The scale is striking: about 50 controls, dozens of independently operated game-studio tenants, and one parallel pipeline that checks whether each environment still matches Xbox’s security intent. When a Conditional Access policy moves to report-only or a required service principal loses a permission, the next run finds it.

In this episode of Entra.Chat, Merill speaks with Audrey Long, Principal Cloud Security Architect in Xbox Security at Microsoft, and Sam Erde, SecureShield Architect at Patriot Consulting and a Maester maintainer. Audrey explains how Xbox Security extended Maester with custom PowerShell, GitHub Actions, a multi-tenant service principal, federated identity credentials, dashboards, ticketing, and time-bound exceptions.

The result is more than a posture report. Findings flow into an operational lifecycle with owners and deadlines. Studios get readable reports, deep links to the affected object, and remediation guidance. Security teams can answer audit questions without interrupting all the tenant admins, while the Maester pipeline keeps read-only observability separate from remediation authority.

The conversation also covers why a Microsoft-wide baseline needs adapting for gaming acquisitions, how custom tests encode an organization’s intent, why security configuration deserves regression tests, the Investigate status Audrey’s team helped introduce, and how administrators can use AI as a first-draft assistant for PowerShell and CI/CD without outsourcing validation.

Subscribe with your favorite podcast player or watch on YouTube

Sponsor

Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant—without digging through old HTML reports.

• Keep 5+ years of tenant history in your chosen Azure region

• Compare runs, spot drift, and get change alerts

Maester Cloud is in active development. Join the waitlist for hosted, self-hosted, or enterprise onboarding updates.

Join the Maester Cloud waitlist

About Audrey Long

Audrey Long is a Principal Cloud Security Architect in Xbox Security at Microsoft. She focuses on Microsoft Entra and identity security, as well as securing Azure, AWS, and Google Cloud environments across Xbox and its game studios. In this episode, she shares how her team built a gaming-specific Entra baseline and operationalized it across more than 70 tenants.

• LinkedIn - https://www.linkedin.com/in/aulong/

About Sam Erde

Sam Erde is part of the Maester core maintainer team, a Microsoft MVP, and a SecureShield Architect at Patriot Consulting. He focuses on Active Directory, Microsoft Entra ID, Microsoft 365 security, and practical PowerShell tooling for defenders.

LinkedIn - https://www.linkedin.com/in/samerde/

Related Links

• Maester, installation guide, and source code (mentioned at 02:19) - Maester · installation guide · GitHub source

• Continuous monitoring with Maester and GitHub Actions (mentioned at 14:38) - https://maester.dev/docs/monitoring/github/

• Writing custom Maester tests (mentioned at 22:39) - https://maester.dev/docs/writing-tests/

• Connect-Maester permissions and read-only access (mentioned at 24:38) - https://maester.dev/docs/connect-maester/

• Zero Trust Assessment: Secure your tenant (mentioned at 25:46) - https://entra.news/p/find-your-tenants-hidden-flaws-in

• Maester’s Investigate test-result status (mentioned at 34:02) - https://maester.dev/docs/writing-tests/formatting-test-results/

• Making Security Invisible for Game Developers (mentioned at 45:52) - https://opsmatters.com/videos/making-security-invisible-game-developers

Related Entra.Chat Episodes

• How to Secure Copilot Agents, Azure DevOps & Defender (+ more) with Maester 2.1 (Full Breakdown)

• Zero Trust Assessment: Secure your tenant

• How to Design Bullet-Proof Conditional Access Policies in Microsoft Entra ID

Chapters

00:00 Intro
00:42 Meet Audrey Long
02:19 From 50 Controls to 70+ Tenants
05:11 Making an Entra Baseline Gaming-Specific
08:32 Why Custom Maester Tests Matter
11:07 Governance and Nightly Automation
15:27 From Findings to Remediation
18:07 Reports Studios Can Actually Use
22:39 Building Custom Multi-Tenant Tests
28:07 Security Intent as Regression Tests
30:48 Catching Drift and Producing Audit Evidence
41:39 CI/CD and AI for Security Admins

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

The big one this week: Microsoft is retiring SMS and voice authentication in February 2027. Passkeys become the default authentication method starting September 1 this year. And if you still need SMS after the Feb cutoff? You’ll be paying a third-party telecom provider for it.

This changes the MFA rollout plan for pretty much every tenant. Nadim’s blog post below has the full timeline and how to prepare.

I’ll be sitting down with the Microsoft Entra PM behind this change to get your questions answered. Post yours here or upvote an existing one. The most popular and interesting ones make the cut.

Enjoy!

Sponsored by:

Transform hybrid management with a one-minute installation

Get EasyEntra

⚡️ Microsoft

🔥 Public Preview

• Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID • Nadim Abdo

📖 Read

• AI agents are everywhere. Are your access controls ready? • Kaitlin Murphy

• Defending SaaS-based applications against ShinyHunters OAuth abuse • Microsoft Defender Security Research Team

• Least privilege for AI agents: Identity, access, and tool binding • Yesenia Yser and Toby Kohlenberg

📺 Watch

• 📺 Microsoft Entra Suite hands-on tour of identity and network access protections • Microsoft Mechanics

🗣️ Message Center

• MC1243549 - Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B

• MC1426371 - Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

• RM522096 - Microsoft Purview: Integration with Entra GSA Internet Access to enable sensitive file filtering at the network layer

• RM558853 - Microsoft Teams: Entra passwordless resource account support for Teams Rooms on Windows devices

From the community…

🚀 Most popular posts from last week

• 🥇 Entra – Reminder to start migrating to Cloud Sync and Exchange writeback • Benoit HAMET

• 🥈 Why you Shouldn’t bypass MFA for your office IP adresses • Daniel Bradley

• 🥉Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect • Jan Bakker

Sponsored by:

Leaving Azure AD B2C? Build, buy, or switch?

The B2C migration forces a question every team eventually faces: build it yourself, follow the default to Entra External ID, or buy a platform that gives you both control and speed?

Before you commit, run the actual numbers. Building in-house isn’t free, it’s ~18-24 months to SOC 2 alone, plus the security and maintenance most teams underestimate.

FusionAuth gives you the control people build for — self-hosting, full customization, your own data — without the build cost:

• 🧮 3-year TCO calculator: build vs. SaaS vs. FusionAuth

• ✅ 5-question assessment to pressure-test your decision

See where you actually land.

Calculate your real auth cost

☀️ Learn

👩‍✈️ AI & Copilot

• Entra Agent Blueprints, from an Offensive perspective. • Derk van der Woude

⛑️ ID Protection

• Block High-risk Agents Using Identity Protection • PaVee

👮‍♂️ ID Governance

• Use the new Entra SOC Identity Responder Admin Role • Daniel Bradley

📦 Apps

• Stop Flying Blind, Take Two: A Brand New Entra ID App Report • Matej Klemenčič

🫆 Authentication

• Microsoft to Stop Providing Telephony-Based Authentication Methods for MFA in February 2027 • Tony Redmond

  • Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - A guide to stay calm • Jan Bakker

  • Microsoft Entra ID Will Retire SMS and Voice Authentication • Rudy Mens

  • Passkeys Become the Default Auth Method in Microsoft Entra • AIMA

  • Microsoft are set to retire SMS & Voice authentication methods • Daniel Bradley

• Managing FIDO2 keys with nothing but PowerShell • Dr. Emin Huseynov

• Reviewing the State of Non-USB FIDO2 Devices on Linux • Dr. Emin Huseynov

• Self-Service Password Reset (SSPR) will require registered authentication methods from September 7th • Benoit HAMET

🚦 Conditional Access

• 📺 Conditional Access, Break-Glass, Legacy Auth, & Named Locations: Entra ID it in Action! • Travis Roberts

🖥️ Devices

• Taking Back Control: Managing the New Entra SSO Prompt in Windows via Intune • Per Larsen

• The long awaited DMA-SSO Admin Controls! • Joey Verlinden

• AutoAcceptSsoPermission: The Continue to Sign In Prompt Fix • Rudy Ooms

• Admin control for SSO prompts in Windows; finally, an off switch! • Jan Bakker

• Entra – Administrators can now control SSO prompts in Windows • Benoit HAMET

• Automatically Accept SSO Permissions – Jóhannes’s blog • Johannes Geir Kristjansson

• Windows BYOD Is Awesome- Here’s Why and How • Colby Pryor

🏙️ External ID - Guests & Multi-Tenant Organizations

• Don’t Delete the Guest Account: Reset Redemption Status in Microsoft Entra • Sreejith Reghunathan Pillai

🥷 Security

• 📺 Why You Keep Getting Microsoft Sign-In Requests (and the Fix) • Dean Ellerby

♻️ Sync

• Entra Connect Sync 2.6.84 released • Andres Bohren

• Entra ID – New Entra ID Connect Sync version (2.6.84.0) is available • Benoit HAMET

📒 Tenant Configuration

• NameCodex.app: Because Every Tenant Deserves Better Names • Matej Klemenčič

• 📺 Azure Files - The Proper Setup Guide (No Active Directory) • Jonathan Edwards

• 📺 Microsoft Entra ID important Updates (Aug 2026) • Andy Malone

🛍️ External ID - Customers

• Analysing Azure AD B2C custom policies to aid with migration to Entra External ID (EEID) • Rory Braybrook

🔥 Maester

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Big week for me personally. I shared why I left Microsoft and what’s next: I’m now working full-time on Maester, and Maester Cloud is officially on the way.

If you want to learn more, start with the Maester Manifesto. It explains where this is all heading. Then join the waitlist, or better yet, become a Founding Sponsor and get early access when Maester Cloud launches.

Also, don’t miss this week’s Entra Chat with Katie Knowles. Her research into Agent ID is some of the most interesting I’ve seen, and she breaks down exactly what Microsoft admins need to know as they are onboarding agents into their orgs.

Enjoy!

Sponsored by:

Cloud PKI & RADIUS, Built for the Microsoft Ecosystem

Passwordless Wi-Fi, VPN, and device trust run on certificates + RADIUS, but AD CS and NPS struggle with Entra-only & cloud-first environments. EZCA and EZRADIUS by Keytos deliver both as a fully managed service.

• Native Entra ID & Intune integration for automated certificate management

• Extend or fully replace Microsoft Cloud PKI, AD CS, & NPS

• Integrates with 3^rd party MDM platforms like Jamf Pro & NinjaOne

• BYOD onboarding with Keytos Connect - no MDM or work profile required

• Available in Azure Government Cloud (GCC High)

• Free, fully-featured 30-day trial - no credit card required

Ready to modernize your PKI and RADIUS? See how Keytos fits your Microsoft environment.

Learn More

⚡️ Microsoft

🏆 General Availability

• External users can be directly assigned to Access Packages

• Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows

• BYOD support for Windows client using Entra registration

• Jailbreak/Root Detection in Authenticator App

• Domainless SAML IdP federation for workforce tenants

• SCIM 2.0 APIs for Microsoft Entra ID in US Gov cloud

• Microsoft Entra Backup and Recovery is now available

• Upcoming change - Improved restore experience for device-bound Authenticator app passkeys on iOS

🔥 Public Preview

• Extended Conditional Access protections for Agent’s user accounts

• New built-in Entra role for SOC identity response in Microsoft Defender

• Prevent unauthorized changes to AD groups with AD group enforcement

📖 Read

• Govern AI agent identities and access the same way you govern your employees • Chirag Dayani

• Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative • Salim Chawro

• 5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management • Microsoft Security Team

🗣️ Message Center

• MC1422061 - Microsoft Entra ID: Retirement of Custom Controls in Conditional Access and migration to External MFA

• MC1423108 - Microsoft Entra: Improved restore experience for Authenticator passkeys on iOS

• MC1418116 - Completed: Conditional Access enforcement update for policies with resource exclusions

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

Sponsored by:

The Identity Sync & Windows Workstation Migrations Solution

ADMT unsupported. MIM nearing end of life. It’s time to modernise your migration approach.

With PowerSyncPro successfully deliver identity and device migrations designed for modern Microsoft environments with confidence and reducing TCO.

✔ DirSync - Synchronise users, groups, contacts and passwords across environments to support coexistence, staged migrations and complex identity scenarios.
✔ Migration Agent - Move Windows devices between AD Joined, Hybrid and Entra Joined states while reducing disruption and preserving the end-user experience.

Built for delivering enterprise migrations at scale.

See PowerSyncPro in action

From the community…

🚀 Most popular posts from last week

• 🥇 A New Face for Risky User Management in Microsoft Entra • Colby Pryor

• 🥈 How To Enable And Roll Out Microsoft Authenticator Passkeys In Microsoft Entra ID: A Step-by-Step Guide • Charbel Nemnom

☀️ Learn

👩‍✈️ AI & Copilot

• EntraPulse Polyarchy - an Entra ID Polyarchy MCP Server - darrenjrobinson • Darren Robinson

ID Governance

• KB - employeeLeaveDateTime show empty (null) • Jan Bakker

📦 Apps

• Using “Entra Local” with the MSAL libraries | by Rory Braybrook | The new control plane | Jul, 2026 • Rory Braybrook

🫆 Authentication

• Microsoft Entra ID Retires Custom Controls For External MFA • Daniel Bradley

• Using “Entra Local” with device code flow | by Rory Braybrook | The new control plane | Jul, 2026 • Rory Braybrook

• Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect • Jan Bakker

• Does anyone even use GitHub for federated authentication? • Sapir Federovsky

👥 User & Group Management

• Groups: The Connective Tissue of Microsoft 365 • Jonathan Hope

🤖 DevOps & PowerShell

• Use M365Mutator to Make Microsoft 365 Test Data Less Boring • Tony Redmond

• How to Report Managers and Direct Reports from Entra ID • Tony Redmond

🚦 Conditional Access

• Conditional Access Optimization Agent | Security Copilot | Entra ID • Michael Frank

• Why you Shouldn’t bypass MFA for your office IP adresses • Daniel Bradley

• 📺 Master Conditional Access in Entra ID: Assignments, Conditions, Controls! • Travis Roberts

🥷 Security

• Entra Agent ID: Protect, detect, respond • Katie Knowles

• Entra ID User App Config Abuse • Elli Shlomo

• How the Microsoft Baseline Security Mode Left Ghost Policies in Entra ID • Michael Morten Sonne

• DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation • ZeroBEC Team

♻️ Sync

• Entra – Reminder to start migrating to Cloud Sync and Exchange writeback • Benoit HAMET

• Troubleshooting Entra Connect permissions sync errors • Aaron Guilmette

🔥 Maester

• Announcing Maester Cloud

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra.Chat, Merill speaks with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Katie explains the blueprint, blueprint principal, agent identity, and agent-user relationships before walking through a cross-tenant compromise demonstration: compromised blueprint credentials, enumeration of associated agents, token requests in trusting tenants, permission inspection, and selection of a useful target identity.

That path does not automatically grant Global Administrator access. Its impact depends on what the target agent identity has been permitted to do. The important lesson is the control point: one blueprint can sit upstream of many identities, tenants, and permission sets.

Katie and Merill also discuss tenant-owned versus vendor-owned blueprints, the Agent ID Administrator role, first-party agent creation through Microsoft platforms, why production client secrets compound the blast radius, workload identity federation, separating blueprints by risk, reusing app-registration detections, and Microsoft Entra ID Protection for agents.

REGISTER: Hidden Risk of App Permissions in Entra ID

Many Microsoft Entra ID environments contain third-party and custom applications with permissions that are broader than necessary, and most organizations lack visibility into how those permissions are being used. Excessive Microsoft Graph permissions and unused access increase the risk of OAuth abuse and privilege escalation.

Join our live session on July 22 to learn how to:

• Evaluate delegated versus application permissions

• Build an effective app governance strategy

• Reduce unnecessary access without disrupting users

You’ll also see how a free AppGov Score assessment can help identify governance gaps and where unused permissions reporting fit into a least-privilege approach.

Save my Seat

Subscribe with your favorite podcast player or watch on YouTube

About Katie Knowles

Katie Knowles is a Senior Security Researcher at Datadog focused on Azure security research, cloud identity, and securing emerging technologies.

• LinkedIn - https://linkedin.com/in/kaknowles

• X/Twitter - https://twitter.com/_sigil

• GitHub - https://github.com/siigil

• Website - https://kknowl.es/

• Microsoft MVP profile - https://mvp.microsoft.com/en-US/MVP/profile/a3547b6a-6a4d-4aa0-840f-23b858c43c8b

Related Links

• Entra Agent ID: The blueprint blast radius (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-blueprint-blast-radius/

• Entra Agent ID: Inside a cross-tenant agent compromise (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-inside-agent-compromise/

• Entra Agent ID: Protect, detect, respond (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-protect-detect-respond/

• Disable agent identities in your tenant (mentioned at 04:00 and 49:33) - https://learn.microsoft.com/entra/agent-id/disable-agent-identities

• Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account (mentioned at 05:14) - https://redcanary.com/blog/threat-detection/entra-id-ai-workflows-teams/

• Entra Agent ID from a Security Perspective (mentioned at 20:38) - https://blog.compass-security.com/2026/06/entra-agent-id-from-a-security-perspective/

• Spying On Your ISVs Credential Choices (mentioned at 38:11) - https://ericonidentity.com/2025/01/13/spying-on-your-isvs-credential-choices/

• Who Are the Robots? Uncovering AI Agents Identities (mentioned at 51:39) - https://www.youtube.com/watch?v=mMxACHKIAwY

• AzTier (mentioned at 51:39) - https://aztier.com/

• Microsoft Entra Agent ID key concepts - https://learn.microsoft.com/entra/agent-id/key-concepts

• Workload identity federation - https://learn.microsoft.com/entra/workload-id/workload-identity-federation

• ID Protection for agents - https://learn.microsoft.com/entra/id-protection/concept-risky-agents

Related Entra.Chat Episodes

• If You Manage Entra Permissions, Watch This Before Deploying Agents - https://entra.news/p/if-you-manage-entra-permissions-watch

• From Windows Core to Leading Agent ID: Vince Smith’s Microsoft Story - https://entra.news/p/from-windows-core-to-leading-agent

• Attackers Are Targeting the AI Ecosystem You Cannot See - https://entra.news/p/attackers-are-targeting-the-ai-ecosystem

Chapters

00:00 Intro

01:12 Katie’s Three-Part Agent ID Research

05:40 Agent ID Objects Under the Hood

06:24 One Blueprint, Many Agent Identities

08:43 The Multitenant Trust Boundary

17:33 Cross-Tenant Compromise Walkthrough

28:29 First-Party and Third-Party Blueprints

36:56 Stop Using Client Secrets

38:40 Workload Identity Federation

46:24 Permissions and Privilege Boundaries

49:33 Detecting and Responding to Agent Abuse 51:29 What Comes Next for Agent ID

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Some cool new features dropped this week and we also have Entra Backup and Recovery going GA.

Plus don’t forget to check out this week’s podcast. It’s a fascinating discussion with Thomas Roccia on AI threat intelligence and AI agent security.

Enjoy!

Sponsored by:

OneDrive Delegation Without the Time Travel

Granting OneDrive access with Microsoft’s native tools means clicking from the M365 Admin Center into SharePoint Admin, digging under “More features” → “User Profiles”, and landing in a portal whose UI hasn’t changed since 2010 - minutes of hunting for a one-second setting.

EasyEntra brings OneDrive management back to the future:

☁ Delegate OneDrive access in seconds - no portal maze
☁ Works for hybrid and cloud-only accounts alike
☁ No SharePoint Admin Center, no classic User Profiles detour
☁ Available directly in user properties with instant loading
☁ Free to use for smaller tenants - no license required

One place, one click, zero detours - download EasyEntra and never open the classic SharePoint portal again.

“This is the best software ever.”
CIO, Care Alliance Health Center, United States

Download EasyEntra

⚡️ Microsoft

🏆 General Availability

• Microsoft Entra Backup and Recovery is now generally available • Cindy Crane

🔥 Public Preview

• Bring business logic into PIM role activation workflows • Kaitlin Murphy

• Protect sensitive data in motion across SaaS and AI apps with Microsoft Purview and Microsoft Entra • Sule Tatar

📖 Read

• Securing AI agents: When AI tools move from reading to acting • Microsoft Incident Response

• ​​What’s new in Microsoft Security: June 2026 • Alym Rayani

• Improving security posture across the Microsoft partner ecosystem • Raji Dani

🗣️ Message Center

• MC12825068 - General Availability: Microsoft Entra passkeys on Windows (Updated)

• MC1409305 - Microsoft Entra: Blocking new assignments to partner tier support roles

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

• RM566869 - Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

Sponsored by:

Move beyond legacy identity and Windows migration approaches.

PowerSyncPro helps organisations modernise with a cloud-native approach to identity synchronisation and Windows migration, supporting transitions across AD, Entra ID, Microsoft 365 and hybrid environments without unnecessary disruption.

• Support big bang, phased and self-service migrations

• Move devices to Entra Join while retaining user experience

• Reduce manual effort and migration complexity

• Drastically reduce support burden in migration projects

• Operational dashboards track migrations in near real time

• Full logging capability automatically available for all migrating devices

• Supports commercial cloud, GCC, GCC High & 21 Vianet

Not sure where to begin? Start with our Getting Started Guide [https://powersyncpro.com/getting-start-migration-agent?utm_source=entra_news&utm_medium=email&utm_campaign=entra_july6] and explore the Architecture Advisor [https://powersyncpro.com/architecture-advisor?utm_source=entra_news&utm_medium=email&utm_campaign=entra_july6] to plan your migration path.

Book a demo

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Entra Connect Sync – Passwordless Authentication – now supported! • Michael Morten Sonne

• 🥈 Your iPhone Can Manage Passkeys on a YubiKey. Yubico’s Own App Just Won’t Let It • Dr. Emin Huseynov

• 🥉 Bypassing Conditional Access policies that have a resource exclusion • Dirk-jan Mollema

☀️ Learn

👩‍✈️ AI & Copilot

• Security Copilot • Michael Frank

• EntraPulse: Tenant Profiles, Lokka 2.0 Interactive Apps, and Microsoft Enterprise MCP - darrenjrobinson • Darren Robinson

• 📺 Episode 431: Agent Governance Is the New App Governance • Microsoft Cloud IT Pro Podcast

🧰 Workload ID

• Monitoring Microsoft Entra Application Secrets Across Multiple Tenants with Azure Automation • Dominic Eames

• Authenticating AWS Workloads to Azure Functions using Workload Identity Federation • Kasturi

• 🎙️ Ctrl+Alt+Azure | 349 - Back to basics: Managed identities vs. Service Principals vs. App Registrations • Jussi Roine and Tobias Zimmergren

• Cross Tenant Microsoft Graph Access Using Federated Identity Credential • Brian Veldman

⛑️ ID Protection

• A New Face for Risky User Management in Microsoft Entra • Colby Pryor

👮‍♂️ ID Governance

• Microsoft Purview Adds Native Role Assignment Time Limits • Daniel Bradley

• How to use Azure Functions to run PowerShell scripts in Entra ID Governance • Christian Frohn

🌐 Private Access & Internet Access (GSA)

• Entra ID – You can now use your own device (BYOD) with global secure access to connect to private access profile • Benoit HAMET

• RM566528 - Microsoft Purview: Data Loss Prevention - Extend Purview data security to the network layer via Entra GSA integration

🫆 Authentication

• Microsoft Entra ID SSPR Will Require Registered Authentication Methods • Rudy Mens

• How To Enable And Roll Out Microsoft Authenticator Passkeys In Microsoft Entra ID: A Step-by-Step Guide - CHARBEL NEMNOM - MVP | MCT | CCSP • Charbel Nemnom

• 📺 Passwords Alone DON’T WORK! Secure M365/Azure with Entra ID MFA! • Travis Roberts

• 📺 The Passwordless Trap: Why Passkeys Break Entra ID SSPR! • Azure Brother

🥷 Security

• I didn’t REALLY understand FOCI & BroCI… until now (Kinda) • Sapir Federovsky

• 📺 90% of MSPs Handle Admin Access The Wrong Way (Fix It!) • Jonathan Edwards

• 📺 Secure containers from code to runtime • Microsoft Mechanics

• 📺 Zero Trust security for AI agents • Microsoft Mechanics

📒 Tenant Configuration

• Microsoft Entra Backup and Recovery and How to Use It • Mark Oldham

• Add some BAESL to your M365 Sandbox! • Colby Pryor

• Microsoft 365 Business Standard vs Premium (2026 Update) • Rudy Mens

🛍️ External ID - Customers

• Getting a checklist before Azure AD B2C migration using EntraExporter • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

It is also about attackers targeting the agent ecosystem most organizations cannot see clearly yet: MCP servers, agent skills, packages, API keys, prompts, tools, and the identity layer underneath all of it.

In this episode, I sit down with , founder of Security Break and a former Microsoft threat researcher, to look at AI agents from the threat-intelligence side. Thomas explains why the easiest path for attackers may not be futuristic autonomous hacking. It may be the boring weak spots that already exist: malicious packages, untrusted MCP servers, hostile agent skills, leaked API keys, and AI-generated code that chooses the fastest path instead of the safest one.

For Entra admins and security teams, this is where Agent ID, non-human identity, workload identity, logging, sponsorship, and governance start to matter. Entra Agent ID gives teams a way to identify and govern agents, but identity is only one part of the picture. You still need to understand what agents can discover, what tools they can call, what context they consume, and whether you can replay what they actually did.

Thomas also breaks down his practical AI threat-intelligence work, including how teams can use agents for CTI, how adversarial prompts and context flooding change the risk model, and why defenders need to understand the attacker side of agent security before these systems become invisible production infrastructure.

Sponsored by

Secure BYOD Wi‑Fi Without MDM enrollment

Keytos Connect is a new mobile and desktop app that makes it easy for users to connect personal and BYOD devices to enterprise and campus Wi‑Fi without shared passwords, manual certificate installs, or traditional MDM enrollment. Users simply download the app, sign in with their work or school account, and Keytos handles the rest. It also works alongside Intune, allowing organizations to continue managing corporate-owned devices while simplifying connectivity for personal devices.

• Connect in minutes: users download the app, sign in, and get securely onboarded to Wi‑Fi

• No MDM required: enable secure access for personal devices without giving IT full control of them

• Works alongside Intune: keep your existing management workflows for corporate devices while enabling secure BYOD access

• Automatic certificate management: certificate issuance and renewal happen behind the scenes

• Secure by default: EAP-TLS authentication eliminates shared Wi‑Fi passwords and provides unique credentials for every user

• Multi-OS: Available across iOS, Android, Windows, and macOS devices

• Included at no additional cost with existing EZRADIUS and EZCA subscriptions

Learn more about Keytos Connect and see how easy secure BYOD connectivity can be.

Learn more about Keytos Connect

About Thomas Roccia

Thomas Roccia is a threat researcher and founder of SecurityBreak, focused on AI threat intelligence, malware analysis, and AI agent security. He previously worked in incident response, malware analysis, threat intelligence, Microsoft Defender, and AI threat research. He is also the author of Visual Threat Intelligence and teaches practical AI for threat intelligence and agentic workflows.

LinkedIn - https://au.linkedin.com/in/thomas-roccia

Subscribe with your favorite podcast player or watch on YouTube 👇

Related Links

• Thomas Roccia on LinkedIn - https://au.linkedin.com/in/thomas-roccia

• SecurityBreak - https://securitybreak.io/

• Practical AI for Threat Intelligence training - https://securitybreak.io/training-genai

• SHIELD.md: A Security Standard for OpenClaw and AI Agents - https://blog.securitybreak.io/shield-md-a-security-standard-for-openclaw-and-ai-agents-b38637031460

• Microsoft Entra Agent ID - https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id

• Microsoft Entra Agent ID key concepts - https://learn.microsoft.com/en-us/entra/agent-id/key-concepts

• Agentic Resource Discovery specification - https://agenticresourcediscovery.org/

• GitHub Agent Finder - https://github.blog/changelog/2026-06-17-agent-finder-for-github-copilot-now-available/

Chapters

00:00 Intro

00:33 Meet Thomas Roccia

01:48 From Malware Analysis to AI Threat Intel

03:30 Why AI Security Is Moving So Fast

05:49 Agentic Resource Discovery and New Standards

09:25 Attackers Are Already Using AI Agents

11:47 The AI Ecosystem Is The Target

15:26 Prompt Injection, MCP, Skills, and API Keys

20:28 Vibe Coding vs Production Security

23:47 Agent ID and Identity for AI Agents

32:30 Practical AI for Threat Intelligence

39:13 Monitoring Agents Like Threat Actors Do

42:28 Context Flooding and What’s Next

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

We are light on news from Microsoft but there are some excellent posts from the community this week especially around security including Dirk-jan and more.

Enjoy!

Sponsored by:

Announcing Hacker Summer 2026

Altered Security HackerSummer is a month-long Red Teaming event designed for red teamers, security professionals and enthusiasts. Throughout the month we will share resources to understand, practice and analyze Red Team techniques and tactics for on-prem, Azure and AI.

What to expect during the month:

• Five Free Red Team Webinars with hands-on labs (July 4th, 11th, 17th, 24th and 31st).

• Flat 20% OFF on all On-Demand Courses and Bootcamps - 20th July to 5th Aug 2026

• A chance to present your research in front of peers by responding to the Call for Papers.

Get ready for a month full of red team research, webinars, blog posts, giveaways and discounts!

Know More

⚡️ Microsoft

📖 Read

• Secure AI at scale: Join the Microsoft Entra + Purview webinar series • Diana Vicezar

📺 Watch

• 📺 Strengthen your security posture with Microsoft Entra Conditional Access • Swaroop Krishnamurthy

• 📺 AI-Powered Identity Security and Live Demos of Security Copilot in Microsoft Entra • Luca Spolidoro and Mamta Kumar

🗣️ Message Center

• MC1400649 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions

• MC1325414 - Microsoft Entra ID SSPR will require registered authentication methods starting September 7, 2026

• MC1400824 - Microsoft Entra: Self-service password reset CAPTCHA protection updated

Sponsored by:

How Mature Is Your Microsoft Governance?

Do you know where your biggest Microsoft 365 governance and Entra ID application risks are in your tenants? How exposed is your organization and its data?

ENow has TWO free Microsoft governance assessments:

1. One benchmarks your Microsoft 365 governance posture across SharePoint, OneDrive, and Teams workloads

2. The second uncovers unknown and overlooked application governance risks across Microsoft Entra ID.

No cost. Just actionable insights you can share with your team in minutes.

Get My Free Scores

From the community…

☀️ Learn

👩‍✈️ AI & Copilot

• 📺 Agent ID in Microsoft Entra: Securing the Identity of AI Agents • Microsoft Security Community and Vijaya Lakshmi Nukula

📦 Apps

• Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA • Jan Bakker

🫆 Authentication

• Your iPhone Can Manage Passkeys on a YubiKey. Yubico’s Own App Just Won’t Let It • Dr. Emin Huseynov

🤖 DevOps & PowerShell

• Using Graph Delta Queries with Entra ID Groups • Tony Redmond

🚦 Conditional Access

• 📺 New Entra ID Conditional Access Features June 2026 • Andy Malone

🥷 Security

• Bypassing Conditional Access policies that have a resource exclusion • Dirk-jan Mollema

• Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication • Thomas Byrne

• Zero Trust - Data as the Trust Boundary • Guillaume Bossiroy

• Secure And Monitor Your Microsoft Copilot Studio AI Agents Real Time • Michael Vink

• From ESTS Cookie Replay to Inbox Persistence • Elli Shlomo

• Azure AD Graph Activity Logs: detecting directory enumeration • Terrance DeJesus

♻️ Sync

• Microsoft Entra Connect Sync – Passwordless Authentication – now supported! • Michael Morten Sonne

• Sync and seek: User matching in tenant migrations • Per-Torben Sorensen

🛍️ External ID - Customers

• Migrating from Azure AD B2C to Microsoft Entra External ID: Applications, Authentication Methods, Branding and Users (Part 1) • Mateusz Jendza

• Azure AD B2C to Entra External ID (EEID) migration tools • Rory Braybrook

⚒️ Toolkit

• 🛠️ GitHub - cmaneu/entra-local: A local Entra ID emulator for application developers that need to mock authentication • Christopher Maneu

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra Chat, Vince (the PM lead driving Microsoft Entra Agent ID) walks us back through a 25-year run at Microsoft: shipping beta products off a machine wired straight to the internet under a neighbor’s desk, owning the early RBAC and custom roles work that shaped Entra, surviving a couple of security incidents he mostly can’t talk about, and finally landing on the team building identity for AI agents.

Along the way he owns up to the one feature name he’d take back if he could, and shares the dead-simple trick he used as a junior dev to get senior engineers to answer his questions every single time.

But this isn’t just a war-stories episode. Vince breaks down why agents needed a brand-new kind of identity in the first place. An agent is a strange beast ‘as clumsy and unpredictable as a human, and as fast as a machine’ which means traditional anomaly detection looks at one and basically can’t tell if it’s a user or a workload gone rogue. His answer is the blueprint-and-instance model: one blueprint (think app registration) spinning up many scoped, least-privilege instances, instead of a bazillion app registrations or one over-permissioned service principal that can read everyone’s mailbox. And if you’re wondering why this matters now, Vince makes the case that as users move to passkeys, attackers just slide to the other end of the balloon: non-human identities and workloads. That’s the new frontier.

So what should you actually do Monday morning? His advice is refreshingly un-precious: don’t wait for the perfect plan. Start green, set a standard for every new agent so you stop the bleeding from shadow AI, then stay green and slowly get green by cleaning up the mess behind you. Even just stamping a unique identifier on your agents today buys you the observability you’ll desperately want later.

Be the river that flows around the rocks.

There’s a lot more in the full conversation including how Agent ID and Agent 365 actually fit together, and how Vince came up to speed on a space that’s moving too fast to write a book about. Give it a watch.

About Vince Smith

Vince Smith is the PM Lead for Agent ID at Microsoft. A self-described computer nerd and Gen Xer, Vince has been with Microsoft since late 1999, working on everything from Windows Core and GDPR to multi-tenant collaboration and identity protection.

LinkedIn - https://www.linkedin.com/in/vincecsmith/

🔗 Related Links

• Entra Agent ID - https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id

• Agent 365 - https://www.microsoft.com/en-us/microsoft-agent-365

📗 Chapters

06:23 Provisioning vs. Federation

10:25 The Need for Agent ID

17:28 Blueprints and Multi-Instancing

23:55 Demystifying Agent 365

26:56 The Threat of Non-Human Identities (NHI)

33:08 Planning Your Enterprise AI Strategy

36:14 Defining a “Start Green” AI Plan

40:45 The Best Way to Learn Complex Tech

45:13 The Wild World of CIAM

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

In today’s issue Jonathan Hope asks the uncomfortable question of who exactly you’ve let in as a guest, Katie Knowles walks through a real cross-tenant agent compromise, and Sebastian Flaeng Markdanner breaks down how to pick the right extension type so you’re not bolting things on the wrong way.

There’s cleanup material too. Sandra Saluti’s excellent naming-standard piece could finally make your tenant readable, Conditional Access starts processing baseline scopes, and SSPR tightens up in September. A little housekeeping now beats an incident write-up later. 🧹

Plus don’t miss this week’s Entra Chat. Erica Zelick joins us with sharp, practical tips for securing the non-human identities hiding across your tenant.

Enjoy!

Sponsored by:

OneDrive Delegation Without the Time Travel

Granting OneDrive access with Microsoft’s native tools means clicking from the M365 Admin Center into SharePoint Admin, digging under “More features” → “User Profiles”, and landing in a portal whose UI hasn’t changed since 2010 - minutes of hunting for a one-second setting.

EasyEntra brings OneDrive management back to the future:

☁ Delegate OneDrive access in seconds - no portal maze
☁ Works for hybrid and cloud-only accounts alike
☁ No SharePoint Admin Center, no classic User Profiles detour
☁ Available directly in user properties with instant loading
☁ Free to use for smaller tenants - no license required

One place, one click, zero detours - download EasyEntra and never open the classic SharePoint portal again.

“This is the best software ever.”
CIO, Care Alliance Health Center, United States

Download EasyEntra

⚡️ Microsoft

🔥 Public Preview

• AI is accelerating cyberattacks—here’s how to stay ahead • Sandeep Deo

🗣️ Message Center

• MC1395007 - Microsoft Entra: New service plans for Conditional Access and ID Protection for agents

• MC1179154 - Updated - Microsoft Authenticator app: Upcoming changes to jailbreak and root detection

• MC1243549 - Updated - Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B

From the community…

🚀 Most popular posts from last week

• 🥇Stop wasting time and use Custom Extensions for PIM approvals • Daniel Bradley

• 🥈Entra Agent ID from a Security Perspective • Christian Feuchter

• 🥉Applying Sensitivity Labels to Groups In Entra • Colby Pryor

Sponosored by:

PowerSyncPro 3.3 is now generally available!

Organisations operating in Microsoft 365 21Vianet, GCC and GCC High environments can now benefit from our trusted Windows Migration Agent and Directory Synchronisation tools.

ü Support for 21Vianet, GCC & GCC High

ü Syncs users, groups, and contacts across AD, Entra ID, and Google Workspace

ü Handles complex AD ↔ Entra ID workstation migrations

ü Entra ID extension attribute support (1–15)

ü Microsoft-signed password filter integration

Whether you’re managing complex coexistence, workstation migrations, or identity transformations, PowerSyncPro provides more control for you and less disruption for your end user.

Find out more:

☀️ Learn

👩‍✈️ AI & Copilot

• Microsoft Agent 365 License Enforcement — July 1, 2026 Security Impact Summary • Derk van der Woude

• Service Plans for Agent Conditional Access and Identity Protection • Blesslin Rinu

• 📺 Connect Declarative Agent to OAuth-Protected MCP Server • Paolo Pialorsi

🧰 Workload ID

• Why graph matters for workload identity hunting in Microsoft Sentinel • David Alonso Dominguez

• Using Microsoft Entra ID Workload Identity Federation (WIF) to Deploy from GitHub Actions to Azure • Jaliya Udagedara

⛑️ ID Protection

• 📺 Stop identity attacks in real time with Microsoft Entra ID Protection • Jared Ross

👮‍♂️ ID Governance

• Custom Account Correlation Rules in Microsoft Defender • Shanchana

🌐 Private Access & Internet Access (GSA)

• Entra Internet Access TLS Inspection Fails with ERR_CERT_INVALID • Richard Hicks

• What’s New in Entra Private Network Connector v1.5.4892.0 | Richard M. Hicks Consulting, Inc. • Richard Hicks

• Entra Global Secure Access❤️ External User Access • Brian Veldman

🫆 Authentication

• Entra Passkey Registration Campaign • Jay Kerai

• Microsoft Tightens SSPR Security in September 2026 • Tony Redmond

🚦 Conditional Access

• Baseline Scopes Will Now Be Processed by Conditional Access • Tony Redmond

• How to Enable Baseline Scope Settings in Conditional Access • Daniel Bradley

🖥️ Devices

• 📺 Azure Files Identity Update • John Savill’s Technical Training

• 📺 How to Setup Intune App Protection Policies, Without Enrollment • Get Rubix

🏙️ External ID - Guests & Multi-Tenant Organizations

• Who Did You Let Into Your House? • Jonathan Hope

🥷 Security

• Entra Agent ID: Inside a cross-tenant agent compromise • Katie Knowles

• Choosing the Right Extension Type in Microsoft Entra • Sebastian Flaeng Markdanner

📒 Tenant Configuration

• One Person One License philosophy for Microsoft Entra Update • Daniel Bradley

• Naming Entra ID so it actually makes sense • Sandra Saluti

• Calculating the Monthly License Increase for a M365 Tenant • Tony Redmond

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

What we get into:

• Application vs. delegated API permissions and why both can be shadow admins

• The most dangerous permissions to hunt for: Files.ReadWrite.All, Sites.FullControl.All and more.

• How Midnight Blizzard turned secrets buried in email into full tenant compromise

• Credential and secret sprawl why you should vault everything and move to managed identities

• Agent identities explained, and why a “sponsor” is safer than an “owner”

• App ownership as an attack path: lateral movement and privilege escalation

• Locking down workload identities with conditional access

• Deadlines that bite: EWS retirement and the ID CRL protocol retirement

• Managed devices, and going from Zero Trust to “hero trust” without burying your help desk

Sponsored by:

Avoiding Entra Credential Outages & Security Risks
June 24 | Live Webinar | Register

An expired client secret or certificate can break SSO, automation, integrations, and business-critical applications without warning.

Do you know:

✔️ Which credentials have already expired?

✔️ Which applications depend on them?
✔️Which credentials will expire next?
✔️Who owns those applications, and are they still used?

Which applications should use Managed Identities instead of secrets?

As organizations deploy more apps, automations, and AI-powered services, credential sprawl continues to grow across Entra. Join MVPs Alistair Pugin and Nicolas Blank as they walk through real-world credential failures, hidden risks, and practical strategies for identifying and remediating Entra credential issues before they lead to outages, security exposures, or audit findings.

Save My Seat

About Erika Zelic

Erika Zelic is a well-known voice in the Microsoft security and identity community, bringing years of offensive security experience to help admins secure their cloud infrastructure.

With roots in offensive security and consulting, she now works on remediating configuration-based vulnerabilities and is known for sharing practical, no-nonsense security insights with the Entra community.

LinkedIn - https://www.linkedin.com/in/erica-z-b4169598/

🔗 Related Links

• MS Identity Tools - https://aka.ms/msid

📗 Chapters

• 02:05 The High Cost of DIY AI & Small Language Models

• 06:17 Why AI is Forcing Everyone to Harden Their Infrastructure

• 14:12 The Hidden Dangers of API Permissions

• 20:59 How Midnight Blizzard Exploited App Secrets

• 27:21 The Magic of Managed Identities & Azure Arc

• 33:38 The Nightmare of Multiple App Owners

• 43:32 Sneaky API Permissions You Need to Monitor

• 51:48 Crucial Protocol Retirements: EWS & ID CRL

• 55:24 Zero Trust: Why You MUST Enforce Managed Devices

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

We’ve got some great updates this week! PIM has some cool improvements landing, and there are two important changes to be aware of: Conditional Access will now be enforced consistently during credential registration, and SSPR will require explicitly registered authentication methods going forward.

I also released Lokka 2.0 check out the video below for a full walkthrough.

On this week’s Entra Chat, we had a very special guest: Nikhil Boreddy, Group Engineering Manager on the Entra team. He shared some fascinating insights into securing AI agents in Entra — well worth a listen! 👇

Enjoy!

Sponsored by:

Would you bet your reputation on your current Microsoft 365 security posture?

Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

You could assume it’s fine.

Or you could run the Microsoft 365 Security Posture Check.

It’s free.

It runs locally.

And no, it doesn’t send your tenant data back to us.

We’ll even help you set it up.

Get yours here

⚡️ Microsoft

🏆 General Availability

• 📺 Agent 365 | Identity & Access Controls in Entra • Vince Smith

🔥 Public Preview

• Configure custom extensions for Privileged Identity Management role activation (Preview)

• Tools for Azure AD B2C migration now available • Namita Singh

📖 Read

• Microsoft Entra ID security updates: What organizations need to do now • Swaroop Krishnamurthy

📺 Watch

• 📺 🔐 Microsoft Entra Backup and Recovery Explained | Restore Directory Objects • Ben Athawes

Sponsored by:

Webinar: Tame Credential Chaos in Microsoft Entra ID

Think your Microsoft Entra ID app credentials are under control? Expired client secrets and certificates often prove otherwise, breaking SSO at the worst possible moment. Meanwhile, long-lived and forgotten credentials can quietly linger in your tenant, creating unnecessary security and governance risks.

Join Microsoft MVPs Alistair Pugin and Nicolas Blank on June 24^th as they dig into this underestimated area of Entra ID governance: application credential management. You’ll learn:

• How to uncover expired, expiring, and risky credentials

• How to understand their impact on business continuity

• How to apply practical governance strategies, including the shift to Managed Identities.

Plus, get access to resources that help you quickly identify and remove risks. Register today!

Register Now

From the community…

🚀 Most popular posts from last week

• 🥇Stop Applying Sign-In Frequency to All Users. Use Authentication Contexts for Step-Up MFA • Rawson Wade

• 🥈The Privileged Roles Nobody Talks About • Carlos Perez

• 🥉System-Preferred Authentication is Coming to the First-Factor Login Screen • Daniel Bradley

☀️ Learn

👩‍✈️ AI & Copilot

• Entra Agent ID from a Security Perspective • Christian Feuchter

🧰 Workload ID

• Workload Identities: The New Attack Surface in M365 • Karthi

• Jaliya’s Blog: Connecting to Azure DocumentDB (with MongoDB compatibility) using Microsoft Entra ID Managed Identity • Jaliya Udagedara

• 🛠️ Managed Identity Permission Manager v1.1.0.5 is here! • Michael Morten Sonne

👮‍♂️ ID Governance

• Stop wasting time and use Custom Extensions for PIM approvals • Daniel Bradley

🫆 Authentication

• Passkeys: Security Only Works If People Use It • Jonathan Hope

• SSPR Verification Requires Registered Authentication Methods • Shanchana

• I.D.E.A #004 – MFA, you say? • Per-Torben Sorensen

• 📺 Entra Passkey Registration Campaign • John Savill’s Technical Training

• 📺 Nobody Registers Passkeys... Until You Do This | Entra ID Registration Campaigns • Azure Brother

👥 User & Group Management

• Applying Sensitivity Labels to Groups In Entra • Colby Pryor

🤖 DevOps & PowerShell

• Find Inactive Accounts with PowerShell • Tony Redmond

🖥️ Devices

• Microsoft Entra - Soft Delete Devices (Preview) • Flavio Meyer

• Secure Device Registration in Microsoft Entra and Microsoft Intune • Oliver Mueller

• Detecting device code phishing attacks in Azure • Roni Hassidim

🏙️ External ID - Guests & Multi-Tenant Organizations

• How to Stop Guests From Inviting More Guests in Microsoft Entra • Daniel Bradley

• Entra – Do not delete your cross-tenant synced group before you do this • Benoit HAMET

🥷 Security

• Entra Agent ID: The blueprint blast radius • Katie Knowles

• Automating Entra ID Tenant Destruction with AI • Huy KHA

• 🛠️ GitHub - ar0x4/tunnel-vision-toolkit • Arshia Reisi

📒 Tenant Configuration

• Microsoft 365 Business Premium - Day 1 • Keith Doolan

• 📺 5 Microsoft Entra ID Updates You Need to Know – June 2026 • Andy Malone

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

We get into why “security = MFA” is dead, why the only recommended Conditional Access control for agents today is block (and why that’s actually good for your users), the missing “challenge” state in agent access, indirect prompt injection, and the unified risk model spanning identity, endpoint, and data layers. If you manage Microsoft Entra ID, run Zero Trust, or are figuring out how to govern AI agents in your tenant, this one’s for you.

🔎 What you’ll learn:

• Why agents are the new insider threat and why latency no longer protects you

• How Conditional Access now targets agentic users and agents

• Why “block” is the default control for agents (allow / block / challenge explained)

• How unified risk works across Entra, Microsoft Defender & Microsoft Purview

• Continuous Access Evaluation interrupting in-motion agent sessions

• Why LLMs recommend insecure defaults (the device code flow problem)

• The Conditional Access optimization agent, report-only mode & phased rollout

• The #1 thing Entra admins and CISOs should do in the next 3–6 months

About Nikhil

Nikhil Boreddy has spent over a decade at Microsoft, from the early Authentication Stack and Identity Protection team to the birth of Conditional Access. Today he works across Entra and Microsoft Security on one of the toughest challenges in the field: securing AI agents in the enterprise.

LinkedIn - https://www.linkedin.com/in/nikhilboreddy/

🔗 Related Links

• Microsoft Entra - https://learn.microsoft.com/en-us/entra/id-protection/concept-risky-agents

• Microsoft Zero Trust - https://aka.ms/ztworkshop

📗 Chapters

00:01:49 The Shift from MFA to Zero Trust

00:02:43 The Rise of AI Agents in Enterprise Security

00:04:40 Vulnerabilities in AI Workflows

00:08:09 Microsoft Security and Agent ID

00:10:41 Using the Conditional Access Optimization Agent

00:11:44 Breaking Silos: Entra, Purview, and Defender

00:20:01 Expanding Conditional Access for Agentic Users

00:26:36 Why Block is the Recommended Control for Agents

00:33:38 The Power of the Microsoft Security Stack

00:38:31 Advice for CISOs: Embracing AI in Security

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

There are lots of new updates this week, thanks to the announcements from Build. Martin Coetzer has put together a really good summary, so make sure you check it out.

This week’s Entra Chat episode was slightly different from our usual programming. Christina Morillo joined us to share career tips, and the reviews and comments speak for themselves. Don’t forget to add Entra Chat to your weekly podcast queue.

Forward this episode to everyone on your helpdesk teams to inspire them.

P.S. Great timing too. Check out our sponsor, EasyEntra, for their awesome tooling for helpdesk teams.

Enjoy!

Sponsored by:

PST Export in One Line of PowerShell (FREE)

Exporting an Exchange Online mailbox to PST traditionally means wrestling with eDiscovery exports, installing Outlook, or paying for third-party tools - hours of work for what should take one command.

EasyEntra’s Invoke-EEMailboxToPst handles the entire export in a single line:

🚀 Export any mailbox to PST with one CmdLet
🚀 Real-time progress reporting and minimal memory burn
🚀 Native PST writer - no Outlook/MAPI tie-in
🚀 Delegate exports to first-line support - zero tribal knowledge
🚀 PowerShell module is free – no license required

Available via EasyEntra GUI and PowerShell (no license required). Download EasyEntra to get started.

“Your product is such a time saver - I love it.”
IT Infrastructure Specialist, MEC Aerial Work Platforms, United States

Free PST Export

⚡️ Microsoft

🏆 General Availability

• Build AI agents for production with secure identities from day one • Arturo Lucatero

🔥 Public Preview

• Device soft delete in Microsoft Entra ID (preview)

• What’s New in Microsoft Entra: June 2026 • Martin Coetzer

📖 Read

• Microsoft Build 2026: Securing code, agents, and models across the development lifecycle • Ales Holecek

• Run Global Secure Access with confidence: Introducing the GSA Operations Guide • Thomas Detzner

📺 Watch

• 📺 MFA Everywhere: Closing the Legacy Gap in Your Essential 8 Strategy is now available • Andres Canello, Deepika Mahankali and Vik Verma

• 📺 Redefining identity security for the modern enterprise • Jared Ross, Heike Ritter and Martin Schvartzman

🗣️ Message Center

• RM518221 - Microsoft Entra: Cross-tenant security group synchronization

• RM559476 - Microsoft Entra: Account Discovery for Application Access Governance.

• MC1381116 - Microsoft Entra: Web categorization changes for Entra Global Secure Access

• MC1223829 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions

From the community…

🚀 Most popular posts from last week

• 🥇Time to move to Entra Cloud Sync • Michael Niehaus

• 🥈Emergency Access Application • Josimar Hedler

• 🥉Why Most Joiner, Mover, Leaver (JML) Processes in Microsoft 365 Are Still Broken • Shaun Hardneck

☀️ Learn

👩‍✈️ AI & Copilot

• 📺 Protecting Your Environment: Governing AI Agents with Entra! • Peter Rising

🌐 Private Access & Internet Access (GSA)

• What’s New in Entra Global Secure Access Client v2.31.125 • Richard Hicks

📦 Apps

• Entra ID - Now you can disable an Enterprise Application via Microsoft Graph! • Michael Morten Sonne

• How to Deactivate an Application in Entra ID: Complete Guide • Prajwal Desai

🫆 Authentication

• Difference between a password reset in the Microsoft portals • Jay Kerai

• System-Preferred Authentication is Coming to the First-Factor Login Screen • Daniel Bradley

• Microsoft Entra Authentication Methods • Daniel Hedegaard Arp

👥 User & Group Management

• How to Secure Delegated Admin Access in the My Staff Portal • kanaga

• Microsoft Launches Container Management Support for Security Groups • Tony Redmond

🚦 Conditional Access

• Stop Applying Sign-In Frequency to All Users. Use Authentication Contexts for Step-Up MFA • Rawson Wade

• Create Attribute-Driven Conditional Access Policy for Agent Identities • Dishan M. Francis

• 📺 Entra ID Security Defaults: What They Are & When to Turn Them Off • Jonathan Edwards

🖥️ Devices

• Microsoft Introduces Soft Delete for Devices in Entra ID • AIMA

• Remote Desktop to Microsoft Entra Joined Devices: RDP with Windows Hello for Business, NLA, and Web Sign-In Explained • Sreejith Reghunathan Pillai

• How to restore devices deleted in Microsoft Entra • Daniel Bradley

• Azure Virtual Desktop Introduces Context-Based Redirections • Kevin Kaminski

• 📺 Ditch Active Directory? Entra ID for On-Prem Servers! • Travis Roberts

📈 Reporting and Insights

• Report Distribution List Changes in Microsoft 365 Tenants • Tony Redmond

🥷 Security

• The Privileged Roles Nobody Talks About • Carlos Perez

• Breaking bitlocker again • Jonas L

• The Zero-Trust Edge is Getting Sharper: What Admins Need to Know for Entra in Summer 2026 • Colby Pryor

🎙️ Podcasts

• Automate the Boring Stuff: Practical SecOps for Microsoft 365 • Chris Goosen and Koos Goossens

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

The conversation dives deep into the essential skills required to grow from a niche technical role into a broader Director or CISO position. Christina emphasizes that while technical proficiency is the foundation, “soft skills” such as storytelling and the ability to pitch security solutions as business value are what truly allow a leader to secure executive buy-in. She encourages professionals not to restrict themselves to one domain but to embrace both breadth and depth, leveraging community engagement to understand the shared struggles across different security verticals.

Sponsored by:

Entra ID Credential Gaps That Cause Outages

In Microsoft Entra ID, outages often start small: an expired client secret, or a lapsed certificate quietly breaks an integration. Traditional controls don’t easily track credential expiry, so issues surface only after something fails. Teams are left asking:

• Which app secrets are expiring and when?

• Which certificates are at risk?

• How many integrations are we managing?

Unanswered, these questions lead to avoidable outages, spikes in service desk tickets, and users losing access and bringing projects to a halt. ENow AppGov Credential Monitor continuously tracks expiring secrets and certificates across your Entra ID apps, alerting your team before credentials expire and integrations fail. Get a 7-day free trial to see how it can help you stay ahead.

Get Free Trial

About Christina Morillo

Christina Morillo is a seasoned cybersecurity and technology executive with over two decades of cross-domain experience leading enterprise security, cloud architecture, and identity programs. As an Information Security Officer and trusted advisor, and in her current role as Senior Director of Information Security at The New York Football Giants, she blends technical depth with strategic leadership to drive resilience, regulatory alignment, and business impact.

Her career spans diverse industries, including financial services, big tech, and professional sports, bringing a unique perspective to every challenge. Christina is also a published O’Reilly author (Zero Trust Networks: Second Edition & 97 Things Every Information Security Professional Should Know) and is passionate about making security and technology accessible, relatable, and actionable for all.

LinkedIn - https://www.linkedin.com/in/christinamorillo/

📗 Chapters

00:00 Intro Chat

00:21 Meet Christina Murillo

01:38 From Helpdesk to Identity

05:40 Discovering the World of Security

07:26 Transitioning to a Broader Security Role

11:47 The Power of Curiosity and Collaboration

19:31 Embracing AI and New Technologies

22:01 Storytelling and Pitching to Executives

28:24 Adapting to Constant Industry Change

32:41 Tailoring Career Advice for Today’s World

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

Build is just around the corner, and I’m excited to see all the new goodies that are going to drop. Microsoft and NVIDIA have also been teasing something, probably a new Arm-based PC. Will it live up to the hype? Let’s find out…

I’ve also heard that we’ll get some new Entra bits at Build 🤞. I’m looking forward to bringing it all to you in next week’s issue.

Don’t forget to listen to or watch this week’s Entra.Chat episode. This week, we looked at what it takes to roll out passkeys to millions of users in a B2C consumer scenario, and the lessons we can apply to our own workforce passkey deployments.

Enjoy!

Sponsored by:

Stop App Credential Expirations Before Outages

Prevent outages caused by expired or expiring certificates and secrets across your Microsoft Entra ID applications. ENow Credential Monitor helps IT teams identify risky credentials before they break integrations, flood the help desk, or trigger late-night troubleshooting.

• Alert on expired and expiring secrets and certificates

• Reduce app outages and user disruption

• Avoid ticket spikes and 2 a.m. firefighting

• Keep critical business apps running smoothly

Get Your Score + 7-Day Trial

⚡️ Microsoft

🔥 Public Preview

• Transforming our approach to sensitivity labels at Microsoft with Microsoft Entra • Stephanie Parry

• Find shadow tenants and reduce risk fast with Microsoft Entra Tenant Governance • Cindy Crane

📺 Watch

• 📺 Microsoft Entra Tenant Governance | Find Configuration Drift • Jeff Staiman

• 📺 Securing macOS devices with Conditional Access • Kenneth van Surksum

🗣️ Message Center

• MC1325414 - Microsoft Entra ID SSPR will require registered authentication methods starting September 7, 2026

• MC1326253 - Conditional Access policies now apply to Windows Hello for Business and macOS Platform SSO registration

From the community…

🚀 Most popular posts from last week

• 🥇How to Block Access for High-Risk AI Agents • Ali Tajran

• 🥈🛠️ SAML & OIDC testing for Microsoft Entra ID • Gabe Corsini

• 🥉Building Custom Sign-In Portals with Custom Branding Themes in Entra • Colby Prior

☀️ Learn

💳 Verified ID

• Microsoft Entra ID Account Recovery: Claims Matching API First Impressions • Samuel Eng

🧰 Workload ID

• Direct Managed Identity or Federated Managed Identity? • Daniel Bradley

🌐 Private Access & Internet Access (GSA)

• 🎙️ Ctrl+Alt+Azure | 344 - Insights on using applied AI with Rick Van Rousselt • Jussi Roine and Rick Van Rousselt

• Why Most Joiner, Mover, Leaver (JML) Processes in Microsoft 365 Are Still Broken • Shaun Hardneck

📦 Apps

• 📺 How to trigger an authenticated Power Automate flow from a SharePoint document library • Ejaz Hussain

🫆 Authentication

• Authentication Methods • Jonathan Hope

• Can’t Register MFA? Conditional Access Is Blocking It (53 chars) • Rudy Mens

• Fix Register MFA but none have been enabled for your Account • Rudy Mens

• 📺 Kali365 Nightmare? Don’t Worry Passkeys Have you Covered • Andy Malone

🤖 DevOps & PowerShell

• Send Welcome Email to New Users & Part 2 • Tony Redmond

• Setup Azure DevOps Workload Identity Federation using Terraform • Brian Veldman

• Entra Change Tracker • Eric Woodruff

🚦 Conditional Access

• Zero Trust - Network and Location Context & Devices as Trust Signals • Guillaume Bossiroy

• 📺 Entra ID Security Defaults: What They Are & When to Turn Them Off • Jonathan Edwards

• 📺 From Static to Risk-Driven: Entra ID P2 Conditional Access Blueprint (2026) • Azure Brother

🏙️ External ID - Guests & Multi-Tenant Organizations

• Container label support and Guest access controls for Entra ID Security Groups (part 1) + (part 2) • Vasil Michev

🥷 Security

• CIS Microsoft 365 Foundations Benchmarks v7.0.0 • Havard Overas

• Emergency Access Application • Josimar Hedler

• 🛠️ Rethink Secure Score: risk-based scoring across Defender XDR, Entra, AD, Azure, ExposureGraph, and Shodan • Morten Knudsen

• 📺 BlueHat 2026: Pulling strings: From user to global admin via appIdUris • Microsoft Security Response Center (MSRC)

♻️ Sync

• Time to move to Entra Cloud Sync • Michael Niehaus

📒 Tenant Configuration

• Microsoft Certification Practice

• 🛠️ Entra ID Tenant Lookup • Julian Rasmussen

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Turn them on.
Users register them.
Passwords go away.
Everyone is more secure.

But in the real world, passkey rollouts are not just an authentication setting. They are a product rollout, a user experience change, a support change, and an operational change all at once.

In this episode, I spoke with Vincent Delitz from Corbado, who has worked on large-scale passkey deployments in customer identity scenarios, including public-sector and consumer environments with millions of users. While the examples come from the CIAM world, many of the lessons apply directly to workforce identity and Microsoft Entra deployments as well.

Sponsored by:

Cloud RADIUS built for Entra + Intune environments

EZRADIUS was designed and built by ex-Microsoft engineers with deep Entra and Intune experience. It integrates seamlessly into the Microsoft ecosystem, making it easy to migrate from your on-prem NPS server to a modern, zero-trust network with full support for cloud-first and hybrid environments.

• Deploy in minutes: no on-prem servers, no Windows updates

• Certificate-based auth: EAP-TLS support for Microsoft Cloud PKI or any CA

• Intune compliance checks for zero-trust Wi-Fi and VPN access

• Built for teams of 10 to 10,000: no minimums, no enterprise gatekeeping

• Pay only for users that connect with usage-based pricing

Start your 30-day trial (no credit card required) or book a demo to see how “EZ” it is.

Try it Out

Here are five practical lessons from the conversation.

1. Know why you are rolling out passkeys

Before you start the rollout, be clear on the reason.

Most organisations adopt passkeys for one or more of these reasons:

Security
Passkeys are phishing-resistant and remove many of the risks that come with passwords, SMS OTP, and other phishable methods.

User experience
Signing in with Face ID, Touch ID, Windows Hello, or a security key can be faster and easier than typing passwords and completing MFA prompts.

Cost reduction
In customer identity scenarios, passkeys can reduce SMS OTP costs. In workforce scenarios, they can reduce password reset and sign-in related help desk calls.

The key lesson is this: your rollout strategy should match your goal.

If your goal is security, you need to think about when and how to retire phishable methods.
If your goal is adoption, you need to make passkeys the easiest path.
If your goal is cost reduction, you need to measure whether users are actually moving away from the older methods.

Simply enabling passkeys is not the same as achieving the outcome.

2. Use a staged rollout, not a big bang

One of the biggest mistakes is assuming you can turn on passkeys and immediately remove passwords.

That sounds clean from a security perspective, but in reality it can create confusion, support tickets, and failed sign-ins.

A better model is a staged rollout:

Stage 1: Offer passkeys as an option

Start by making passkeys available. Let users register and begin using them without taking away existing methods immediately.

Stage 2: Nudge adoption

Do not leave passkeys buried as “just another sign-in method.” Make them visible. Make them the preferred option where possible. Help users understand why they should use them.

Stage 3: Gradually retire phishable methods

Once you can see that a user or group has been successfully using passkeys for a period of time, then you can start reducing reliance on passwords, SMS, or other weaker methods.

Stage 4: Fix recovery

This is the part many teams forget.

Once passkeys become the primary sign-in method, account recovery becomes the new weak point. If recovery still relies on phishable methods or manual help desk processes, attackers will target that path instead.

A passkey rollout is not complete until recovery is also secure.

3. Passkeys move complexity from the backend to the user’s device

With passwords, SMS OTP, or push notifications, a lot of the complexity sits in the backend.

With passkeys, much more happens on the client side.

That means success depends on things like:

The user’s device.
The browser version.
The operating system.
The credential manager.
Whether Bluetooth is enabled.
Whether the passkey is synced.
Whether the user is on a managed device or BYOD.
Whether a password manager has changed the sign-in experience.

This is a big mindset shift.

For example, cross-device passkey sign-in often relies on Bluetooth proximity checks. That is great when it works. But what happens if Bluetooth is disabled on a kiosk, blocked by policy, or unavailable on a shared device?

That is the sort of issue you want to find before go-live, not after a three-month project.

The practical takeaway: test the real environments your users will sign in from. Not just your own managed test devices.

4. Your backend logs may not tell the full story

This was one of the most important lessons from the episode.

Passkey success rates can look great in backend logs, but still miss a large part of the user experience.

Why?

Because many failures happen before the backend sees anything useful.

A user may not have the passkey on the current device.
The credential manager may not appear.
The browser may have a bug.
The user may cancel the Face ID or Touch ID prompt.
The passkey may have been deleted locally.
The device may try to use the wrong credential manager.
The user may think registration worked, even though the backend blocked it.

From the backend, you might only see the successful challenges. That can make your success rate look much better than the lived experience.

This is why observability matters.

For customer identity platforms, you may be able to add frontend telemetry and track where users get stuck. In workforce scenarios, you may not be able to instrument the Entra sign-in page directly, but you can still look for signals elsewhere:

Which users are passkey-capable?
Which devices and browsers are being used?
Which users registered passkeys but are not using them?
Which support tickets map to specific OS, browser, or credential manager combinations?
Which groups are still falling back to passwords or SMS?

The lesson: do not rely on a single “success rate” number. It may hide the real rollout problems.

5. Support multiple passkeys and explain the mental model

A common mistake is limiting users to one passkey.

That may sound tidy, but it does not match how people actually work.

A user may have a Windows laptop, a Mac, an iPhone, an Android phone, a password manager, and a physical security key. Some passkeys sync. Some do not. Some are device-bound. Some are stored in iCloud Keychain, Google Password Manager, Bitwarden, 1Password, Windows Hello, or on a physical key.

If users can only register one passkey, they may be locked out when they move to another device.

A better approach is to allow multiple passkeys and make it clear what each one is for.

For example:

One passkey in iCloud Keychain.
One in Google Password Manager.
One in an enterprise password manager.
One physical security key.
One backup key for critical accounts.

This also means communication matters.

Users do not always understand terms like “FIDO2,” “WebAuthn,” “AAGUID,” “attestation,” or even “passkey.” They understand things like:

Sign in with your face.
Sign in with your fingerprint.
Use your security key.
Use the passkey saved on this device.

The more technical your language, the more likely users are to get confused.

This applies internally as well. Even project teams need a shared vocabulary. Are you talking about synced passkeys? Device-bound passkeys? Security keys? Windows Hello for Business? Platform credentials? Roaming authenticators?

If the project team is confused, the users definitely will be.

Bonus lesson: Attestation matters, but not for every user

We also discussed attestation, which is one of those topics that can get confusing quickly.

In simple terms, attestation lets an authenticator prove what type of device or security key it is. This is useful when you want to control exactly which authenticators are allowed.

For example, for privileged admins, you may want to require specific physical security keys issued by the organisation. In that case, attestation can help you enforce that only approved keys are used.

But synced passkeys are different.

If a passkey is stored in iCloud Keychain, Google Password Manager, Bitwarden, or another synced credential manager, it can move across devices. That breaks the model where you can prove it belongs to one specific physical authenticator.

So the practical model may be:

Use stricter device-bound passkeys and attestation for privileged users.
Allow synced passkeys for broader user populations where usability and adoption matter more.
Be clear about the trade-off.

Synced passkeys may not give you the same level of device control as a hardware key, but they are still a huge improvement over passwords and many phishable MFA methods.

Final thoughts

The big takeaway from this episode is that passkey success is not just about enabling the feature.

You need to plan for adoption, device readiness, recovery, support, telemetry, and user education.

Passkeys can absolutely improve security and user experience, but only if the rollout is treated as a real change program.

The teams that succeed will be the ones that ask the hard questions early:

Why are we rolling this out?
Which users are ready?
Which devices are not?
What will break on day two?
How will users recover access?
How will we know whether adoption is actually happening?

Passkeys are the future of authentication, but the rollout still needs careful planning.

About Vincent Delitz

Vincent Delitz is the Co-founder and Managing Director at Corbado, the passkey intelligence platform designed specifically for enterprise CIAM teams. Based in Munich, Vincent is a software engineer turned founder who has been deeply focused on the technology since the term “passkeys” first emerged in 2022.

Through Corbado, he helps large-scale B2C enterprises understand why passkey adoption might be flat, identify what’s breaking logins, and successfully scale passkeys alongside their existing IDPs (including Entra, Okta, Auth0, Ping, ForgeRock, or in-house solutions). Corbado is trusted by major organizations like VicRoads (supporting 5 million users), as well as leaders in financial services and e-commerce. As a speaker, Vincent frequently shares his expertise on passkey adoption and the often-overlooked “Day 2” passkey problems that don’t appear in standard vendor documentation.

LinkedIn - https://www.linkedin.com/in/vincent-delitz/

🔗 Related Links

• How to enable passkeys (FIDO2) in Microsoft Entra ID - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Enterprise Passkey Deployment Challenges - https://www.corbado.com/blog/enterprise-passkey-deployment-challenges

• Corbado - https://www.corbado.com/

📗 Chapters

04:10 The Consumer vs. Workforce Scale

07:49 Uncovering the True Motivations for Passkeys

11:06 The Four Stages of Going Passwordless

12:51 Day 2 Problems and Implementation Hurdles

17:02 Real-World Device and Network Limitations

22:53 Why Passkey Success Rates Are Misleading

27:20 Best Practices for Large-Scale Deployments

32:16 Demystifying Passkey Attestation and AGUIDs

38:48 Handling Support Tickets and Adoption Strategies

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

The long-awaited Platform SSO during Automated Device Enrollment (ADE) for macOS is officially generally available! You can now complete device registration right inside the macOS Setup Assistant before a user ever hits the desktop. In other massive news, Microsoft Entra was named a Leader in the Forrester Wave™: Workforce Identity Security Platforms (Q2 2026) securing the highest scores across both the Current Offering and Strategy categories.

Also in this issue: tune into the latest Entra.Chat episode with Jeff Staiman to learn how Microsoft’s own battle with Midnight Blizzard shaped the new Tenant Governance control plane. And if you’re a GSA customer, don’t miss the newly published GSA Ops Guide.

Enjoy!

Sponsored by:

PST Export in One Line of PowerShell (FREE)

Exporting an Exchange Online mailbox to PST traditionally means wrestling with eDiscovery exports, installing Outlook, or paying for third-party tools - hours of work for what should take one command.

EasyEntra’s Invoke-EEMailboxToPst handles the entire export in a single line:

🚀 Export any mailbox to PST with one CmdLet
🚀 Real-time progress reporting and minimal memory burn
🚀 Native PST writer - no Outlook/MAPI tie-in
🚀 Delegate exports to first-line support - zero tribal knowledge
🚀 PowerShell module is free – no license required

Available via EasyEntra GUI and PowerShell (no license required). Download EasyEntra to get started.

“Your product is such a time saver - I love it.”
IT Infrastructure Specialist, MEC Aerial Work Platforms, United States

Free PST Export

⚡️ Microsoft

🏆 General Availability

• Platform SSO during automated device enrollment is now generally available for macOS • Justin Ploegert

📖 Read

• Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms • Nadim Abdo

• How Storm-2949 turned a compromised identity into a cloud-wide breach • Microsoft Defender Security Research Team

Sponsored by:

Book a demo

From the community…

👩‍✈️ AI & Copilot

• Step-by-Step guide to Microsoft Entra Agent ID • Dishan M. Francis

• Natural Language Queries Against Entra ID • Klaus Bierschenk

• How to Block Access for High-Risk AI Agents • Ali Tajran

💳 Verified ID

• Announcement: Terraform Provider for Entra Verified ID • Mateusz Jendza

👮‍♂️ ID Governance

• Microsoft Entra PIM Secure Admin Access • Mark Oldham

• Password Delivery Is the Last Manual Step in Onboarding • Sandra Saluti

• 🛠️ Introducing the New PIMActivation Portal: Managed, Self-Hosted, and Mobile Ready • Sebastian Flaeng Markdanner

🫆 Authentication

• Identity Is Everything. • Jon Hope

• 🛠️ SAML & OIDC testing for Microsoft Entra ID • Gabe Corsini

👥 User & Group Management

• Microsoft Purview Workload Content roles in Entra & new PIM alerts • Ewelina Paczkowska

🖥️ Devices

• Platform SSO during automated device enrollment is now generally available for macOS • Justin Ploegert

🥷 Security

• 🛠️ Release Monkey365 v0.98 · silverhack/monkey365 • Juan Garrido

• Different Ways to Restrict User Access to Entra Portal • Adi

📒 Tenant Configuration

• Building Custom Sign-In Portals with Custom Branding Themes in Entra • Colby Prior

• 📺 Entra ID Has Been Unprotected for 16 Years! • Azure Academy

🛍️ External ID - Customers

• Domainless SAML federation in Microsoft Entra External ID • Jan Bakker

• Enabling user attributes, e.g. “email” in the JWT in Entra External ID (EEID) • Rory Braybrook

• Using the High Scale Compatibility (HSC) mode in Entra External ID (EEID) for enabling Azure AD B2C… • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

What Can Your AI Applications Access?

Organizations are investing heavily in AI-powered applications and agents, but many are discovering they lack the operational visibility and governance discipline needed to scale AI confidently and securely.

With continuous visibility into Entra ID applications, permissions, OAuth access, secrets, certificates, and application ownership, ENow App Governance Accelerator can:

• Reduce uncertainty around what SaaS apps can access

• Accelerate application reviews and approval processes

• Strengthen operational trust across security and leadership teams

• Prevent unmanaged application growth from becoming operational risk

• Enable lean IT teams to support AI expansion at scale

• Demonstrate governance maturity required for enterprise AI adoption

Request a Demo + Free Trial

While most admins focus on securing their primary production environment, many organizations are sitting on hundreds of “test” or “shadow” tenants that were created by users with a simple Azure subscription. These unmanaged environments often lack proper security bars and can become entry points for sophisticated attackers.

The Wake-Up Call: Midnight Blizzard

The urgency for these new features was fueled by the 2024 Midnight Blizzard attack. In that instance, attackers compromised a legacy test tenant and used its old access rights to move laterally into Microsoft’s core environment. This highlighted a critical gap: securing one tenant isn’t enough if you don’t even know how many other tenants are connected to your organization.

Three Things You’ll Learn in This Episode:

1. Automatic Discovery of the “Unknown”: Jeff explains how the Related Tenants feature uses signals like B2B sign-in logs, multi-tenant app consents, and billing relationships to automatically find every tenant connected to your corporate identity.

2. Configuration Drift Monitoring: You can now define a “Golden Configuration” for your tenants. The service monitors over 200 resource types across Entra, Intune, Teams, and Exchange every six hours, alerting you the moment a security setting is weakened.

3. The “Three-Step” Handshake: To prevent accidental or malicious takeovers, Microsoft has implemented a rigorous trust process. If two tenants don’t share a billing relationship, the governed tenant must explicitly invite the governing tenant before any control can be established.

A New Approach to Licensing

Something many admins will find surprising is the licensing model. Unlike many Entra features that require a license for every user, Tenant Governance is licensed based on the number of admins interacting with the features. This makes it far more accessible for organizations trying to secure a massive multi-tenant estate without a massive budget.

Why you should listen: Jeff dives deep into how Microsoft managed its own 7 million internal tenants and shares the roadmap for future discovery signals, including using Global Secure Access network telemetry to find tenants being accessed from corporate devices.

Whether you are managing a merger or just trying to clean up years of “test” environments, this episode provides the blueprint for moving from manual, one-tenant-at-a-time management to a deterministic, automated security posture.

Subscribe with your favorite podcast player or watch on YouTube 👇

About Jeff Staiman

Jeff Stammen is the PM Area Lead for Tenant Governance within the Identity and Access Management (IAM) team at Microsoft. A true company veteran of 31 years, Jeff originally joined Microsoft managing engineering compensation and famously architected Microsoft's core engineering leveling framework (Levels 59–61) directly from requirements delivered by Steve Ballmer. Today, he leads engineering and product efforts to secure multi-tenant cloud ecosystems at massive scale.

LinkedIn - https://www.linkedin.com/in/jeffstaiman/

🔗 Related Links

• Microsoft Entra Tenant Governance - https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview

📗 Chapters

00:00 Intro

00:18 Introducing Jeff Stammen

00:41 Jeff’s 31-Year Journey at Microsoft

01:25 The Midnight Blizzard Hack That Started It All

05:07 Tenant Governance: What It Is and Why It Exists

07:12 Where Should Admins Start?

09:57 Configuration Snapshots and Baselines

13:02 The M365 DSC Connection

15:18 What Resources Should You Monitor?

17:07 How Drift Detection Works

19:49 Multi-Tenant Monitoring Strategy

20:02 Related Tenants: Discovering Your Unknown Exposure

20:39 Licensing: Basic vs Premium Explained

22:48 Quotas and Resource Limits

24:27 Governance Relationships and Cross-Tenant Role Assignments

28:26 Two-Step vs Three-Step Governance Flow

31:15 Discovery Signals and Blind Spots

35:17 Tenant Restrictions: A Related Feature Worth Knowing

36:40 Secure Tenant Creation

38:10 Governance Policy Templates

40:01 Licensing Across Multiple Tenants

43:43 Final Recommendations: Where to Start Today

47:54 Wrap Up

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

A quick note from Merill: Earlier this week, I shared that I’m leaving Microsoft to start out on my own. The flood of responses has been completely overwhelming. Thank you all so much for the incredible support.

I won’t lie, taking a leap like this is terrifying, and I’ve definitely had moments of second-guessing my sanity! But seeing your kind words reminds me why I need to follow my heart.

Though my day job is changing, my loyalty isn’t: I will always be the #1 Entra fan.

Merill

Sponsored by:

PST Export in One Line of PowerShell (FREE)

Exporting an Exchange Online mailbox to PST traditionally means wrestling with eDiscovery exports, installing Outlook, or paying for third-party tools - hours of work for what should take one command.

EasyEntra’s Invoke-EEMailboxToPst handles the entire export in a single line:

🚀 Export any mailbox to PST with one CmdLet
🚀 Real-time progress reporting and minimal memory burn
🚀 Native PST writer - no Outlook/MAPI tie-in
🚀 Delegate exports to first-line support - zero tribal knowledge
🚀 PowerShell module is free – no license required

Available via EasyEntra GUI and PowerShell (no license required). Download EasyEntra to get started.

“Your product is such a time saver - I love it.”
IT Infrastructure Specialist, MEC Aerial Work Platforms, United States

Free PST Export

⚡️ Microsoft

🏆 General Availability

• Secure the moments attackers target: onboarding, access requests, and account recovery • Ankur Patel

• Sponsor group type requirements for agent identities • Microsoft Entra Agent ID team

• Microsoft Identity Manager 2016 SP3 now available: Enhanced stability for hybrid identity • Ben Mann

📖 Read

• Defense at AI speed: Microsoft’s new multi-model agentic security system finds 16 new vulnerabilities • Taesoo Kim

• New Microsoft Certified: Cybersecurity Business Professional Certification • Liberty Munson

• Microsoft Entra Global Secure Access operations guide • Microsoft Learn

📺 Watch

• 📺 Azure Files Native Entra ID support with AVD FSLogix

🗣️ Message Center

• RM561035 - Microsoft Edge: Allow M365 authentication popups in work profiles

Sponsored by:

Benchmark Entra ID Application Governance

How many enterprise apps, OAuth integrations, and service principals are sitting in your Microsoft Entra ID tenant? In many Microsoft environments, application sprawl builds quietly through:

• User-consented third-party SaaS integrations

• Custom and internal applications

• Test deployments and abandoned dev projects

ENow’s free AppGov Score Assessment uses read-only access to benchmark application governance in Microsoft Entra ID and identify visibility gaps, ownership issues, excessive permissions, expired credentials, and high-privilege access risks.

Get a baseline of enterprise applications, app registrations, ownership gaps, and permission exposure measures across your environment.

Check your AppGov Score

From the community…

☀️ Learn

🧰 Workload ID

• Using configurable token lifetimes in Microsoft Entra ID, .NET and Microsoft Graph • Damien Bowden

👮‍♂️ ID Governance

• PIM Tray: Activate Microsoft Entra ID PIM Roles From the Windows Tray • Thomas Marcussen

🌐 Private Access & Internet Access (GSA)

• 📺 AI Prompt Injection Attacks Are Easy [How To Stop This] • Ru Campbell

📦 Apps

• Entra Enterprise App Recon • Derk van der Woude

• Configure excluded callers for Entra application management policies • Vasil Michev

• Member, Guest, and Wrong: Classifying Entra Users the Practical Way • Nicolas Blank

🫆 Authentication

• Use Device Code Flow to register a passkey in Microsoft Authenticator App • Jan Bakker

• Passkeys enabled ≠ phishing-resistant • Per-Torben Sorensen

• Finding Your Way on the Passkey Path • Brandon Colley

🤖 DevOps & PowerShell

• Understanding How Graph Permissions for Groups Work • Tony Redmond

🚦 Conditional Access

• Protecting Against Credential and Token Theft | 🛡️Jay Kerai • Jay Kerai

• Getting With The Times: Time-Based Conditional Access • Sebastian Flaeng Markdanner

🔐 Credential Management

• Registration Campaigns Now Include Passkeys in Microsoft Entra • Daniel Bradley

🖥️ Devices

• Creating Dynamic Device Model Groups in Entra with PowerShell • Jorge Suarez

• Restricted Management Administrative Unit for PAW Workstations • Jan Mulder

• Control SharePoint Online Site Access for Unmanaged Devices • Adi

🥷 Security

• 📺 The dark art of OIDC abuse - A case study in Entra ID - Cody Burkard - NDC Security 2026 • Cody Burkard

• 📺 Hardening Microsoft Entra, 5 Critical Tips for Admins • Andy Malone

📒 Tenant Configuration

• How Many Global Admins Should I Have in Microsoft 365? • Daniel Bradley

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

We talk about the massive shift toward Passkeys and registration campaigns, the impending migration from Entra Connect Sync to Cloud Sync, and the rapidly evolving world of Agent IDs and AI workloads. We also cover how Entra admins can leverage new Defender XDR features and Security Copilot agents to secure their environments.

About Fabian and Thomas

Fabian Bader is a Microsoft MVP and Cybersecurity Architect at glueckkanja, based in Hamburg, Germany. He is a well-known researcher in the Microsoft identity space, creator of the Cloud Brothers blog, and creator of the Maester and Token Tactics V2 tools. His work focuses on Microsoft Entra and the Defender suite, helping customers secure their cloud environments.

Thomas Naunheim is a Microsoft MVP and a Cybersecurity Architect at glueckkanja. He specializes in Microsoft Entra, identity and access management, and cloud security posture.

• Thomas LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

• Fabian LinkedIn- https://www.linkedin.com/in/fabianbader/

🔗 Related Links

• What’s New in Microsoft Entra: May 2026 - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-may-2026/4517884

• Claude API Docs - https://platform.claude.com/docs/en/manage-claude/wif-providers/azure

• Microsoft Graph - https://learn.microsoft.com/en-us/graph/api/resources/agentid-platform-overview?view=graph-rest-1.0

📗 Chapters

00:00 Intro

01:18 The Year of Passkeys & Registration Campaigns

08:49 Windows Hello & Passkey Syncing

16:37 Migrating to Entra Cloud Sync

22:27 The Rise of Agent IDs & AI Workloads

28:21 Defender XDR Updates for Entra Admins

38:32 Security Copilot & Conditional Access Agent

45:48 Access Packages & New AI Admin Roles

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill