In this episode, Merill sits down with the person who has already done it. Andrew Cameron is a Distinguished Engineer for Identity and Cybersecurity at General Motors, and he has spent roughly 25 years there, long enough to have started on the employee portal as a web architect in 2000, and then helped build the identity function that now carries one of the world’s largest passwordless deployments.

The single biggest lever, Andrew says, was almost embarrassingly simple. GM treated Windows Hello as an optional convenience for years, then realised that an already-managed Windows device is a passkey. About 100,000 people were enabled through Windows Hello alone - no roaming key, no phone, no authenticator juggling. Platform SSO now extends the same idea to Mac through the secure enclave.

The sequence matters as much as the tools. Admin roles came first, required to carry a device-bound passkey with Azure PIM forcing the stronger method through activation. Then Conditional Access did the rollout: a small group of eager users, audit mode, and then add apps and expand outward. Andrew’s practical tip is to target the big, heavily used apps before chasing every user - it often gets you to 80% coverage faster.

Then the conversation turns to the corners most passkey explainers skip. Manufacturing workers who cannot use a phone and do not have a keyboard. Guest accounts - suppliers, dealerships and contractors - whose source tenant must also enable passkeys before the journey can complete. Call-centre users on unmanaged devices. And VDI, where certificate auth or Azure Virtual Desktop fills the gap.

Andrew also walks through the synced-versus-device-bound decision, and lands on the unglamorous first step of the whole thing: before you retire anything, know which authentication methods are actually in use.

What caught GM’s identity team by surprise

Andrew was candid about the corners that bit them - the ones most admins only discover after the weak method is already gone:

• SMS was the onboarding bootstrap. A new starter was never expected to have a passkey, so onboarding simply defaulted to an SMS code. Remove SMS and you have also removed the way people got in on day one. GM’s fix: issue a Temporary Access Pass (TAP) for onboarding, then register a strong method immediately.

• A new phone defaulted to SMS again. The “I just got a new phone” recovery path sent a code to the number by default. That whole flow had to be redesigned too, not just the sign-in policy.

• Guests were the hard problem. Several hundred thousand suppliers, dealerships and contractors can only finish a passkey sign-in if their own source tenant has also enabled passkeys. Enforce on your side and a guest can still get blocked upstream through no fault of yours.

• Factory floors have no phones and no keyboards. Manufacturing workers could not use a phone or type a password, so GM built custom non-password methods and used hardware keys for robots and other physical assets.

• Call-centre users are not on managed devices. Tens of thousands of users were remote or unmanaged, so GM folded device posture and network location into the risk evaluation.

• VDI was a fresh corner. Certificate auth and Azure Virtual Desktop SSO replaced SMS as the way into a virtual desktop.

• Hardware-key attestation had to be unwound. GM had registered AAGUIDs for hardware keys; when synced passkeys arrived, those old attestation requirements no longer applied and had to be revisited.

GM’s secrets: don’t repeat the mistakes

• Your managed device is already a passkey. The light-bulb moment was realising Windows Hello turns an already-managed Windows device into a passkey — no phone required. It became the fast path for roughly 100,000 people, and Platform SSO does the same on Mac.

• Privileged roles first, then everyone else. Admin roles carried device-bound passkeys, with Azure PIM forcing the stronger method through activation.

• Use Conditional Access as the rollout engine. Small pilot group → audit mode → add apps → expand. No big bang.

• Target the big apps, not every user. You reach ~80% coverage faster by protecting the heavily used apps first, then adding more to the same policy.

• Know your authentication methods before you retire anything. Monitoring and visibility come first — the deprecation clock is not the plan.

Sponsored by:

Scan, Score, and Secure Your Applications in Entra

Application identities represent one of the largest attack surfaces in Entra — and often one of the least consistently governed. AppGov Score helps IT and security teams understand where that risk sits.

The 24-check assessment evaluates your Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

• App registrations and enterprise apps for excessive permissions

• Expired or unmanaged secrets

• Ownerless apps

• Risky consent grants

• Privileged service principals

Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations and blast radius — so you can prioritize remediation and strengthen your security posture with confidence.

Scan Your Tenant - No Cost

Subscribe with your favorite podcast player or watch on YouTube 👇

About Andrew Cameron

Andrew Cameron is a Distinguished Engineer for Identity and Cybersecurity at General Motors. He joined GM in 2000 as a web architect working on the employee portal, then moved into directory services and helped stand up GM’s identity and access management team in 2004. He has spent the past quarter-century building and leading identity and security at one of the world’s largest manufacturers from early SAML and OpenID Connect standardisation and Azure AD adoption, to GM’s current passwordless rollout across roughly 200,000 people.

LinkedIn - https://www.linkedin.com/in/kandrewcameron/

Related Links

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (mentioned at 13:23) - https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement

• Passkeys (FIDO2) authentication in Microsoft Entra ID (context throughout) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2

• Synced passkeys, device-bound passkeys and passkey profiles (discussed at 33:57) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Deploy phishing-resistant passwordless authentication (context at 28:38) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication

• Configure a Temporary Access Pass (discussed at 12:48 and 33:20) - https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass

• Windows Hello for Business (the fast path discussed at 09:32 and 26:24) - https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/

• Configure Platform SSO for macOS devices (discussed at 27:23) - https://learn.microsoft.com/intune/device-configuration/settings-catalog/configure-platform-sso-macos

• Require device compliance with Conditional Access (unmanaged-device discussion at 41:35) - https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-compliance

Related Entra.Chat Episodes

• 5 Lessons from Rolling Out Passkeys to Millions of Users - https://entra.news/p/5-lessons-from-rolling-out-passkeys

• From SMS MFA to Passkeys: A Practical Microsoft Entra Migration Plan - https://entra.news/p/from-sms-mfa-to-passkeys-a-practical

• Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - https://entra.news/p/mastering-microsoft-entra-id-real

Chapters

00:00 Intro

00:27 Meet Andrew Cameron

01:34 25 years of identity at GM

07:34 200,000 people and their personas

08:24 The strategy: passkeys over weaker MFA

09:32 Windows Hello: the fast path

10:06 Factory floors and hardware keys

11:20 Sponsor: AppGov Score

13:23 The SMS and voice deprecation

14:20 The guest-account problem

20:30 Roadblocks: onboarding and new phones

23:30 Conditional Access: small groups first

25:02 VDI, certificate auth and Azure Virtual Desktop

27:23 Platform SSO on Mac

28:38 The playbook: monitor, target, measure

33:57 Synced vs device-bound passkeys

35:35 Privileged roles first and Azure PIM

38:54 Final thoughts and wrap-up

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

There’s a bit of a cloud-to-on-prem theme this week.

Entra Cloud Sync can now provision users and groups from Entra ID back to Active Directory, which is now in preview.

There’s also a new preview for keeping a group’s OU and name when changing its Source of Authority. And if you’re working with on-prem apps, there’s a useful walkthrough on governing access to them from Entra ID.

We’ve also got Greg, Eric and Rene on the Entra Chat podcast this week talking all things Entra Groups, so make sure you check it out.

Enjoy!

Sponsored by:

Cut the PS: Mailbox Folder Permissions Made Easy

PowerShell is awesome! For automation, bulk-editing, and scheduling. For first-line ad-hoc user support, PowerShell is a resource sinkhole that slows down ticket resolution, sucks in senior IT, and eats up end-user productivity.

To do “simple” mailbox folder permission management using MS standard tooling, your helpdesk needs to juggle five separate cmdlets and hand-type access rights, exact user identities, and SharingPermissionFlags values for calendar delegates.

With EasyEntra, first-line supporters of any level can view and manage mailbox folder permissions in seconds with close to zero training.

And this is just one of many features available in the same application.

“My team and I are blown away with EasyEntra.”
Group IT Manager, RM Curtis, United Kingdom

Download EasyEntra

⚡️ Microsoft

🔥 Public Preview

• Configure Microsoft Entra ID to Active Directory provisioning (preview)

• Preserve a group’s organizational unit and name when you convert Source of Authority (preview)

• Tutorial: Govern access to an on-premises app from Microsoft Entra ID (preview)

• Entra Domain Services - Public preview of enhanced security account manager support

📖 Read

• ​​​​​​What’s new in Microsoft Security: August 2026 • Alym Rayani

🗣️ Message Center

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

• MC1461704 - Microsoft Defender XDR: Unified response actions across identity accounts

• MC1461705 - Microsoft Defender XDR: Unified identity timeline on the Identity page

• MC1462460 - Microsoft Entra: Domain update for My Account and identity self-service experiences

• MC1462464 - Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retired

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Graph’s Move Toward More Granular API Permissions • AIMA

• 🥈 Microsoft says use Tenant Restrictions to block personal Copilot access. I have questions. • Adam Fowler

• 🥉 Calculating the Licensing Requirement for Entra Conditional Access Policies • Tony Redmond

What happens when the identity services behind Microsoft 365 go down?

Join us this week for a live discussion on 𝗧𝗵𝗲 𝗡𝗲𝘄 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 𝗼𝗳 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 with Merill Fernando, host of Entra.Chat, and Craig Birch of Cayosoft.

Register now

☀️ Learn

👩‍✈️ AI & Copilot

• Using the Entra ID Agentic ID sample • Rory Braybrook

• Conditional Access for Agents: Blocking Agent Identities with Risk and Custom Security Attributes • Derk van der Woude

• Agent 365 settings explained • Derk van der Woude

• 📺 Hide Your OpenAI Key Behind an agentgateway Proxy and Enforce Entra ID with ChatGTP Desktop APP • Sebastian Maniak

🧰 Workload ID

• App instance property lock gets a scoping mechanism (and some other updates) • Vasil Michev

• New Graph Permissions Pose Questions for Microsoft 365 Tenants • Tony Redmond

• Access Azure Key Vault from a Local Kubernetes Cluster with Azure Arc Workload Identity • Ben Reader

• Instant revocation of service principal bearer tokens with CAE • Simone Oor

⛑️ ID Protection

• Entra ID P2 for SMBs: Is it Worth It and Which License to choose? • Gannon Novak

• Identity Threat Protection Starts After the Login • Derek Morgan

👮‍♂️ ID Governance

• Agentifying Entra ID using SCIM • Darren Robinson

• Microsoft PIM is great - but it has some shortcomings that need fixing • Stian A. Strysse

🌐 Private Access & Internet Access (GSA)

• Entra ID – A new version of the Global Secure Access is available • Benoit HAMET

• What’s New in Entra Global Secure Access Client v2.32.294.0 • Richard M. Hicks

• Global Secure Access – Now with Windows Update support! • Michael Morten Sonne

🫆 Authentication

• Passkeys for dummies • Sapir Federovsky

• Configuring Microsoft Entra ID Authentication for Azure SQL Database using Azure Bicep • Brian Veldman

• Passkeys Explained: What They Are & Why They Win • Phil Wade

• 📺 Microsoft Is Retiring SMS & Voice MFA by 2027 - are you ready? • Rio Hindle

• 📺 SMS MFA → Passkey: What Happens on September 1? • Azure Brother

• 📺 The NEW Passwordless Onboarding Flow | TAP → Passkey → Autopilot → WHfB • Azure Brother

👥 User & Group Management

• Microsoft Entra memberOf Retirement: What Admins Must Do • Merill Fernando

• Microsoft accidentally created a new “All Company” group in Entra ID • Tobias Asböck

• 📺 Your Entra Dynamic Groups Break in November (Silently) • Jonathan Edwards

🤖 DevOps & PowerShell

• Microsoft To Enforce WAM for Delegated Interactive Graph Sessions • Tony Redmond

• New Graph API permissions point to Entra ID diagnostics • Daniel Bradley

• Microsoft just added 13 Graph authentication delete permissions • Daniel Bradley

• Interact with MSGraph API locally • Morten Mynster

🚦 Conditional Access

• 10 Conditional Access Mistakes That Are Probably In Your Tenant Right Now • Jonathan Hope

• Your Entra ID protected action has a gap • Jurre Janssens

🖥️ Devices

• Fix Autopilot Device Enrollment Error 80180003 [7 Solutions] • Prajwal Desai

🥷 Security

• Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques • Niklas Kerner

• PRTremote: hijacking sessions via scheduled tasks • Jake Otte

• 📺 16. Kuba Gretzky: Downgrading FIDO MFA With AI Slop • Kuba Gretzky

♻️ Sync

• Sync Entra ID users to Active Directory with Cloud Sync • Daniel Bradley

📒 Tenant Configuration

• How To Use Entra Native Backup and Recovery • Michael Vink

🔥 Maester

• Running a community security baseline in CI: adding Maester to a Terraform and Entra ID GitHub Actions pipeline • Antonio Russo

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

It was a preview feature for four years. It is in a lot of production tenants.

In this episode of Entra.Chat, Merill is joined by three guests for the first time: Gregor Reimling, Chief Azure Technologist at adesso SE and Microsoft MVP for Azure and Security; René Wasel, a Microsoft 365 specialist and Microsoft MVP; and returning guest Eric Woodruff, Chief Identity Architect at Semperis. Gregor and René co-organise the Cloud Identity Summit, which happens to fall on the same date the deprecation lands.

