolling out SMS and voice delivery.
The article now links to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center instead of the API-based setup guide.
The documentation now links to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center instead of the API-based setup guide.
The troubleshooting page’s setup link was updated from API-based instructions to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center.
The article describing CYOT provider purchase, Azure integration deployment, permissions, policy configuration, and testing is no longer documented at this location.
The documentation now lists Microsoft Graph PowerShell commands to read and update a group’s `IsCloudManaged` state, and documents cloud-specific authentication options. It also notes that Graph Explorer isn’t supported in Azure China.
The guide now covers connecting with Microsoft Graph PowerShell, required permissions and cloud settings, troubleshooting consent, and the PowerShell command for changing a group’s source of authority.
The documentation now explains how to install and connect with Microsoft Graph PowerShell, select cloud environments, grant required permissions, and update a user’s source of authority with PowerShell.
The article now describes contacts as Outlook items, retains the required Contacts-OnPremisesSyncBehavior.ReadWrite.All permission, and uses a generic contact PATCH example. Detailed SOA read, transfer, verification, PowerShell, sovereign-cloud, and contact cmdlet guidance was removed.
The documentation now lists Graph PowerShell commands for setting and reading user SOA, identifies the Hybrid Administrator role, and documents cloud-specific connection environments. It also notes that Graph Explorer isn't supported in Azure China.
The configuration article now links to Microsoft Graph PowerShell cmdlets for updating and retrieving a contact’s on-premises sync behavior.
The page no longer includes the note that Graph Explorer is unsupported in Azure China or the instructions to use Microsoft Graph PowerShell for sovereign clouds.
The article adds Microsoft Graph API and PowerShell examples for transferring the source of authority (SOA) for organizational contacts synchronized from AD DS, including permissions, verification, and sovereign-cloud guidance.
The tutorial adds requirements to enable SOAP API `login()` and grant the integration account API Enabled, Manage Users, and Use Any API Auth permissions. It also documents Salesforce’s December 1, 2026 requirement for Use Any API Auth and related credential errors.
The tutorial now requires SOAP API `login()` to be enabled and the Admin Username account to have **Use Any API Auth**. It also documents credential-validation troubleshooting and Salesforce’s December 1, 2026 requirement.
The documentation changed the SOA-related resource table into a bulleted list while retaining the same three Microsoft Graph PowerShell links.
The Update-MgGroupOnPremiseSyncBehavior and Get-MgGroupOnPremiseSyncBehavior links no longer include the graph-powershell-1.0 view parameter.
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication for self-service password reset (SSPR) starting February 2027, with a 50-day transition per user group. Organizations must prepare alternative recovery methods, as SMS/voice will no longer be available for SSPR after the transition.
The User Source of Authority configuration guide now links to the current Microsoft Graph PowerShell cmdlet pages without the `view=graph-powershell-1.0` version parameter.
The documentation now states that Office perpetual clients version 2024 and later support Token Protection, while versions earlier than 2024 aren't supported.
The documentation now describes the sample as supporting passkey listing, registration, and deletion. It removes the separate deletion endpoint guidance and the warning about the sample using Microsoft Graph with high-privilege permissions and a client secret.
The new page describes the preview sign-in-every-time capability, its Conditional Access dependency, Windows client requirement (version 2.34.222 or later), and five-minute reauthentication window.
Microsoft Entra Private Access documentation now explains how to configure, test, and deploy reauthentication for selected private applications using one Conditional Access policy and a pilot group. It requires Global Secure Access Windows client version 2.34.222 or later.
The documentation now links to instructions for configuring sign-in every time for Microsoft Entra Private Access (preview).