The conversation starts with the deadline and quickly becomes something more useful: an honest audit of what groups in Entra actually do, versus what administrators assume they do.

The memberOf operator existed because Entra does not resolve nested groups the way Active Directory does. It was a flattening trick — take the members of several groups and produce one flat group that applications, licensing and policies could read. With it going away, the panel walks through the realistic replacements: move to supported attribute-based rules where an attribute exists, stamp an attribute with PowerShell where one does not, or convert the group to assigned membership and script it. Gregor and René both raise the version of this that is easy to forget — a rule written years ago that nobody documented, using a sync rule editor nobody wants to reopen.

Then the discussion turns to the part that is not on any deprecation notice. Nested groups are supported in Conditional Access. They are not supported for group-based licensing, where only first-level members get a licence. They are not supported for Global Secure Access, where a nested group assigned to a traffic forwarding profile applies only to its direct members with no error, no warning, and nothing in the portal to tell you. Chris Brumm found that one and wrote a Maester test for it, because the only way to know is to go looking.

There is a new group property that blocks nesting in both directions, undocumented when this was recorded. Sensitivity labels have reached Entra security groups in preview, bringing a guest-access control that stops new guests but does not evict the ones already in the group. And Merill spotted something through Entra.News Daily that deserves more attention than it has had: an agent’s user account is a user identity, so existing dynamic user rules already evaluate it. If your licensing group has a broad rule and your developers start creating agent accounts, those accounts qualify. If it is a group behind a Conditional Access policy or an exclusion, that is a different conversation entirely.

Which leads to the sharpest point in the episode, and Eric makes it plainly: the security of a dynamic group is the security of the write permissions on the attributes in its rule. Some of those attributes are self-service. Some flow up from on-premises Active Directory, changed by people who are not thinking about the cloud at all. Microsoft Learn now carries an explicit warning about exactly this, and it is why groups used for privileged access cannot be dynamic.

The last third is about the Cloud Identity Summit itself. More info below.

If you have memberOf in a rule anywhere, the useful thing to do this week is find it. Everything else in this episode can wait until after November.

Featured sponsor

Cloud Identity Summit 2026 → One Day, One Topic, In the Room

Identity. Security. 2026. On Tuesday 3 November in Frankfurt, the Cloud Identity Summit gives cloud identity a conference of its own, now in its seventh year, and free to attend.

Two parallel tracks, Identity Management and Identity Security, run 50-minute sessions in English. It is deliberately vendor-neutral: Microsoft Entra, AWS, Google Cloud and whatever else you actually run. Eric Woodruff keynotes with Identity Security Kindergeburtstag fourteen years of identity being called “the new security perimeter”, and an honest look at what that has actually got us.

Why it is worth the trip:

• It is in person only. No livestream, no catch-up recordings. The organisers built it that way on purpose — “a strong focus on face-to-face conversations to support networking and exchange of experiences.” If you want the hallway conversation, you have to be in the hallway.

• Everything is identity. No filler tracks. A whole day of people who work on the same problems you do, from an international mix of industries.

• The Community Ticket is 100% free. There is an optional paid Supporter Ticket if you want to help fund the event.

• It is easy to get to. adesso SE, Prisma Frankfurt-Niederrad — around ten minutes by S-Bahn from Frankfurt Airport, ten from Frankfurt Hauptbahnhof, and a short walk from Frankfurt-Niederrad station.

• Travelling in? The Crowne Plaza Frankfurt is a ten-minute walk, €89 single with breakfast on the “Cloud Identity Summit” booking code — 50 rooms, held until 5 October.

One more thing, given what this episode is about: 3 November is also the day Microsoft retires the memberOf operator. If you are going to spend that Tuesday thinking about Entra groups anyway, spend it in a room with people solving the same problem.

Get Your Free Ticket

Subscribe with your favorite podcast player or watch on YouTube

About Gregor Reimling

Gregor is a Microsoft MVP in Azure and Security, Chief Azure Technologist at adesso SE, and a passionate advocate for the Microsoft cloud community. His expertise spans Azure architecture, Microsoft Entra, Zero Trust and hybrid cloud environments; he helps organizations successfully navigate their cloud journey. Beyond his day job, Gregor is a frequent speaker at international events, co-host of the Cloud Inspires podcast and co-founder of the Cloud Identity Summit. As a Microsoft Certified Trainer, he enjoys sharing knowledge, mentoring others, and helping IT professionals get the most out of Microsoft technologies.

LinkedIn - https://www.linkedin.com/in/gregorreimling/

About René Wasel

René is a Microsoft 365 specialist, and a Microsoft MVP for Microsoft 365. He describes his work as helping people actually use the technology they have been given, and he is active in the community as a meetup and event organiser. He co-organises the Cloud Identity Summit.

LinkedIn - https://www.linkedin.com/in/renewasel/

About Eric Woodruff

Throughout his 25-year career in the IT field, Eric has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Sr. Premier Field Engineer, and spent almost 15 years in the public sector, with 10 of them as a technical manager.

LinkedIn - https://www.linkedin.com/in/ericonidentity/

Related Links

• MC1448379 - Microsoft Entra ID: Replace MemberOf rules by November 3, 2026 - https://mc.merill.net/message/MC1448379

• Entra.News Daily, Merill’s daily diff of Microsoft Entra documentation changes (mentioned at 26:26) - https://daily.entra.news/changes/2026-08-14/manage-rules-for-dynamic-membership-groups-in-microsoft-entra-id-16/

• Maester, the open-source test framework used for the dynamic-group and nested-group checks discussed (mentioned at 06:09 and 30:06) - https://maester.dev/contributors/agnivesh

• Configure dynamic membership groups with the memberOf operator - the official retirement notice and migration guidance - https://learn.microsoft.com/entra/identity/users/groups-dynamic-rule-member-of

• Manage rules for dynamic membership groups - covers agent user accounts and the attribute write-permission warning - https://learn.microsoft.com/entra/identity/users/groups-dynamic-membership

• Assign users and groups to Global Secure Access traffic forwarding profiles - confirms nested groups are not supported (discussed at 15:50) - https://learn.microsoft.com/entra/global-secure-access/how-to-manage-users-groups-assignment

• Group-based licensing - confirms only first-level members receive licences - https://learn.microsoft.com/entra/fundamentals/concept-group-based-licensing

• Assign sensitivity labels to Microsoft Entra security groups (preview) (discussed at 25:09) - https://learn.microsoft.com/entra/identity/users/groups-sensitivity-labels

• Eric’s Cloud Identity Summit keynote, “Identity Security Kindergeburtstag” (mentioned at 34:12) - https://www.identitysummit.cloud/speaker

Related Entra.Chat Episodes

• Operational Groups in Entra with Nathan McNulty - https://entra.news/p/operational-groups-in-entra-with

• Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - Eric’s previous episode, referenced at 02:12 - https://entra.news/p/mastering-microsoft-entra-id-real

• From Active Directory to AI Agents: The 25-Year Saga of Microsoft’s Identity - the keynote-turned-podcast Merill promised to link (mentioned at 40:16) - https://entra.news/p/from-active-directory-to-ai-agents

Chapters

00:00 Intro

01:17 Meet Gregor, René and Eric

02:12 Passkeys: what comes after the rollout

04:17 memberOf is being retired

06:45 Workarounds: attributes, PowerShell and sync rules

10:41 Why Entra wants your groups flat

14:36 Where nested groups silently fail

17:45 The new property that blocks nesting

19:27 AD-sourced groups vs Entra-sourced groups 25:09 Sensitivity labels come to security groups

26:23 Agents are already in your dynamic groups

28:23 Why dynamic groups are not a security control

31:31 Inside the Cloud Identity Summit

35:21 Identity is not the “new” perimeter

41:44 November 3, tickets and wrap-up

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

We are light on posts from Microsoft but there are a few interesting Message Center posts on passkeys. Microsoft finally confirming passkey support for guests, as well as WHfB and Platform SSO for macOS to be recognized as stand-alone MFA from October 2026.

We also learnt about a severe Entra ID flaw (CVSS 10.0) that allowed remote code execution. Microsoft has already fixed it and there is nothing for you to do. It was not exploited, and it was found by one of their own engineers.

Don’t forget to check out this week’s Entra.Chat podcast. The demos that Michael Grafnetter showed made me do a double take. Must watch for any Entra admin.

Enjoy!

Sponsored by:

Know Every AI Agent in Your Tenant? Neither Does

Copilot Studio mints a new Entra agent identity every time someone builds an agent. Each one is a live service principal: its own credentials, its own reach into your systems. Entra creates them fast. Nobody’s watching what happens next.

Oasis Platform is.

• Every agent discovered and owned, the full picture. No spreadsheet archaeology

• Secrets rotated automatically, without breaking production

• Stale agents recertified and retired with confidence

See it on your tenant

⚡️ Microsoft

🗣️ Message Center

• MC1459133 - Microsoft Entra ID: Passkey support for B2B users

• MC1450134 - Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors

• MC1303719 - Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

• MC1458474 - Microsoft Entra ID: Retirement of custom CSS layout and positioning properties in company branding

From the community…

🚀 Most popular posts from last week

• 🥇 Secret’s out: How to replace client secrets with Azure managed identity • Sep Behesti

• 🥈 Microsoft is Tracking your Entra ID License Usage – Are You Compliant? • Rudy Mens

• 🥉 Entra Admin Center Flags Licensing Problems with Conditional Access • Tony Redmond

Sponsored by:

Webinar: From App Sprawl to Control in Entra ID

Wednesday, August 26 at 3 pm ET | Register

Entra ID app sprawl happens when nobody owns the process after approval. App registrations, service principals, and integrations pile up, and questions about ownership, permissions, credentials, and usage go unanswered until nobody’s confident enough to remove them.

Hosted by ENow, Microsoft MVPs Nicolas Blank and Alistair Pugin welcome guest Merill Fernando for a practical look at governing apps starting from onboarding through their full lifecycle. You’ll learn:

• What application onboarding should establish

• How to assign real ownership (technical and business)

• Where app lifecycle gaps create risk

• How to govern credentials and access over time

• Which Entra ID controls help, where gaps remain, and what to do about it

  Register Now

☀️ Learn

👩‍✈️ AI & Copilot

• Identity Risk Management Agent | Security Copilot • Michael Frank

🧰 Workload ID

• Logic Managed Identity works – Retire the workaround! • Chris Bradshaw

• Configuring Microsoft Entra ID Authentication for Azure SQL Database using Azure Bicep • Brian Veldman

👮‍♂️ ID Governance

• Entra Inbound Provisioning to Active Directory Attribute Constraint Violated • Darren Robinson

🌐 Private Access & Internet Access (GSA)

• Private DNS Hygiene in GSA — Suffixes, Segments, and the Order Things Resolve In • Christopher Brumm

• 🎙️ Renewing our understanding of Microsoft Global Secure Access | Ctrl+Alt+Azure • Jussi Roine and Tobias Zimmergren

📦 Apps

• Microsoft Graph’s Move Toward More Granular API Permissions • AIMA

• 📺 Microsoft Entra ID and SSO explained minimum required knowledge • Cobuman

🫆 Authentication

• Pass-the-Passkey: What Michael Grafnetter’s Black Hat Research Means for Entra Admins • Merill Fernando

• How to create a Microsoft 365 device-bound passkey on macOS • Jan Bakker

• 📺 How to Handle Entra Passkey & SMS Changes [5 Critical FAQs] • Ru Campbell

👥 User & Group Management

• Stop agent users joining Microsoft Entra dynamic groups • Daniel Bradley

• Microsoft Entra agent users can join your dynamic groups. Here is what to check • Merill Fernando

• Microsoft Entra memberOf Retirement: 2026 Checklist • Driek Desmet

🤖 DevOps & PowerShell

• Use of AZURE_TOKEN_CREDENTIALS in Azure.Identity • Jaliya Udagedara

• Connect to Microsoft Graph, Teams and Exchange with PowerShell Simultaneously • Martin Heusser

🚦 Conditional Access

• Calculating the Licensing Requirement for Entra Conditional Access Policies • Tony Redmond

🏙️ External ID - Guests & Multi-Tenant Organizations

• Microsoft Entra brings passkeys to B2B guest users • Daniel Bradley

🥷 Security

• Microsoft quietly expands the Entra Application Developer role • Daniel Bradley

• Microsoft adds user actions to the Security Administrator role • Daniel Bradley

• Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution • The Hacker News

• 📺 Check Your Customers’ Entra ID Tenants with Maester - Constantin Hager - PSConfEU 2026 • Constantin Hager

📒 Tenant Configuration

• Microsoft says use Tenant Restrictions to block personal Copilot access. I have questions. • Adam Fowler

🛍️ External ID - Customers

• Integrating Entra External ID (EEID) with a third-party MFA provider, e.g. Authsignal • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra.Chat, I spoke with Michael Grafnetter, Principal Security Researcher at SpecterOps and Microsoft MVP, about the Pass-the-Passkey research he presented at Black Hat USA 2026. A family of attacks against passkey implementations across Windows, Microsoft Entra ID, browsers and password managers.

Michael starts with the vulnerability chain he reported to Microsoft. Windows was writing the complete passkey assertion into the event log, and Microsoft Entra ID would accept a replay of that assertion for up to ten minutes. Any user able to read those logs including a member of Remote Desktop Users on a shared server, or unprivileged malware quietly reading event logs without tripping EDR could impersonate whoever had just signed in. If that person was a Global Administrator, so was the attacker. Windows now truncates the logged message, and Microsoft Entra ID checks authenticator signature counters to reject replays.

We also covered the attacks that do not depend on any single bug. Malware running without administrator rights can call the native Windows WebAuthn APIs directly and raise a passkey prompt flood that keeps returning until the user gives in and approves it. Synced passkeys, exported from a password manager and decrypted with a keylogged password, hand an attacker a credential with no ten-minute limit at all. And a browser-hooking technique Michael calls a passkey detour attack quietly redirects a legitimate assertion into the attacker’s own session.

The defensive thread running through all of it is the same: every one of these attacks assumes malware is already on the device. That makes device trust the key control. Privileged access workstations for administrators, Conditional Access requiring compliant devices with EDR running, and the clean source principle that says a system can only be as trustworthy as whatever it depends on.

Michael closes on an optimistic note, and it is worth repeating. Passkeys are still the future. They remain far better than passwords and phishable MFA, and every attack here costs an adversary vastly more effort than sending a phishing link. But as passkeys become the default in Microsoft Entra, the threat model deserves an honest read.

Watch the demos. This episode includes three on-screen demonstrations that are much easier to follow on video than on audio.

This episode brought to you by Workplace Ninjas US

Workplace Ninjas US isn’t just another tech conference. It’s where Microsoft experts, MVPs, engineers, and IT professionals come together to learn, network, and build lasting connections.

We are a community built on diversity, mentoring, fellowship, and creating a place where everyone belongs.

Our core DNA comes down to a few pillars:

• Over 60 sessions from the largest collection of MVPs and SMEs you will find in any event in America.

• Amazing mentoring, development, and growth through our one on one mentoring system with any speaker, our hackathon, community theatre and more.

• A diverse expo hall featuring some of the best Microsoft partners in the world that will help you drive deep efficiencies from your M365 stack.

• A place where you will learn how to think differently and collaborate better through a collection of activities and can return refreshed and invigorated to drive change in your organization.

• Don’t miss out on our early bird tickets while supplies last

Get your early bird ticket today

Subscribe with your favorite podcast player or watch on YouTube

About Michael Grafnetter

Michael Grafnetter is a Principal Security Researcher at SpecterOps and a Microsoft MVP, based in Prague. He specializes in Microsoft Entra ID and Active Directory security and PowerShell. He is the author of the DSInternals PowerShell module and the researcher who originally discovered the Shadow Credentials attack technique, now widely used by penetration testers, red teamers and attackers alike. He has presented his security research at international conferences including Black Hat Europe, Black Hat USA, SecTor, TROOPERS and BSides Lisbon.

• LinkedIn - https://www.linkedin.com/in/grafnetter/

Related Links

• Pass-the-Passkey research and tools, including Passkey Injector and the DSInternals.Passkeys module (discussed at 14:57 and 34:22) - https://github.com/SpecterOps/pass-the-passkey

• Pass-the-Passkey research paper from Black Hat USA 2026 (introduced at 07:34) - https://specterops.io/wp-content/uploads/sites/3/2026/08/Pass-the-Passkey_A4_v2.pdf

• Shadow Credentials, Michael’s earlier Active Directory research (mentioned at 01:46) - https://specterops.io/blog/2021/06/17/shadow-credentials-abusing-key-trust-account-mapping-for-account-takeover/

• DSInternals PowerShell module (mentioned at 01:34) - https://www.dsinternals.com/en/

• Passkeys (FIDO2) authentication in Microsoft Entra ID (context throughout) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2

• Synced passkeys, device-bound passkeys and passkey profiles (discussed at 23:21) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Deploy phishing-resistant passwordless authentication (context at 18:08) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication

• Require device compliance with Conditional Access (recommended at 21:12) - https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-compliance

• Privileged access devices and the clean source principle (discussed at 21:55 and 35:41) - https://learn.microsoft.com/security/privileged-access-workstations/privileged-access-devices

• Unit 42, “Pass the Passkey: A Novel Attack Surface in Passwordless Authentication” — the Palo Alto research on Google Password Manager passkeys (mentioned at 26:27) - https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/

Related Entra.Chat Episodes

• From SMS MFA to Passkeys: A Practical Microsoft Entra Migration Plan - https://entra.news/p/from-sms-mfa-to-passkeys-a-practical

• 5 Lessons from Rolling Out Passkeys to Millions of Users - https://entra.news/p/5-lessons-from-rolling-out-passkeys

• Attackers Are Targeting The AI Ecosystem You Cannot See - https://entra.news/p/attackers-are-targeting-the-ai-ecosystem

Chapters

00:00 Intro

01:02 Meet Michael Grafnetter

03:09 How the Research Started

06:50 Windows Hello for Business Was the First Passkey

07:30 The Signature in Your Event Log

10:18 No, Private Keys Are Not Logged

12:25 How Entra Mitigated the Replay

13:44 Demo: Signing In With a Stolen Signature

15:22 Malware-Initiated Passkey Phishing

18:08 The Browser Is What Makes Passkeys Phishing-Resistant

20:42 What Defenders Should Actually Do

23:04 Synced Passkeys and the Export Problem

26:13 Credential Exchange and Password Manager Risk

28:19 The Passkey Detour Attack

30:43 The Authentication Broker Debate

31:57 RDP Redirection and Remote Passkey Abuse

32:59 Spotting a Suspicious Passkey Prompt

34:46 Passkeys Are Still the Future

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

It’s a passkey week. Users can now register a passkey or passwordless sign-in as their first MFA method and SMS first-factor sign-in has been retired for Entra ID Free tenants on Aug 11. That’s a lot of change landing at once, and the community has already done the heavy lifting. Ru breaks down device-bound vs syncable passkeys, Jonathan has an opt-out guide if you need more runway, and Nathan, Jon, Kenneth and Rahul all published rollout playbooks worth bookmarking before you touch anything in prod.

Two other things to catch. Microsoft Entra Tenant Governance is now GA 🏆. And if you’re still leaning on memberOf dynamic groups, read Julian’s post (and watch Andy’s video) before you plan your fixes. 🫣

Plus I had Jai Maharaj on Entra Chat to break down the upcoming changes. We covered a lot of ground including thinking about account recovery once you’ve moved to passkeys, ID verification and more.

Enjoy!

Sponsored by:

Cut the PS: Mailbox Folder Permissions Made Easy

PowerShell is awesome! For automation, bulk-editing, and scheduling. For first-line ad-hoc user support, PowerShell is a resource sinkhole that slows down ticket resolution, sucks in senior IT, and eats up end-user productivity.

To do “simple” mailbox folder permission management using MS standard tooling, your helpdesk needs to juggle five separate cmdlets and hand-type access rights, exact user identities, and SharingPermissionFlags values for calendar delegates.

With EasyEntra, first-line supporters of any level can view and manage mailbox folder permissions in seconds with close to zero training.

And this is just one of many features available in the same application.

“My team and I are blown away with EasyEntra.”
Group IT Manager, RM Curtis, United Kingdom

Download EasyEntra

⚡️ Microsoft

🏆 General Availability

• Microsoft Entra Tenant Governance is now generally available • Cindy Crane

📖 Read

• Why Active Directory alone is no longer enough • Jorge A Lopez

• How to enforce Zero Trust across every resource • Janice Ricketts

🗣️ Message Center

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

• MC1448374 - Microsoft Entra ID: Retirement of SMS first-factor sign-in for Entra ID Free tenants

📕 Microsoft Learn Docs

• Web filtering in Global Secure Access (V2) (New)

• Migrate web content filtering policies from V1 to V2 (New)

• Tutorial: Federate a SPIFFE/SPIRE workload identity with Microsoft Entra ID (New)

• Tutorial: Federate a Google Cloud workload identity with Microsoft Entra ID (New)

Sponsored by:

Top 5 App Governance Challenges in Your Entra Tenant

Somewhere in your Entra tenant, a client secret is expiring. An over-permissioned application has access it never should have. And nobody’s reviewed which applications are in use since... honestly, who remembers?

You didn’t create this mess. Sprawl, drift, process gaps, enthusiastic users, and time did. But you are the one getting middle-of-the-night pings when an exec cannot access their business-critical app. And you might be the one getting grilled by an auditor asking why an app needs ReadWrite.All permissions.

Created for IT admins, IAM, security teams, and the people who are tasked with managing the application estate in Entra ID - the Entra ID App Governance Playbook breaks down 5 application governance gaps behind identity incidents and how to prioritize the fixes.

Get the Playbook

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Entra Just Made Passwordless MFA Registration Easier • Daniel Bradley

• 🥈 No Guest? No Problem: Direct External Assignments in Microsoft Entra • Colby Pryor

• 🥉 Manage your AI Agents at Scale with Entra Agent ID • Brian Veldman

Yeah. ☀️ Learn

👩‍✈️ AI & Copilot

• Microsoft Graph Atlas MCP Server • Darren Robinson

🧰 Workload ID

• Secret’s out: How to replace client secrets with Azure managed identity • Sep Behesti

• Microsoft Entra: Migrating GitHub Actions Federated Credentials to Immutable Subjects • Tobias Asböck

👮‍♂️ ID Governance

• 📺 How to configure Privileged Identity Management in Entra ID • Steven Weiner

📦 Apps

• Set up OpenwebUI on Docker with Foundry and Entra ID Authentication (Caddy) • Marius Sandbu

🫆 Authentication

• From IST to SOLL: A Field Guide to Modernizing Entra ID Authentication • Kenneth van Surksum

• Afterthoughts: I said SMS and voice were being removed • Per-Torben Sorensen

• Phishing-Resistant MFA: Planning Your Passkey Rollout in Microsoft 365 • Nathan Hutchinson

• How to Move to Passkeys as the Default in Microsoft Entra • Jon Towles

• Microsoft Entra makes passwordless registration easier, but what does this mean for Zero Trust? • Rahul Jindal

• 📺 Device-Bound vs Syncable Passkeys [Admin’s Decision Guide] • Ru Campbell

• 📺 How to Delay Microsoft’s Passkey Rollout (Opt-Out Guide) • Jonathan Edwards

• 📺 Your MFA Won’t Stop This. Here’s What Will • Jonathan Edwards

👥 User & Group Management

• Farewell to memberOf Dynamic Groups • Julian Rasmussen

• Mastering Groups: The Deep Dive • Jonathan Hope

• 📺 Microsoft Is Changing Entra Dynamic Groups – Are You Ready? • Andy Malone

🤖 DevOps & PowerShell

• WAM Bam, Thank You Ma’am. What Changed in the Microsoft Graph SDK • Ben Whitmore

• Microsoft Needs To Proactively Prevent Typosquatting (how I almost got owned) | by Ethan Word | Aug, 2026 • Ethan Word

🚦 Conditional Access

• Entra Admin Center Flags Licensing Problems with Conditional Access • Tony Redmond

🖥️ Devices

• Windows Hello for Business • Keith Doolan

🥷 Security

• 📺 Nested APP Authentication - Undocumented Risk and Conditional Access Bypass • Jun-Sheng Shi and Shang-De (John) Jiang

📒 Tenant Configuration

• Microsoft is Tracking your Entra ID License Usage – Are You Compliant? • Rudy Mens

• Are Microsoft preparing license enforcement for Entra ID? • Daniel Bradley

🛍️ External ID - Customers

• How does Microsoft’s SMS retirement affect CIAM products • Rory Braybrook

• Using strong authentication and email/SMS OTP as second-factor MFA via native auth in Entra… • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

• Microsoft Entra agent users can join your dynamic groups. Here is what to check • Merill Fernando

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra.Chat, Merill speaks with Jai Maharaj, Product Manager at Microsoft, about the practical journey from legacy MFA to a passwordless Microsoft Entra environment. Jai explains what is actually being retired, why organizations can still use a customer-managed telecom provider, and how passkey profiles support synced and device-bound passkeys for different user personas.

The user-experience case is compelling: Microsoft reports roughly 69 seconds for password plus traditional MFA compared with about three seconds for a synced passkey. The security case is stronger still. Passkeys resist phishing by design, but Jai stresses that deploying them does not make an organization phishing-resistant until it enforces the right authentication strength and addresses the passwords and legacy applications still in the environment.

The conversation then follows the complete identity lifecycle. How do you ensure the right person receives a passkey during onboarding? How do you verify someone requesting a sensitive role? How do you recover an account without relying on knowledge-based help-desk questions? Jai connects those scenarios to Microsoft Entra Verified ID, verifiable credentials, Face Check, identity verification partners, and self-service account recovery.

Sponsored by

Scan, Score, and Secure Your Applications in Entra

Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. ENow AppGov Score helps IT and identity teams understand where risk exists. Its 25-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

• App registrations and enterprise apps for excessive permissions

• Expired or unmanaged secrets and certificates

• Risky consent grants

• Privileged service principals

Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations, and blast radius so you can prioritize remediation and strengthen your security posture.

Scan Your Tenant – No Cost

Subscribe with your favorite podcast player or watch on YouTube 👇

About Jai Maharaj

Jai Maharaj is a Senior Product Manager at Microsoft. He works with customers and engineering teams across Microsoft Entra, with experience spanning ID Governance, Verified ID, External ID, and passkeys. He helps enterprise and public-sector organizations move from legacy authentication methods to phishing-resistant authentication.

• LinkedIn - https://www.linkedin.com/in/jai-maharaj-0938305a/

Related Links

• Microsoft-managed SMS and voice retirement timeline (discussed at 02:19 and 06:31) - https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement

• Customer-managed telecom provider FAQ (mentioned at 03:41 and 07:13) - https://learn.microsoft.com/entra/identity/authentication/phone-providers-faq

• Passkey profiles, synced passkeys, and device-bound passkeys (discussed at 09:44) - https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2#passkey-profiles

• Passkey concepts and Microsoft performance figures (mentioned at 14:22) - https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2#what-are-passkeys

• Microsoft Entra Verified ID Face Check (introduced at 31:57) - https://learn.microsoft.com/entra/verified-id/using-facecheck

• ASD/ACSC Essential Eight maturity model (mentioned at 33:41) - https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model

• Microsoft Entra account recovery overview (discussed at 36:59) - https://learn.microsoft.com/entra/identity/authentication/concept-account-recovery-overview

• Verified ID identity verification partners (discussed at 37:12) - https://learn.microsoft.com/entra/verified-id/idv-partners

• Microsoft Entra licensing (discussed at 39:27) - https://learn.microsoft.com/entra/fundamentals/licensing

• Verified ID and Face Check pricing model (discussed at 39:27) - https://learn.microsoft.com/entra/verified-id/verified-id-pricing

• Deploy phishing-resistant passwordless authentication (mentioned at 52:34) - https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication

Related Entra.Chat Episodes

• Microsoft Is Auto-Enabling Passkeys in March 2026 - https://entra.news/p/microsoft-is-auto-enabling-passkeys

• Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - https://entra.news/p/mastering-microsoft-entra-id-real

• Entra Ignite Recap: Synced Passkeys, Agent ID & The Future of Identity - https://entra.news/p/entra-ignite-recap-synced-passkeys

Chapters

00:00 Intro

02:19 Why Microsoft Is Retiring Managed SMS and Voice

03:32 What the February 2027 Deadline Means

09:27 Synced vs Device-Bound Passkeys

14:22 From 69 Seconds to Three

19:02 Making Passkeys Easier for Users

23:14 Customer Passkey Deployment Lessons

28:41 The Secure Bootstrapping Problem

31:57 Verified ID and Face Check

33:41 Essential Eight and High-Value Access

36:24 Self-Service Account Recovery

39:27 Licensing and Recovery Economics

44:45 Why Face Check Augments Passkeys

49:40 Enforce Phishing Resistance and Build a Roadmap

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Lots happening in Entra this week, including the retirement of the memberOf operator for dynamic groups and administrative units, new passkey updates, changes to managed policies, and more.

Also, don’t miss my latest podcast with Andres Canello, where we dive into migrating from existing VPN and SSE solutions to Microsoft Entra Global Secure Access.

Enjoy!

Sponsored by:

88% say AI has outrun their identity stack

AI agents are already making production API calls, running workflows, and touching sensitive data. Your written policies can’t regulate what a machine does at runtime or prove its actions.

FusionAuth’s 2026 State of AI and Identity Report surveyed over 300 technology leaders on the gap:

• 88% say AI adoption has outrun their identity and security readiness

• The more confident a team is in its AI posture, the more likely it’s had a confirmed incident

• Multi-tenant SaaS identity environments report far higher incident rates than isolated or self-hosted deployments

In an AI world, your deployment model is a security decision. Get the data.

Get the 2026 report

⚡️ Microsoft

🏆 General Availability

• RM558853 - Microsoft Teams: Entra passwordless resource account support for Teams Rooms on Windows and Android devices

🔥 Public Preview

• Token Protection deployment guide - Web apps (Preview) • Microsoft Learn

• Analyze provisioning logs with Microsoft MCP Server for Enterprise (Preview) • Microsoft Learn

• Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps • Ron Pessner

📖 Read

• Microsoft may enable managed policies after 30 days in Report-only, shortened from 45 days, with the notification period also shortened from 28 days to two weeks

🗣️ Message Center

• MC1450134 - Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

• MC1448379 - Microsoft Entra ID: Replace MemberOf rules by November 3, 2026

• MC1447671 - Microsoft Entra: Migrate GitHub Actions federated identity credentials to immutable subjects

• MC1325414 - Microsoft Entra ID SSPR will require registered authentication methods starting November 9, 2026

Sponsored by:

What’s been left exposed in your Microsoft 365 tenant?

The devices Defender never picked up, the dead Teams and SharePoint sites, the forgotten Entra apps, the shared mailboxes nobody owns. None of it looks urgent. All of it is exposure: standing access, unprotected devices, and data nobody is watching. Inspect 365 finds it, prioritizes what matters, and tracks each one from review to resolved.

Continuous Microsoft 365 tenant hygiene, built to find and address security risks:

• Small enough to do. Prioritized by impact, so you start with the few that matter, not the whole list.

• Documented as you go. Every decision recorded with its note.

• Provable after. What got resolved, what got accepted and why, whether you bill for the work or answer for it.

Connect a tenant in minutes and see what’s exposed in yours.

See what's in your tenant

From the community…

🚀 Most popular posts from last week

• 🥇 Conditional Access Visualizer & Deployer Tool • Joey Verlinden

• 🥈 Conditional Access Framework (2026.6.1) • Joey Verlinden

• 🥉 Why Intune Devices Became Noncompliant After the July Windows Update • Rudy Ooms

☀️ Learn

👩‍✈️ AI & Copilot

• Manage your AI Agents at Scale with Entra Agent ID • Brian Veldman

🧰 Workload ID

• Bypassing the IMDS cache • Jos Lieben

• 📺 No more passwords: The future is now! • Ben Reader

⛑️ ID Protection

• User Risk with Unified Identity Signals from Defender is here! • Michael Morten Sonne

👮‍♂️ ID Governance

• No Guest? No Problem: Direct External Assignments in Microsoft Entra • Colby Pryor

• Updated ECMA2Host Tools with Entra Application Provisioning Job Management • Darren Robinson

🌐 Private Access & Internet Access (GSA)

• New Entra ID Private Connector version • Benoit HAMET

📦 Apps

• How to prevent users from registering applications in Microsoft Entra • Daniel Bradley

🫆 Authentication

• Microsoft Entra Just Made Passwordless MFA Registration Easier • Daniel Bradley

• System-Preferred Authentication and September 1st Passkey Change • Shehan Perera

• Windows Hello for Business (WHfB) in Practice • Marco Wohler

• 📺 Microsoft Is Killing SMS MFA • Jonathan Edwards

• 📺 Why Your Passkeys Deployment Fails [5 Major Pitfalls] • Ru Campbell

👥 User & Group Management

• Access Microsoft Entra Group Insights with Group Analytics API • Blesslin Rinu

• Entra ID Enables Blocking for Nested Security Groups • Tony Redmond

• Entra ID Drops the memberOf Rule Operator for Dynamic Groups and Dynamic Admin Units • Tony Redmond

• Microsoft Entra Retires the MemberOf Rule Operator for Dynamic Membership Rules • Kanaga

• Microsoft Entra ID Is Retiring the MemberOf Rule for Dynamic Groups • Rudy Mens

• The memberOf rule operator is ending for dynamic Groups in Entra • Daniel Bradley

• Replacing MemberOf in Entra after it is deprecated • Jos Lieben

🚦 Conditional Access

• CA Baseline changes affecting Citrix Authentication • Julian Jakob

• How to Set Up Microsoft Entra Terms of Use • Mark Oldham

• 📺 MFA vs Conditional Access | They’re Not the Same Thing! • Travis Roberts

• 📺 Microsoft Entra Terms of Use Require Acceptance Before Microsoft 365 Access • Mark Oldham

🖥️ Devices

• Hide the AVD SSO Consent Prompt • Flavio Meyer

• Strengthening Endpoint Security with Device Lock Policies in Microsoft Intune • Nicky De Westelinck

• Entra Cloud Sync now allows Active Directory devices synchronization • Benoit HAMET

• 📺 Entra Join vs Hybrid Join vs Registered FINALLY Explained! • Andy Malone

🏙️ External ID - Guests & Multi-Tenant Organizations

• Securing Microsoft Entra Guest Access: Cross-tenant Access Settings and MFA Trust • Oliver Mueller

🥷 Security

• Borrowing Windows Hello keys for authentication and persistence • Dirk-jan Mollema

• Audit your entra permissions with LeastPrivilegedEntra • Morten Mynster

• Pass-the-Passkey v2.pdf • Michael Grafnetter

  

♻️ Sync

• 📺 Microsoft Entra Cloud Sync Just Got Better! New Features August 2026 • Andy Malone

📒 Tenant Configuration

• 📺 Microsoft Entra Identity Architecture – Why Identity Is Your Most Important Security Decision • Shabaz Darr

🛍️ External ID - Customers

• Using OIDC federation via native auth in Entra External ID (EEID) • Rory Braybrook

• Using social federation via native auth in Entra External ID (EEID) • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Existing configuration carries hard-won intent: which populations need access, which destinations should be blocked, and which exceptions keep the business running. Migrate2GSA creates a path to preserve the useful parts while making the migration a deliberate cleanup opportunity.

In this episode of Entra.Chat, I spoke with Andres Canello, Principal Product Manager at Microsoft and creator of Migrate2GSA. Andres demonstrates how the open-source toolkit exports configuration from third-party products, converts it into a common CSV schema, gives administrators an intentional review step, and provisions the approved configuration into Global Secure Access through Microsoft Graph.

The goal is not to configure the product end to end or remove human judgment. Andres describes it as a way to accelerate the repetitive 80%. Conflicting segments default to “do not provision,” existing applications are skipped, generated Conditional Access policies remain disabled, and there is no delete API call in the toolkit.

The conversation also covers greenfield provisioning, backup and restore, reusable consultant baselines, and the unusual development story behind more than 30,000 lines of PowerShell. Andres explains why detailed, published specifications produced better AI-generated code than incremental prompting—and why the intent and edge cases in an open-source contribution matter more than who typed the implementation.

Subscribe with your favorite podcast player or watch on YouTube.

About Andres Canello

Andres Canello is a Principal Product Manager at Microsoft, where he works at the intersection of modern identity and Secure Service Edge. Over his 15 years at Microsoft, he was a founding member of the Entra Global Secure Access team, helping shape the product before it launched, and has since guided some of the largest identity and secure-access deployments in the industry, from banks and miners to national governments. He’s the creator of Migrate2GSA, an open-source migration toolkit used by organizations around the world, which he built end-to-end using AI-assisted, spec-driven development.

• Andres Canello on LinkedIn

• Andres Canello on X/Twitter

Sponsored by

Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant - without digging through old HTML reports.

• Keep 5+ years of tenant history in your chosen Azure region

• Compare runs, spot drift, and get change alerts

Become a Founding Supporter for $99/month to fund open-source Maester development, shape the roadmap, and get self-hosted private-preview access plus 10% off hosted for life.

Check out Maester Cloud today!

Related Links

• Plan and troubleshoot UserPrincipalName changes in Microsoft Entra ID
  (mentioned at 04:07)

• Azure AD Mailbag: Conditional Access Q&A by Andres Canello (mentioned at 06:43)

• Migrate2GSA documentation (mentioned at 45:37)

• Migrate2GSA source repository (mentioned at 45:37)

Related Entra.Chat Episodes

• How to Migrate from Legacy VPNs to Entra Private Access (Real Strategies from a Veteran)

• Global Secure Access Explained: Real-World Rollouts, Mistakes, and Best Practices

• Identity-Centric Network Security: Entra Global Secure Access Architecture & Benefits

Chapters

00:00 Intro

01:05 Andres Canello's 15 Years in Microsoft Identity

06:43 A Conditional Access Mistake Admins Still Make

11:29 From Early Customer Pilots to Entra GSA

13:21 Why SSE Migrations Should Not Start From Scratch

18:31 Beyond Migration: Backup Restore and Greenfield

23:27 Export Convert Review and Provision

27:02 How Specifications Made AI-Generated PowerShell Work

35:22 Conflict Detection and the Human Review Gate

39:14 Microsoft Graph Provisioning with Safety Built In

43:35 Automating the Repetitive 80 Percent

46:15 Contributing to Migrate2GSA

Podcast Apps

• Entra.Chat

• Apple Podcast

• YouTube

• Spotify

• Overcast

• Pocketcast

• Other podcast apps

Merill’s socials

• YouTube

• LinkedIn

• Twitter

• TikTok

• Bluesky

• Mastodon

• Threads

• GitHub

There’s lots happening with the SMS and MFA retirement and migration to passkeys. Check out the message center posts and docs updates to stay on top of things.

Don’t forget to watch this week’s podcast with Ray Reyes on the new Microsoft Entra and Purview integrations including Conditional Access policies that are based on Microsoft Purview.

Enjoy!

Sponsored by:

Cut the PS: Mailbox Folder Permissions Made Easy

PowerShell is awesome! For automation, bulk-editing, and scheduling. For first-line ad-hoc user support, PowerShell is a resource sinkhole that slows down ticket resolution, sucks in senior IT, and eats up end-user productivity.

To do “simple” mailbox folder permission management using MS standard tooling, your helpdesk needs to juggle five separate cmdlets and hand-type access rights, exact user identities, and SharingPermissionFlags values for calendar delegates.

With EasyEntra, first-line supporters of any level can view and manage mailbox folder permissions in seconds with close to zero training.

And this is just one of many features available in the same application.

“My team and I are blown away with EasyEntra.”
Group IT Manager, RM Curtis, United Kingdom

Download EasyEntra

⚡️ Microsoft

🔥 Public Preview

• Configure device sync with Microsoft Entra Cloud Sync (preview) • Microsoft Learn

📖 Read

• Assess the SMS and voice migration temporary opt-out: Microsoft is retiring SMS and voice authentication methods in favor of passkeys. Microsoft added the beta Graph opt-out procedure for the automatic passkey and Registration Campaign rollout. Set optOutSettings.passkeyDynamicMigration to true for the temporary 1 September 2026–1 February 2027 exclusion.

• Harden GitHub and GitLab federated credentials: Federated credentials that rely on mutable repository, branch, tag, or environment names can be vulnerable to takeover or unintended access. Adopt immutable subject identifiers and review existing workload identity federation configurations.

• New tenant-estate architecture series: Seven new articles cover primary tenants, collaborating production tenants, isolated critical-system tenants, business-partner isolation, nonproduction tenants, and hybrid identity.

• New guidance explains how Global Secure Access and Defender for Cloud Apps can coexist without double proxying

• Global Secure Access publishes dedicated outbound egress IP ranges for allowlisting

• SCIM provisioning adds secretless authentication with workload identity federation

• ​​​​What’s new in Microsoft Security: July 2026 • Alym Rayani

🗣️ Message Center

• MC1223829 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions

• MC1435782 - Microsoft Entra ID: Retirement of custom CSS positioning properties in custom branding

• MC1440968 - Microsoft Entra ID: Optimizations for passkey registration experience

• RM568217 - Microsoft Purview: Information Protection - Sensitivity Labels for Microsoft Entra Security Groups

Sponsored by:

Recent layoffs have left a lot of strong professionals in limbo.

That’s why we built Sponsor a Seeker — a simple way for the community to lift each other up.

For just $29, you can gift a full 3-month Job-Hunt Pass packed with: • Unlimited resume & job description scans • AI-powered rewrites that actually beat ATS systems • Professional cover letter generation

Every dollar goes directly to the seeker.

You can: → Sponsor someone like Alex M. (recently laid off front-end engineer) → Or request sponsorship for yourself

Either way, you’re helping keep momentum alive in a tough market.

👉 Take action here: pastthebots.com/sponsor

Let’s turn “I was laid off” into “Someone had my back.”

Thank you for being part of this community, Rod Trent Past the Bots

Take action

From the community…

🚀 Most popular posts from last week

• 🥇 Passkeys by default and retirement of Microsoft-provided SMS and voice in Entra ID • Stefan Dohnal

• 🥈 Lock or sign-out when Yubikey is removed from the device • Jan Bakker

• 🥉 Inside Microsoft Intune MAM: What Your Mobile App Protection Actually Protects • Rawson Wade

☀️ Learn

🧰 Workload ID

• 📺 Finding App Permissions in the Entra Maze (a PoShaKucha) • Andres Bohren

• 📺 Secret’s out 🤫 There’s a better way to access Multi-Tenant • Jonas Sommer Nielsen

• 📺 Your Graph Apps Are Over-Privileged! (a PoShaKucha) • Morten Mynster

👮‍♂️ ID Governance

• Resetting Escrowed Accounts on a Microsoft Entra Provisioning Job • Darren Robinson

🌐 Private Access & Internet Access (GSA)

• Entra ID SMS and Voice MFA Retirement: Migration Playbook • Thomas Marcussen

• Global Secure Access in Sentinel, Part 1: Logs Are Not a Strategy • Dustin Gullett

• How Entra Private Access Can Stop Hotel Hackers • Colby Pryor

• When DNS Lookups Trigger MFA — Private DNS and Conditional Access in GSA • Christopher Brumm

🫆 Authentication

• 📺 MFA Passed, The Attacker Still Won [How To Stop This] • Ru Campbell

• 📺 Passwordless from Day One | Windows Autopilot + TAP + WHfB + Passkeys (No Password Ever) • Azure Brother

• 📺 Stop Trusting Your Office IP Address for MFA • Jonathan Edwards

• 📺 Episode 433: Passkeys, Passwords, and the End of SMS MFA • Microsoft Cloud IT Pro Podcast

👥 User & Group Management

• Working with the group insights (analytics) Graph API • Vasil Michev

• How to disable group nesting in Microsoft Entra ID • Daniel Bradley

🤖 DevOps & PowerShell

• using OData any() to filter proxyAddresses in Graph API • Martin Rublik

🚦 Conditional Access

• Conditional Access Visualizer & Deployer Tool • Joey Verlinden

• Conditional Access Framework (2026.6.1) • Joey Verlinden

• 📺 Microsoft Defender for Cloud Apps: Conditional Access App Control Demo | Real-Time Session Control • Rio Hindle

🖥️ Devices

• Why Intune Devices Became Noncompliant After the July Windows Update • Rudy Ooms

🏙️ External ID - Guests & Multi-Tenant Organizations

• Quick look at the sponsorOf property in the Graph API • Vasil Michev

🥷 Security

• Microsoft make silent but frequent changes to Entra ID roles • Daniel Bradley

• Apply Sensitivity Labels to Microsoft Entra Security Groups • Adi

• Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts • Bill Toulas

• 📺 TROOPERS26: I’m_in_your_cloud_v4_FINAL.pdf - hacking everyone’s cloud • Dirk-jan Mollema

♻️ Sync

• manipulating proxyAddresses via inbound Entra Connect rules • Martin Rublik

• Microsoft Entra Cloud Sync Now Supports Device Sync • Blesslin Rinu

📒 Tenant Configuration

• AUs vs RMAUs: What’s That? • Jonathan Hope

• Microsoft 365 - Too Complex for Humans to Understand? • Tony Redmond

• 📺 TROOPERS26: Delete Is Easy – Recovery Is Not: The Reality of Entra ID Backup & Restore • Klaus Bierschenk

🛍️ External ID - Customers

• Using social federation via native auth in Entra External ID (EEID) | by Rory Braybrook | The new control plane | Aug, 2026 • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Microsoft Purview can now influence the controls Entra administrators are asked to implement. From insider-risk conditions in Conditional Access to inline protection for sensitive data moving toward unsanctioned AI apps. That means Entra teams need enough Purview knowledge to understand what triggers a policy, how users experience it, and who should respond when an alert fires.

In this episode of Entra.Chat, Merill speaks with Ray Reyes, Principal Security Consultant at Engage Squared and author of Mastering Microsoft Purview Deployment in the Era of AI. Ray explains Data Loss Prevention and Insider Risk Management in plain language, then follows their integrations into Microsoft Entra ID, Microsoft Defender XDR, and Global Secure Access.

The conversation moves beyond product configuration. A policy can be technically simple and still require identity, network, data-security, HR, management, and data-owner teams to agree on scope, ownership, education, escalation, and remediation. Ray’s practical advice is to understand the neighbouring Microsoft security products at a high level and deploy Purview gradually: start in audit mode or with a limited group, learn from the impact, and expand with the business.

Ray also shares the story of the charity he and his wife started in Nepal, how it grew from supporting roughly 30 street children to reaching thousands, and how that chapter changed his perspective on work and stress. He and Merill close with an honest discussion about burnout, layoffs, gratitude, personal branding, and building a career safety net outside any one employer.

Sponsored by

Recent layoffs have left a lot of strong professionals in limbo.

That’s why we built Sponsor a Seeker, a simple way for the community to lift each other up.

For just $29, you can gift a full 3-month Job-Hunt Pass packed with: • Unlimited resume & job description scans • AI-powered rewrites that actually beat ATS systems • Professional cover letter generation

Every dollar goes directly to the seeker.

You can: → Sponsor someone like Alex M. (recently laid off front-end engineer) → Or request sponsorship for yourself

Either way, you’re helping keep momentum alive in a tough market.

👉 Take action here: pastthebots.com/sponsor

Take action here

Let’s turn “I was laid off” into “Someone had my back.”

Thank you for being part of this community, Rod Trent Past the Bots

Subscribe with your favorite podcast player or watch on YouTube.

About Ray Reyes

Ray Reyes is a Principal Security Consultant at Engage Squared and the author of Mastering Microsoft Purview Deployment in the Era of AI. He previously worked at Microsoft, where he led data-security subject-matter expertise across Asia Pacific and Japan and helped customers deploy Microsoft Purview and Microsoft Defender XDR. His work now spans identity, data security, and the wider Microsoft security stack.

• LinkedIn → linkedin.com/in/ray-reyes-598062125

Related Links

• Mastering Microsoft Purview Deployment in the Era of AI by Ray Reyes (mentioned at 00:00 and 02:25)

• Microsoft Purview overview (discussed from 03:29)

• Adaptive Protection in Microsoft Purview (discussed at 22:09)

• Learn about Data Loss Prevention for Network Data Security (discussed at 33:31)

• Configure Microsoft Entra Internet Access content filtering (discussed at 34:18)

• The Resilience Project: Finding Happiness through Gratitude, Empathy and Mindfulness by Hugh van Cuylenburg (mentioned at 47:25)

Related Entra.Chat Episodes

• How Microsoft Is Securing AI Agents in Entra — Conditional Access, Zero Trust & the “Block” Debate

• How to Migrate from Legacy VPNs to Entra Private Access

• What’s New in Microsoft Entra — May 2026: Passkeys, Agents & Cloud Sync

Chapters

00:00 Intro

03:29 Why Purview Matters to Entra Admins

05:39 How Microsoft Purview Evolved

09:46 Data Loss Prevention Explained

16:04 Insider Risk and Employee Departures

22:09 Adaptive Protection Meets Conditional Access

25:00 Education and Alert Ownership

28:51 Breaking Down the Security Silos

33:31 Network Data Security and Unsanctioned AI

38:29 How to Roll Out Purview Safely

41:20 Ray’s Charity Work in Nepal

47:10 Resilience Burnout and a Career Safety Net

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Some key highlights this week. Darren Robinson built an MCP server for Entra.Chat. Point your agent at it and you get every episode and newsletter as searchable context. Worth 5 minutes of your time.

Jan Bakker has been writing some top notch Maester tests using AI, and he wrote up how he does it. Idea to pull request!

Also don’t miss Audrey Long from Xbox on securing 70+ Entra tenants with Maester.

Enjoy!

Sponsored by:

88% say AI has outrun their identity stack.

AI agents are already making production API calls, running workflows, and touching sensitive data. Your written policies can’t regulate what a machine does at runtime or prove its actions.

FusionAuth’s 2026 State of AI and Identity Report surveyed over 300 technology leaders on the gap:

• 88% say AI adoption has outrun their identity and security readiness

• The more confident a team is in its AI posture, the more likely it’s had a confirmed incident

• Multi-tenant SaaS identity environments report far higher incident rates than isolated or self-hosted deployments

In an AI world, your deployment model is a security decision. Get the data.

Get the 2026 report

⚡️ Microsoft

🏆 General Availability

• What’s New in Microsoft Entra: July 2026 • Martin Coetzer

📖 Read

• Modernize SAP Identity Management with Microsoft Entra • Mark Wahl

• Secure AI, web, and private apps with Zero Trust • Sinead O’Donovan

• Microsoft Entra ID enhances security of branded sign-ins • Adam Steenwyk

• Plan your Azure AD B2C migration with the Migration Policy Analyzer • Namita Singh

🗣️ Message Center

• MC1221452 - (Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants

• MC1282568 - General Availability: Microsoft Entra passkeys on Windows

• MC1400824 - Microsoft Entra: Self-service password reset CAPTCHA protection updated

• MC1435782 - Microsoft Entra ID: Retirement of custom CSS positioning properties in custom branding

• MC1437671 - Microsoft Entra: Passwordless password change in My Sign-Ins

From the community…

🚀 Most popular posts from last week

• 🥇 Taking Back Control: Managing the New Entra SSO Prompt in Windows via Intune • Per Larsen

• 🥈 Stop Flying Blind, Take Two: A Brand New Entra ID App Report • Matej Klemenčič

• 🥉Don’t Delete the Guest Account: Reset Redemption Status in Microsoft Entra • Sreejith Reghunathan Pillai

Sponsored by:

Still spending hours packaging and updating applications for Microsoft Intune?

Pckgr helps IT administrators automate the entire application lifecycle, from packaging and deployment to version updates and compliance.

Key benefits:
• Private repository of ready-to-deploy applications
• Automated update management
• Windows, macOS and Custom application support
• Reduced packaging and maintenance workload
• Vulnerability detection and remediation

Reduce operational overhead, improve consistency, and give your team time back for higher-value work.

Book a demo

☀️ Learn

👩‍✈️ AI & Copilot

• The Invisible Factory: Four Security ‘Weaknesses’ in Entra Agent ID Blueprints • Derk van der Woude

• The sad state of governance APIs for Copilot and Agent 365 • Vasil Michev

• Inside Entra Agent ID • Elli Shlomo

🧰 Workload ID

• Two doors into your tenant: delegated vs application permissions in multi‑tenant Entra apps • Derk van der Woude

• Using User Assigned Managed Identities with Microsoft 365 Automation • Tony Redmond

👮‍♂️ ID Governance

• Access Packages On-Demand with PowerShell • Mark Orr

🌐 Private Access & Internet Access (GSA)

• Entra Internet Access TLS Inspection and Always On VPN: Troubleshooting SSTP Connection Failures • Richard Hicks

📦 Apps

• How to add granular amr claims to your SAML apps in Entra ID • Jan Bakker

🫆 Authentication

• Passkeys by default and retirement of Microsoft-provided SMS and voice in Entra ID • Stefan Dohnal

• Microsoft Entra to allow passwordless password changes • Daniel Bradley

• HEADS UP: The 2027 Microsoft MFA Shift Is Coming • Colby Pryor

• 🎙️ Ctrl+Alt+Azure | 352 - So long, SMS and voice authentication • Jussi Roine and Tobias Zimmergren

• 📺 SMS Gets Hacked, FIDO2 Doesn’t: Why Your MFA Isn’t Good Enough • Travis Roberts

• 📺 Stop Using SMS MFA [Before Entra Locks You Out] • Ru Campbell

👥 User & Group Management

• Entra ID – A new administration role for SOC incident response • Benoit HAMET

🤖 DevOps & PowerShell

• Permissions Creep Halts Microsoft Graph PowerShell SDK • Tony Redmond

• How JSON Batching Speeds Up Graph API Processing • Tony Redmond

• 📺 Zero Trust, Five Logins - PSConfEU 2026 • Gael Colas, Friedrich Weinmann and Aleksandar Nikolic

🚦 Conditional Access

• Replace Remember MFA with Conditional Access Sign-in Frequency • Pranavkumar

🖥️ Devices

• Inside Microsoft Intune MAM: What Your Mobile App Protection Actually Protects • Rawson Wade

• Goodbye Passwords: Certificate-Based Authentication on Windows with Cloud PKI in Microsoft Intune • Nicky De Westelinck

• Lock or sign-out when Yubikey is removed from the device • Jan Bakker

• Hybrid Join to Entra Join Migration? Don’t Miss This Microsoft Entra Token Protection Limitation • Sreejith Reghunathan Pillai

🏙️ External ID - Guests & Multi-Tenant Organizations

• Teams Shared Channels: Use Cases, B2B Direct Connect, and Governance • Frank van Zandwijk

🥷 Security

• The New Hotness in Phishing: Device Code Attacks in M365 • Danny Dubree

• 📺 Episode 49 - Common Entra Security Mistakes • Ru Campbell and Dinant Paardenkooper

📒 Tenant Configuration

• Microsoft are retiring custom CSS positioning in company branding • Daniel Bradley

• 📺 Microsoft 365 Important Updates Every Admin Needs to Know • Andy Malone

⚒️ Toolkit

• Entra Chat Podcast MCP Server • Darren Robinson

🔥 Maester

• Introducing Active Directory Security Testing in Maester 🏰 • Maester Team

• Writing Maester tests using AI - From idea to Pull Request • Jan Bakker

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

The scale is striking: about 50 controls, dozens of independently operated game-studio tenants, and one parallel pipeline that checks whether each environment still matches Xbox’s security intent. When a Conditional Access policy moves to report-only or a required service principal loses a permission, the next run finds it.

In this episode of Entra.Chat, Merill speaks with Audrey Long, Principal Cloud Security Architect in Xbox Security at Microsoft, and Sam Erde, SecureShield Architect at Patriot Consulting and a Maester maintainer. Audrey explains how Xbox Security extended Maester with custom PowerShell, GitHub Actions, a multi-tenant service principal, federated identity credentials, dashboards, ticketing, and time-bound exceptions.

The result is more than a posture report. Findings flow into an operational lifecycle with owners and deadlines. Studios get readable reports, deep links to the affected object, and remediation guidance. Security teams can answer audit questions without interrupting all the tenant admins, while the Maester pipeline keeps read-only observability separate from remediation authority.

The conversation also covers why a Microsoft-wide baseline needs adapting for gaming acquisitions, how custom tests encode an organization’s intent, why security configuration deserves regression tests, the Investigate status Audrey’s team helped introduce, and how administrators can use AI as a first-draft assistant for PowerShell and CI/CD without outsourcing validation.

Subscribe with your favorite podcast player or watch on YouTube

Sponsor

Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant—without digging through old HTML reports.

• Keep 5+ years of tenant history in your chosen Azure region

• Compare runs, spot drift, and get change alerts

Maester Cloud is in active development. Join the waitlist for hosted, self-hosted, or enterprise onboarding updates.

Join the Maester Cloud waitlist

About Audrey Long

Audrey Long is a Principal Cloud Security Architect in Xbox Security at Microsoft. She focuses on Microsoft Entra and identity security, as well as securing Azure, AWS, and Google Cloud environments across Xbox and its game studios. In this episode, she shares how her team built a gaming-specific Entra baseline and operationalized it across more than 70 tenants.

• LinkedIn - https://www.linkedin.com/in/aulong/

About Sam Erde

Sam Erde is part of the Maester core maintainer team, a Microsoft MVP, and a SecureShield Architect at Patriot Consulting. He focuses on Active Directory, Microsoft Entra ID, Microsoft 365 security, and practical PowerShell tooling for defenders.

LinkedIn - https://www.linkedin.com/in/samerde/

Related Links

• Maester, installation guide, and source code (mentioned at 02:19) - Maester · installation guide · GitHub source

• Continuous monitoring with Maester and GitHub Actions (mentioned at 14:38) - https://maester.dev/docs/monitoring/github/

• Writing custom Maester tests (mentioned at 22:39) - https://maester.dev/docs/writing-tests/

• Connect-Maester permissions and read-only access (mentioned at 24:38) - https://maester.dev/docs/connect-maester/

• Zero Trust Assessment: Secure your tenant (mentioned at 25:46) - https://entra.news/p/find-your-tenants-hidden-flaws-in

• Maester’s Investigate test-result status (mentioned at 34:02) - https://maester.dev/docs/writing-tests/formatting-test-results/

• Making Security Invisible for Game Developers (mentioned at 45:52) - https://opsmatters.com/videos/making-security-invisible-game-developers

Related Entra.Chat Episodes

• How to Secure Copilot Agents, Azure DevOps & Defender (+ more) with Maester 2.1 (Full Breakdown)

• Zero Trust Assessment: Secure your tenant

• How to Design Bullet-Proof Conditional Access Policies in Microsoft Entra ID

Chapters

00:00 Intro
00:42 Meet Audrey Long
02:19 From 50 Controls to 70+ Tenants
05:11 Making an Entra Baseline Gaming-Specific
08:32 Why Custom Maester Tests Matter
11:07 Governance and Nightly Automation
15:27 From Findings to Remediation
18:07 Reports Studios Can Actually Use
22:39 Building Custom Multi-Tenant Tests
28:07 Security Intent as Regression Tests
30:48 Catching Drift and Producing Audit Evidence
41:39 CI/CD and AI for Security Admins

Podcast Apps

Entra.Chat - https://entra.chat

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

The big one this week: Microsoft is retiring SMS and voice authentication in February 2027. Passkeys become the default authentication method starting September 1 this year. And if you still need SMS after the Feb cutoff? You’ll be paying a third-party telecom provider for it.

This changes the MFA rollout plan for pretty much every tenant. Nadim’s blog post below has the full timeline and how to prepare.

I’ll be sitting down with the Microsoft Entra PM behind this change to get your questions answered. Post yours here or upvote an existing one. The most popular and interesting ones make the cut.

Enjoy!

Sponsored by:

Transform hybrid management with a one-minute installation

Get EasyEntra

⚡️ Microsoft

🔥 Public Preview

• Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID • Nadim Abdo

📖 Read

• AI agents are everywhere. Are your access controls ready? • Kaitlin Murphy

• Defending SaaS-based applications against ShinyHunters OAuth abuse • Microsoft Defender Security Research Team

• Least privilege for AI agents: Identity, access, and tool binding • Yesenia Yser and Toby Kohlenberg

📺 Watch

• 📺 Microsoft Entra Suite hands-on tour of identity and network access protections • Microsoft Mechanics

🗣️ Message Center

• MC1243549 - Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B

• MC1426371 - Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

• RM522096 - Microsoft Purview: Integration with Entra GSA Internet Access to enable sensitive file filtering at the network layer

• RM558853 - Microsoft Teams: Entra passwordless resource account support for Teams Rooms on Windows devices

From the community…

🚀 Most popular posts from last week

• 🥇 Entra – Reminder to start migrating to Cloud Sync and Exchange writeback • Benoit HAMET

• 🥈 Why you Shouldn’t bypass MFA for your office IP adresses • Daniel Bradley

• 🥉Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect • Jan Bakker

Sponsored by:

Leaving Azure AD B2C? Build, buy, or switch?

The B2C migration forces a question every team eventually faces: build it yourself, follow the default to Entra External ID, or buy a platform that gives you both control and speed?

Before you commit, run the actual numbers. Building in-house isn’t free, it’s ~18-24 months to SOC 2 alone, plus the security and maintenance most teams underestimate.

FusionAuth gives you the control people build for — self-hosting, full customization, your own data — without the build cost:

• 🧮 3-year TCO calculator: build vs. SaaS vs. FusionAuth

• ✅ 5-question assessment to pressure-test your decision

See where you actually land.

Calculate your real auth cost

☀️ Learn

👩‍✈️ AI & Copilot

• Entra Agent Blueprints, from an Offensive perspective. • Derk van der Woude

⛑️ ID Protection

• Block High-risk Agents Using Identity Protection • PaVee

👮‍♂️ ID Governance

• Use the new Entra SOC Identity Responder Admin Role • Daniel Bradley

📦 Apps

• Stop Flying Blind, Take Two: A Brand New Entra ID App Report • Matej Klemenčič

🫆 Authentication

• Microsoft to Stop Providing Telephony-Based Authentication Methods for MFA in February 2027 • Tony Redmond

  • Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - A guide to stay calm • Jan Bakker

  • Microsoft Entra ID Will Retire SMS and Voice Authentication • Rudy Mens

  • Passkeys Become the Default Auth Method in Microsoft Entra • AIMA

  • Microsoft are set to retire SMS & Voice authentication methods • Daniel Bradley

• Managing FIDO2 keys with nothing but PowerShell • Dr. Emin Huseynov

• Reviewing the State of Non-USB FIDO2 Devices on Linux • Dr. Emin Huseynov

• Self-Service Password Reset (SSPR) will require registered authentication methods from September 7th • Benoit HAMET

🚦 Conditional Access

• 📺 Conditional Access, Break-Glass, Legacy Auth, & Named Locations: Entra ID it in Action! • Travis Roberts

🖥️ Devices

• Taking Back Control: Managing the New Entra SSO Prompt in Windows via Intune • Per Larsen

• The long awaited DMA-SSO Admin Controls! • Joey Verlinden

• AutoAcceptSsoPermission: The Continue to Sign In Prompt Fix • Rudy Ooms

• Admin control for SSO prompts in Windows; finally, an off switch! • Jan Bakker

• Entra – Administrators can now control SSO prompts in Windows • Benoit HAMET

• Automatically Accept SSO Permissions – Jóhannes’s blog • Johannes Geir Kristjansson

• Windows BYOD Is Awesome- Here’s Why and How • Colby Pryor

🏙️ External ID - Guests & Multi-Tenant Organizations

• Don’t Delete the Guest Account: Reset Redemption Status in Microsoft Entra • Sreejith Reghunathan Pillai

🥷 Security

• 📺 Why You Keep Getting Microsoft Sign-In Requests (and the Fix) • Dean Ellerby

♻️ Sync

• Entra Connect Sync 2.6.84 released • Andres Bohren

• Entra ID – New Entra ID Connect Sync version (2.6.84.0) is available • Benoit HAMET

📒 Tenant Configuration

• NameCodex.app: Because Every Tenant Deserves Better Names • Matej Klemenčič

• 📺 Azure Files - The Proper Setup Guide (No Active Directory) • Jonathan Edwards

• 📺 Microsoft Entra ID important Updates (Aug 2026) • Andy Malone

🛍️ External ID - Customers

• Analysing Azure AD B2C custom policies to aid with migration to Entra External ID (EEID) • Rory Braybrook

🔥 Maester

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Big week for me personally. I shared why I left Microsoft and what’s next: I’m now working full-time on Maester, and Maester Cloud is officially on the way.

If you want to learn more, start with the Maester Manifesto. It explains where this is all heading. Then join the waitlist, or better yet, become a Founding Sponsor and get early access when Maester Cloud launches.

Also, don’t miss this week’s Entra Chat with Katie Knowles. Her research into Agent ID is some of the most interesting I’ve seen, and she breaks down exactly what Microsoft admins need to know as they are onboarding agents into their orgs.

Enjoy!

Sponsored by:

Cloud PKI & RADIUS, Built for the Microsoft Ecosystem

Passwordless Wi-Fi, VPN, and device trust run on certificates + RADIUS, but AD CS and NPS struggle with Entra-only & cloud-first environments. EZCA and EZRADIUS by Keytos deliver both as a fully managed service.

• Native Entra ID & Intune integration for automated certificate management

• Extend or fully replace Microsoft Cloud PKI, AD CS, & NPS

• Integrates with 3^rd party MDM platforms like Jamf Pro & NinjaOne

• BYOD onboarding with Keytos Connect - no MDM or work profile required

• Available in Azure Government Cloud (GCC High)

• Free, fully-featured 30-day trial - no credit card required

Ready to modernize your PKI and RADIUS? See how Keytos fits your Microsoft environment.

Learn More

⚡️ Microsoft

🏆 General Availability

• External users can be directly assigned to Access Packages

• Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows

• BYOD support for Windows client using Entra registration

• Jailbreak/Root Detection in Authenticator App

• Domainless SAML IdP federation for workforce tenants

• SCIM 2.0 APIs for Microsoft Entra ID in US Gov cloud

• Microsoft Entra Backup and Recovery is now available

• Upcoming change - Improved restore experience for device-bound Authenticator app passkeys on iOS

🔥 Public Preview

• Extended Conditional Access protections for Agent’s user accounts

• New built-in Entra role for SOC identity response in Microsoft Defender

• Prevent unauthorized changes to AD groups with AD group enforcement

📖 Read

• Govern AI agent identities and access the same way you govern your employees • Chirag Dayani

• Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative • Salim Chawro

• 5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management • Microsoft Security Team

🗣️ Message Center

• MC1422061 - Microsoft Entra ID: Retirement of Custom Controls in Conditional Access and migration to External MFA

• MC1423108 - Microsoft Entra: Improved restore experience for Authenticator passkeys on iOS

• MC1418116 - Completed: Conditional Access enforcement update for policies with resource exclusions

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

Sponsored by:

The Identity Sync & Windows Workstation Migrations Solution

ADMT unsupported. MIM nearing end of life. It’s time to modernise your migration approach.

With PowerSyncPro successfully deliver identity and device migrations designed for modern Microsoft environments with confidence and reducing TCO.

✔ DirSync - Synchronise users, groups, contacts and passwords across environments to support coexistence, staged migrations and complex identity scenarios.
✔ Migration Agent - Move Windows devices between AD Joined, Hybrid and Entra Joined states while reducing disruption and preserving the end-user experience.

Built for delivering enterprise migrations at scale.

See PowerSyncPro in action

From the community…

🚀 Most popular posts from last week

• 🥇 A New Face for Risky User Management in Microsoft Entra • Colby Pryor

• 🥈 How To Enable And Roll Out Microsoft Authenticator Passkeys In Microsoft Entra ID: A Step-by-Step Guide • Charbel Nemnom

☀️ Learn

👩‍✈️ AI & Copilot

• EntraPulse Polyarchy - an Entra ID Polyarchy MCP Server - darrenjrobinson • Darren Robinson

ID Governance

• KB - employeeLeaveDateTime show empty (null) • Jan Bakker

📦 Apps

• Using “Entra Local” with the MSAL libraries | by Rory Braybrook | The new control plane | Jul, 2026 • Rory Braybrook

🫆 Authentication

• Microsoft Entra ID Retires Custom Controls For External MFA • Daniel Bradley

• Using “Entra Local” with device code flow | by Rory Braybrook | The new control plane | Jul, 2026 • Rory Braybrook

• Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect • Jan Bakker

• Does anyone even use GitHub for federated authentication? • Sapir Federovsky

👥 User & Group Management

• Groups: The Connective Tissue of Microsoft 365 • Jonathan Hope

🤖 DevOps & PowerShell

• Use M365Mutator to Make Microsoft 365 Test Data Less Boring • Tony Redmond

• How to Report Managers and Direct Reports from Entra ID • Tony Redmond

🚦 Conditional Access

• Conditional Access Optimization Agent | Security Copilot | Entra ID • Michael Frank

• Why you Shouldn’t bypass MFA for your office IP adresses • Daniel Bradley

• 📺 Master Conditional Access in Entra ID: Assignments, Conditions, Controls! • Travis Roberts

🥷 Security

• Entra Agent ID: Protect, detect, respond • Katie Knowles

• Entra ID User App Config Abuse • Elli Shlomo

• How the Microsoft Baseline Security Mode Left Ghost Policies in Entra ID • Michael Morten Sonne

• DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation • ZeroBEC Team

♻️ Sync

• Entra – Reminder to start migrating to Cloud Sync and Exchange writeback • Benoit HAMET

• Troubleshooting Entra Connect permissions sync errors • Aaron Guilmette

🔥 Maester

• Announcing Maester Cloud

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra.Chat, Merill speaks with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Katie explains the blueprint, blueprint principal, agent identity, and agent-user relationships before walking through a cross-tenant compromise demonstration: compromised blueprint credentials, enumeration of associated agents, token requests in trusting tenants, permission inspection, and selection of a useful target identity.

That path does not automatically grant Global Administrator access. Its impact depends on what the target agent identity has been permitted to do. The important lesson is the control point: one blueprint can sit upstream of many identities, tenants, and permission sets.

Katie and Merill also discuss tenant-owned versus vendor-owned blueprints, the Agent ID Administrator role, first-party agent creation through Microsoft platforms, why production client secrets compound the blast radius, workload identity federation, separating blueprints by risk, reusing app-registration detections, and Microsoft Entra ID Protection for agents.

REGISTER: Hidden Risk of App Permissions in Entra ID

Many Microsoft Entra ID environments contain third-party and custom applications with permissions that are broader than necessary, and most organizations lack visibility into how those permissions are being used. Excessive Microsoft Graph permissions and unused access increase the risk of OAuth abuse and privilege escalation.

Join our live session on July 22 to learn how to:

• Evaluate delegated versus application permissions

• Build an effective app governance strategy

• Reduce unnecessary access without disrupting users

You’ll also see how a free AppGov Score assessment can help identify governance gaps and where unused permissions reporting fit into a least-privilege approach.

Save my Seat

Subscribe with your favorite podcast player or watch on YouTube

About Katie Knowles

Katie Knowles is a Senior Security Researcher at Datadog focused on Azure security research, cloud identity, and securing emerging technologies.

• LinkedIn - https://linkedin.com/in/kaknowles

• X/Twitter - https://twitter.com/_sigil

• GitHub - https://github.com/siigil

• Website - https://kknowl.es/

• Microsoft MVP profile - https://mvp.microsoft.com/en-US/MVP/profile/a3547b6a-6a4d-4aa0-840f-23b858c43c8b

Related Links

• Entra Agent ID: The blueprint blast radius (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-blueprint-blast-radius/

• Entra Agent ID: Inside a cross-tenant agent compromise (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-inside-agent-compromise/

• Entra Agent ID: Protect, detect, respond (mentioned at 51:39) - https://securitylabs.datadoghq.com/articles/agent-id-protect-detect-respond/

• Disable agent identities in your tenant (mentioned at 04:00 and 49:33) - https://learn.microsoft.com/entra/agent-id/disable-agent-identities

• Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account (mentioned at 05:14) - https://redcanary.com/blog/threat-detection/entra-id-ai-workflows-teams/

• Entra Agent ID from a Security Perspective (mentioned at 20:38) - https://blog.compass-security.com/2026/06/entra-agent-id-from-a-security-perspective/

• Spying On Your ISVs Credential Choices (mentioned at 38:11) - https://ericonidentity.com/2025/01/13/spying-on-your-isvs-credential-choices/

• Who Are the Robots? Uncovering AI Agents Identities (mentioned at 51:39) - https://www.youtube.com/watch?v=mMxACHKIAwY

• AzTier (mentioned at 51:39) - https://aztier.com/

• Microsoft Entra Agent ID key concepts - https://learn.microsoft.com/entra/agent-id/key-concepts

• Workload identity federation - https://learn.microsoft.com/entra/workload-id/workload-identity-federation

• ID Protection for agents - https://learn.microsoft.com/entra/id-protection/concept-risky-agents

Related Entra.Chat Episodes

• If You Manage Entra Permissions, Watch This Before Deploying Agents - https://entra.news/p/if-you-manage-entra-permissions-watch

• From Windows Core to Leading Agent ID: Vince Smith’s Microsoft Story - https://entra.news/p/from-windows-core-to-leading-agent

• Attackers Are Targeting the AI Ecosystem You Cannot See - https://entra.news/p/attackers-are-targeting-the-ai-ecosystem

Chapters

00:00 Intro

01:12 Katie’s Three-Part Agent ID Research

05:40 Agent ID Objects Under the Hood

06:24 One Blueprint, Many Agent Identities

08:43 The Multitenant Trust Boundary

17:33 Cross-Tenant Compromise Walkthrough

28:29 First-Party and Third-Party Blueprints

36:56 Stop Using Client Secrets

38:40 Workload Identity Federation

46:24 Permissions and Privilege Boundaries

49:33 Detecting and Responding to Agent Abuse 51:29 What Comes Next for Agent ID

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Some cool new features dropped this week and we also have Entra Backup and Recovery going GA.

Plus don’t forget to check out this week’s podcast. It’s a fascinating discussion with Thomas Roccia on AI threat intelligence and AI agent security.

Enjoy!

Sponsored by:

OneDrive Delegation Without the Time Travel

Granting OneDrive access with Microsoft’s native tools means clicking from the M365 Admin Center into SharePoint Admin, digging under “More features” → “User Profiles”, and landing in a portal whose UI hasn’t changed since 2010 - minutes of hunting for a one-second setting.

EasyEntra brings OneDrive management back to the future:

☁ Delegate OneDrive access in seconds - no portal maze
☁ Works for hybrid and cloud-only accounts alike
☁ No SharePoint Admin Center, no classic User Profiles detour
☁ Available directly in user properties with instant loading
☁ Free to use for smaller tenants - no license required

One place, one click, zero detours - download EasyEntra and never open the classic SharePoint portal again.

“This is the best software ever.”
CIO, Care Alliance Health Center, United States

Download EasyEntra

⚡️ Microsoft

🏆 General Availability

• Microsoft Entra Backup and Recovery is now generally available • Cindy Crane

🔥 Public Preview

• Bring business logic into PIM role activation workflows • Kaitlin Murphy

• Protect sensitive data in motion across SaaS and AI apps with Microsoft Purview and Microsoft Entra • Sule Tatar

📖 Read

• Securing AI agents: When AI tools move from reading to acting • Microsoft Incident Response

• ​​What’s new in Microsoft Security: June 2026 • Alym Rayani

• Improving security posture across the Microsoft partner ecosystem • Raji Dani

🗣️ Message Center

• MC12825068 - General Availability: Microsoft Entra passkeys on Windows (Updated)

• MC1409305 - Microsoft Entra: Blocking new assignments to partner tier support roles

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

• RM566869 - Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

Sponsored by:

Move beyond legacy identity and Windows migration approaches.

PowerSyncPro helps organisations modernise with a cloud-native approach to identity synchronisation and Windows migration, supporting transitions across AD, Entra ID, Microsoft 365 and hybrid environments without unnecessary disruption.

• Support big bang, phased and self-service migrations

• Move devices to Entra Join while retaining user experience

• Reduce manual effort and migration complexity

• Drastically reduce support burden in migration projects

• Operational dashboards track migrations in near real time

• Full logging capability automatically available for all migrating devices

• Supports commercial cloud, GCC, GCC High & 21 Vianet

Not sure where to begin? Start with our Getting Started Guide [https://powersyncpro.com/getting-start-migration-agent?utm_source=entra_news&utm_medium=email&utm_campaign=entra_july6] and explore the Architecture Advisor [https://powersyncpro.com/architecture-advisor?utm_source=entra_news&utm_medium=email&utm_campaign=entra_july6] to plan your migration path.

Book a demo

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Entra Connect Sync – Passwordless Authentication – now supported! • Michael Morten Sonne

• 🥈 Your iPhone Can Manage Passkeys on a YubiKey. Yubico’s Own App Just Won’t Let It • Dr. Emin Huseynov

• 🥉 Bypassing Conditional Access policies that have a resource exclusion • Dirk-jan Mollema

☀️ Learn

👩‍✈️ AI & Copilot

• Security Copilot • Michael Frank

• EntraPulse: Tenant Profiles, Lokka 2.0 Interactive Apps, and Microsoft Enterprise MCP - darrenjrobinson • Darren Robinson

• 📺 Episode 431: Agent Governance Is the New App Governance • Microsoft Cloud IT Pro Podcast

🧰 Workload ID

• Monitoring Microsoft Entra Application Secrets Across Multiple Tenants with Azure Automation • Dominic Eames

• Authenticating AWS Workloads to Azure Functions using Workload Identity Federation • Kasturi

• 🎙️ Ctrl+Alt+Azure | 349 - Back to basics: Managed identities vs. Service Principals vs. App Registrations • Jussi Roine and Tobias Zimmergren

• Cross Tenant Microsoft Graph Access Using Federated Identity Credential • Brian Veldman

⛑️ ID Protection

• A New Face for Risky User Management in Microsoft Entra • Colby Pryor

👮‍♂️ ID Governance

• Microsoft Purview Adds Native Role Assignment Time Limits • Daniel Bradley

• How to use Azure Functions to run PowerShell scripts in Entra ID Governance • Christian Frohn

🌐 Private Access & Internet Access (GSA)

• Entra ID – You can now use your own device (BYOD) with global secure access to connect to private access profile • Benoit HAMET

• RM566528 - Microsoft Purview: Data Loss Prevention - Extend Purview data security to the network layer via Entra GSA integration

🫆 Authentication

• Microsoft Entra ID SSPR Will Require Registered Authentication Methods • Rudy Mens

• How To Enable And Roll Out Microsoft Authenticator Passkeys In Microsoft Entra ID: A Step-by-Step Guide - CHARBEL NEMNOM - MVP | MCT | CCSP • Charbel Nemnom

• 📺 Passwords Alone DON’T WORK! Secure M365/Azure with Entra ID MFA! • Travis Roberts

• 📺 The Passwordless Trap: Why Passkeys Break Entra ID SSPR! • Azure Brother

🥷 Security

• I didn’t REALLY understand FOCI & BroCI… until now (Kinda) • Sapir Federovsky

• 📺 90% of MSPs Handle Admin Access The Wrong Way (Fix It!) • Jonathan Edwards

• 📺 Secure containers from code to runtime • Microsoft Mechanics

• 📺 Zero Trust security for AI agents • Microsoft Mechanics

📒 Tenant Configuration

• Microsoft Entra Backup and Recovery and How to Use It • Mark Oldham

• Add some BAESL to your M365 Sandbox! • Colby Pryor

• Microsoft 365 Business Standard vs Premium (2026 Update) • Rudy Mens

🛍️ External ID - Customers

• Getting a checklist before Azure AD B2C migration using EntraExporter • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

It is also about attackers targeting the agent ecosystem most organizations cannot see clearly yet: MCP servers, agent skills, packages, API keys, prompts, tools, and the identity layer underneath all of it.

In this episode, I sit down with , founder of Security Break and a former Microsoft threat researcher, to look at AI agents from the threat-intelligence side. Thomas explains why the easiest path for attackers may not be futuristic autonomous hacking. It may be the boring weak spots that already exist: malicious packages, untrusted MCP servers, hostile agent skills, leaked API keys, and AI-generated code that chooses the fastest path instead of the safest one.

For Entra admins and security teams, this is where Agent ID, non-human identity, workload identity, logging, sponsorship, and governance start to matter. Entra Agent ID gives teams a way to identify and govern agents, but identity is only one part of the picture. You still need to understand what agents can discover, what tools they can call, what context they consume, and whether you can replay what they actually did.

Thomas also breaks down his practical AI threat-intelligence work, including how teams can use agents for CTI, how adversarial prompts and context flooding change the risk model, and why defenders need to understand the attacker side of agent security before these systems become invisible production infrastructure.

Sponsored by

Secure BYOD Wi‑Fi Without MDM enrollment

Keytos Connect is a new mobile and desktop app that makes it easy for users to connect personal and BYOD devices to enterprise and campus Wi‑Fi without shared passwords, manual certificate installs, or traditional MDM enrollment. Users simply download the app, sign in with their work or school account, and Keytos handles the rest. It also works alongside Intune, allowing organizations to continue managing corporate-owned devices while simplifying connectivity for personal devices.

• Connect in minutes: users download the app, sign in, and get securely onboarded to Wi‑Fi

• No MDM required: enable secure access for personal devices without giving IT full control of them

• Works alongside Intune: keep your existing management workflows for corporate devices while enabling secure BYOD access

• Automatic certificate management: certificate issuance and renewal happen behind the scenes

• Secure by default: EAP-TLS authentication eliminates shared Wi‑Fi passwords and provides unique credentials for every user

• Multi-OS: Available across iOS, Android, Windows, and macOS devices

• Included at no additional cost with existing EZRADIUS and EZCA subscriptions

Learn more about Keytos Connect and see how easy secure BYOD connectivity can be.

Learn more about Keytos Connect

About Thomas Roccia

Thomas Roccia is a threat researcher and founder of SecurityBreak, focused on AI threat intelligence, malware analysis, and AI agent security. He previously worked in incident response, malware analysis, threat intelligence, Microsoft Defender, and AI threat research. He is also the author of Visual Threat Intelligence and teaches practical AI for threat intelligence and agentic workflows.

LinkedIn - https://au.linkedin.com/in/thomas-roccia

Subscribe with your favorite podcast player or watch on YouTube 👇

Related Links

• Thomas Roccia on LinkedIn - https://au.linkedin.com/in/thomas-roccia

• SecurityBreak - https://securitybreak.io/

• Practical AI for Threat Intelligence training - https://securitybreak.io/training-genai

• SHIELD.md: A Security Standard for OpenClaw and AI Agents - https://blog.securitybreak.io/shield-md-a-security-standard-for-openclaw-and-ai-agents-b38637031460

• Microsoft Entra Agent ID - https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id

• Microsoft Entra Agent ID key concepts - https://learn.microsoft.com/en-us/entra/agent-id/key-concepts

• Agentic Resource Discovery specification - https://agenticresourcediscovery.org/

• GitHub Agent Finder - https://github.blog/changelog/2026-06-17-agent-finder-for-github-copilot-now-available/

Chapters

00:00 Intro

00:33 Meet Thomas Roccia

01:48 From Malware Analysis to AI Threat Intel

03:30 Why AI Security Is Moving So Fast

05:49 Agentic Resource Discovery and New Standards

09:25 Attackers Are Already Using AI Agents

11:47 The AI Ecosystem Is The Target

15:26 Prompt Injection, MCP, Skills, and API Keys

20:28 Vibe Coding vs Production Security

23:47 Agent ID and Identity for AI Agents

32:30 Practical AI for Threat Intelligence

39:13 Monitoring Agents Like Threat Actors Do

42:28 Context Flooding and What’s Next

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

We are light on news from Microsoft but there are some excellent posts from the community this week especially around security including Dirk-jan and more.

Enjoy!

Sponsored by:

Announcing Hacker Summer 2026

Altered Security HackerSummer is a month-long Red Teaming event designed for red teamers, security professionals and enthusiasts. Throughout the month we will share resources to understand, practice and analyze Red Team techniques and tactics for on-prem, Azure and AI.

What to expect during the month:

• Five Free Red Team Webinars with hands-on labs (July 4th, 11th, 17th, 24th and 31st).

• Flat 20% OFF on all On-Demand Courses and Bootcamps - 20th July to 5th Aug 2026

• A chance to present your research in front of peers by responding to the Call for Papers.

Get ready for a month full of red team research, webinars, blog posts, giveaways and discounts!

Know More

⚡️ Microsoft

📖 Read

• Secure AI at scale: Join the Microsoft Entra + Purview webinar series • Diana Vicezar

📺 Watch

• 📺 Strengthen your security posture with Microsoft Entra Conditional Access • Swaroop Krishnamurthy

• 📺 AI-Powered Identity Security and Live Demos of Security Copilot in Microsoft Entra • Luca Spolidoro and Mamta Kumar

🗣️ Message Center

• MC1400649 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions

• MC1325414 - Microsoft Entra ID SSPR will require registered authentication methods starting September 7, 2026

• MC1400824 - Microsoft Entra: Self-service password reset CAPTCHA protection updated

Sponsored by:

How Mature Is Your Microsoft Governance?

Do you know where your biggest Microsoft 365 governance and Entra ID application risks are in your tenants? How exposed is your organization and its data?

ENow has TWO free Microsoft governance assessments:

1. One benchmarks your Microsoft 365 governance posture across SharePoint, OneDrive, and Teams workloads

2. The second uncovers unknown and overlooked application governance risks across Microsoft Entra ID.

No cost. Just actionable insights you can share with your team in minutes.

Get My Free Scores

From the community…

☀️ Learn

👩‍✈️ AI & Copilot

• 📺 Agent ID in Microsoft Entra: Securing the Identity of AI Agents • Microsoft Security Community and Vijaya Lakshmi Nukula

📦 Apps

• Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA • Jan Bakker

🫆 Authentication

• Your iPhone Can Manage Passkeys on a YubiKey. Yubico’s Own App Just Won’t Let It • Dr. Emin Huseynov

🤖 DevOps & PowerShell

• Using Graph Delta Queries with Entra ID Groups • Tony Redmond

🚦 Conditional Access

• 📺 New Entra ID Conditional Access Features June 2026 • Andy Malone

🥷 Security

• Bypassing Conditional Access policies that have a resource exclusion • Dirk-jan Mollema

• Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication • Thomas Byrne

• Zero Trust - Data as the Trust Boundary • Guillaume Bossiroy

• Secure And Monitor Your Microsoft Copilot Studio AI Agents Real Time • Michael Vink

• From ESTS Cookie Replay to Inbox Persistence • Elli Shlomo

• Azure AD Graph Activity Logs: detecting directory enumeration • Terrance DeJesus

♻️ Sync

• Microsoft Entra Connect Sync – Passwordless Authentication – now supported! • Michael Morten Sonne

• Sync and seek: User matching in tenant migrations • Per-Torben Sorensen

🛍️ External ID - Customers

• Migrating from Azure AD B2C to Microsoft Entra External ID: Applications, Authentication Methods, Branding and Users (Part 1) • Mateusz Jendza

• Azure AD B2C to Entra External ID (EEID) migration tools • Rory Braybrook

⚒️ Toolkit

• 🛠️ GitHub - cmaneu/entra-local: A local Entra ID emulator for application developers that need to mock authentication • Christopher Maneu

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra Chat, Vince (the PM lead driving Microsoft Entra Agent ID) walks us back through a 25-year run at Microsoft: shipping beta products off a machine wired straight to the internet under a neighbor’s desk, owning the early RBAC and custom roles work that shaped Entra, surviving a couple of security incidents he mostly can’t talk about, and finally landing on the team building identity for AI agents.

Along the way he owns up to the one feature name he’d take back if he could, and shares the dead-simple trick he used as a junior dev to get senior engineers to answer his questions every single time.

But this isn’t just a war-stories episode. Vince breaks down why agents needed a brand-new kind of identity in the first place. An agent is a strange beast ‘as clumsy and unpredictable as a human, and as fast as a machine’ which means traditional anomaly detection looks at one and basically can’t tell if it’s a user or a workload gone rogue. His answer is the blueprint-and-instance model: one blueprint (think app registration) spinning up many scoped, least-privilege instances, instead of a bazillion app registrations or one over-permissioned service principal that can read everyone’s mailbox. And if you’re wondering why this matters now, Vince makes the case that as users move to passkeys, attackers just slide to the other end of the balloon: non-human identities and workloads. That’s the new frontier.

So what should you actually do Monday morning? His advice is refreshingly un-precious: don’t wait for the perfect plan. Start green, set a standard for every new agent so you stop the bleeding from shadow AI, then stay green and slowly get green by cleaning up the mess behind you. Even just stamping a unique identifier on your agents today buys you the observability you’ll desperately want later.

Be the river that flows around the rocks.

There’s a lot more in the full conversation including how Agent ID and Agent 365 actually fit together, and how Vince came up to speed on a space that’s moving too fast to write a book about. Give it a watch.

About Vince Smith

Vince Smith is the PM Lead for Agent ID at Microsoft. A self-described computer nerd and Gen Xer, Vince has been with Microsoft since late 1999, working on everything from Windows Core and GDPR to multi-tenant collaboration and identity protection.

LinkedIn - https://www.linkedin.com/in/vincecsmith/

🔗 Related Links

• Entra Agent ID - https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id

• Agent 365 - https://www.microsoft.com/en-us/microsoft-agent-365

📗 Chapters

06:23 Provisioning vs. Federation

10:25 The Need for Agent ID

17:28 Blueprints and Multi-Instancing

23:55 Demystifying Agent 365

26:56 The Threat of Non-Human Identities (NHI)

33:08 Planning Your Enterprise AI Strategy

36:14 Defining a “Start Green” AI Plan

40:45 The Best Way to Learn Complex Tech

45:13 The Wild World of CIAM

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill