There are some important updates in this week’s Message Center posts, so be sure to check them out and prepare for the changes.

Don’t forget to queue up this week’s Entra Chat featuring the legendary Sean Metcalf, and hear his top tips for hardening Entra ID in 2026.

Enjoy!

Sponsored by:

Uncover Risky Entra ID Apps Faster

Most Microsoft 365 tenants accumulate hundreds of enterprise applications, with OAuth permissions granted over time and ownership left undefined. Security teams often lack visibility into which apps access mailboxes, files, or user data, and which introduce risk.

Native tools provide pieces of this data, but not a unified view. That gap makes consistent application governance hard to maintain.

AppGov Score assesses your Entra ID application landscape. Identify high-risk permissions, detect unused or overprivileged apps, and surface ownership gaps so you can prioritize remediation based on real exposure.

Attending the Microsoft 365 Community Conference in Orlando? Visit ENow at booth #617 to see how teams are strengthening application governance while enabling their users.

Get Your App Risk Score

⚡️ Microsoft

🔥 Public Preview

• Authorize SFTP access to blobs using Microsoft Entra ID (preview) - Azure Storage • Microsoft Learn

📖 Read

• What’s new in Microsoft Entra – March 2026 • Shobhit Sahay

🗣️ Message Center

• MC1282568 - General Availability: Microsoft Entra passkeys on Windows

• MC1225192 - Microsoft Entra ID Governance: Azure subscription required to continue using guest governance features

• MC1221452 - (Updated 15 Apr) Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants

• MC1279092 - Microsoft Entra: Passkeys in registration campaigns update

• MC1255405 - Microsoft Edge for Business: Cross-tenant support using Intune Mobile Application Management (MAM)

• MC1223829 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions - The new Baseline scope configuration is now available to preview the enforcement behavior before it is enabled by default.

From the community…

🚀 Most popular posts from last week

• 🥇Microsoft Security Copilot for M365 E5/E7 recommendations from the field • Derk van der Woude

• 🥈Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration – Compass Security Blog • Christian Feuchter

• 🥉How to Track Changes in Microsoft 365 Groups • Tony Redmond

Sponsored by:

Would you bet your reputation on your current Microsoft 365 security posture?

Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

You could assume it’s fine.

Or you could run the Microsoft 365 Security Posture Check.

It’s free.

It runs locally.

And no, it doesn’t send your tenant data back to us.

We’ll even help you set it up.

Get yours here

☀️ Learn

👩‍✈️ AI & Copilot

• A Deep-Dive into Entra Agent ID Authentication • Derk van der Woude

🧰 Workload ID

• Block or limit multi-tenant and consumer applications in Entra ID • Jan Bakker

• Who Created That Service Principal? Tracing It Back with Microsoft Graph • Shannon Kuehn

👮‍♂️ ID Governance

• Beyond Basic SCIM: Custom Role and Warehouse Mapping with Microsoft Entra ID and Snowflake • Parshu Anantharam

• Making Lifecycle Workflows State-Aware with State Groups • Patrik Jonsson

🌐 Private Access & Internet Access (GSA)

• Why you should enable the Microsoft Traffic Forwarding Profile • Chris Brumm

📦 Apps

• Block Multi-Tenant and Consumer Applications in Microsoft Entra • Shanchana

• Getting the Group Claims when authenticating with Microsoft Graph • Brian Veldman

• 📺 Entra ID Integrated SFTP (16 min) • John Savill

• 📺 Device Authentication Flows in Microsoft Entra (12 min) • Colby Pryor

🫆 Authentication

• Any user can disable passkeys in Windows. Completely. No admin rights needed. • Dr. Emin Huseynov

• Prevent disabling passkeys on Windows • Dániel Kovács

• Microsoft Entra Passkeys: Registration Campaign Delays Explained • Daniel Bradley

• Synchronizing Forced Password Changes from AD to Entra ID for AVD and Cloud PC Access – All about Endpoint Management • Eswar Koneti

• 📺 Are passkeys as secure as you think? (43 min) • Fabian Bader

• 📺 How to Handle Upcoming Entra Passkey Changes [Defaults Fail] (17 min) • Ru Campbell

• 📺 Not Another Tech Podcast - Synced Passkeys (38 min) • Andy Kemp, Nate Hutchinson

👥 User & Group Management

• Customize Microsoft 365 Profile Cards with Division, Role & Employee Type using Entra ID • Sreejith Reghunathan Pillai

• Entra ID – You can now synchronize groups with cross-tenant capability • Benoit Hamet

• 🛠️ I built a free Microsoft Entra ID tool that finds roles Microsoft hasn’t documented yet • Antonio Russo

🤖 DevOps & PowerShell

• Writing PowerShell for the Eventually Consistent Entra ID Database • Tony Redmond

• Complete Microsoft 365 PowerShell Environment Setup • Tiago S. Carvalho

🚦 Conditional Access

• Common Entra ID Security Assessment Findings – Part 4: Weak Conditional Access Policies • Christian Feuchter

• Conditional Access, or how to stop playing security Whac-A-Mole • Åsne Holtklimpen

• Your Conditional Access Device Filters Are a Paper Wall • Rawson Wade

🏙️ External ID - Guests & Multi-Tenant Organizations

• Manage external users in your Microsoft 365 tenant • Erik Lindeboom

📒 Tenant Configuration

• 📺 Microsoft FINALLY Adds Entra Backup… But Wait (8 min) • Jonathan Edwards

• 🛠️ TrustM365 - Baseline, Detect, Restore for M365 • Anthony Porter

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

About Sean Metcalf

Sean Metcalf is the Identity Security Architect at TrustedSec and a renowned expert in Microsoft identity security. He holds the rare Certified Master in Active Directory certification and has spoken at major security conferences including Black Hat, DEF CON, and BlueHat on how to defend cloud and hybrid environments.

LinkedIn - https://www.linkedin.com/in/seanmmetcalf/

🔗 Related Links

• Securing Entra ID Administration: Tier 0 - https://trustedsec.com/blog/securing-entra-id-administration-tier-0

• Managing Privileged Roles in Microsoft Entra ID: A Pragmatic Approach - https://trustedsec.com/blog/managing-privileged-roles-in-microsoft-entra-id-a-pragmatic-approach

• Improve Entra ID Security More Quickly - https://adsecurity.org/?p=4825

• Microsoft Graph Skill - https://graph.pm

📗 Chapters

00:04:05 AI and the Evolution of Attacks

00:06:42 The Importance of Hardening Fundamentals

00:12:03 Securing Entra ID Quickly

00:16:24 Protecting Tokens with VBS and TPM

00:19:58 Restricting Consent and Guest Users

00:23:40 Managing Rogue Tenants

00:27:36 Cloud Admin Workstation Strategies

00:34:14 Delegated Admin Privileges

00:44:32 The Danger of Application Permissions

00:57:06 Artemis Mission Trivia

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

There’s quite a bit from the community this week, including a mix of agents, some solid deep dives into Conditional Access gaps and identity attack paths, and a few practical security findings from the field.

From Microsoft: the planned rollout for passkeys in Microsoft registration campaigns (MC1253746) has been paused for now. Read the post below for more info.

Also, this week’s Entra Chat podcast is with Per-Torben Sørensen. We go deep on designing Conditional Access policies. You’ll likely come away with at least one new idea to apply. Worth adding to your podcast queue.

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• Protect enterprise generative AI applications with prompt injection protection

📖 Read

• Plan for change – Agent Registry consolidation into Microsoft Agent 365

• As AI adoption scales, is your access strategy still viable? • Kaitlin Murphy

• Inside an AI‑enabled device code phishing campaign • Microsoft Defender Security Research Team

🗣️ Message Center

• MC1253746 - Microsoft Entra: Passkeys in Microsoft registration campaigns - Updated April 9, 2026: After further review, we have decided not to move forward with this change at this time. We will communicate via a new Message center post when we are ready to proceed. We apologize for any inconvenience this may cause and appreciate your understanding.

From the community…

🚀 Most popular posts from last week

• 🥇Hidden Gem in Microsoft Entra Conditional Access: Authentication context • Henrik Piecha

• 🥈Conditional Access Policies are the Best Way to Block Weekend Access to Microsoft 365 • Tony Redmond

• 🥉Managing Shared Mailbox Access with Entra ID Governance • Christian Frohn

Sponsored by:

Book a demo

☀️ Learn

👩‍✈️ AI & Copilot

• Microsoft Entra Agent ID Blueprints and Microsoft Foundry: A Security Guide • Jonas Bøgvad

• Microsoft Security Copilot for M365 E5/E7 recommendations from the field • Derk van der Woude

• Using the Microsoft 365 Connector for Claude • Tony Redmond

• 📺 Introduction to Agent 365 SDK - Microsoft Community Learning (9 min) • MK Bajwa

💳 Verified ID

• Cross-Device Identity Verification via Entra Verified ID in a Multi-Agent System • Mateusz Jendza

• Entra Verified ID Upgrade signing key to become FIPS compliant • Andres Bohren

⛑️ ID Protection

• Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration – Compass Security Blog • Christian Feuchter

• Continuing the Sentinel & MCP Series: Hunting Identity Risk and Password Sprays • David Alonso Dominguez

🌐 Private Access & Internet Access (GSA)

• KB – Entra Private Access Session persistence • Jan Bakker

• 📺 Network-layer data protection with Microsoft Entra GSA and Purview DLP (18 min) • Dominik Hoefling, Heike Ritter

📦 Apps

• How to Assign Application Admin to Specific Enterprise Apps • Daniel Bradley

• Leverage User and Group Assignments to Limit User Access to Apps • Tony Redmond

• 🎙️ Entra app sprawl - HIP Podcast • Sander Berkouwer, Sean Deuby, Raymond Comvalius

🫆 Authentication

• Device-preferred Credential Logic in System-preferred MFA • Shanchana

• System & Device-preferred Authentication • Michael Frank

• 📺 Your MFA Is Already Broken - Microsoft Just Didn’t Tell You (2 min) • Azure Academy

👥 User & Group Management

• How to Track Changes in Microsoft 365 Groups • Tony Redmond

• Manage Microsoft 365 Groups Using a PowerShell Script • Blesslin Rinu

🚦 Conditional Access

• Break-Glass Accounts Done Right: Securing Emergency Access in Microsoft Entra • Sebastian Flæng Markdanner

• Conditional Access: Location, Location, Location - and the Gaps We Create • Jon Hope

• Demonstrating CA Policy Gaps using AADInternals • Anton Willoughby

🏙️ External ID - Guests & Multi-Tenant Organizations

• 📺 Automate Entra ID Guest Audits (Azure Automation + Graph API) (8 min) • Azure Brother

🥷 Security

• MyStaff - hidden admin portal ?? • Jay Kerai

• IAM the Captain Now – Hijacking Azure Identity Access • Justin Mahon

• 🛠️ GoXDR - KQL Query Library • Göksel Atakan

♻️ Sync

• Entra Connect Sync 2.6.3 released • Andres Bohren

📒 Tenant Configuration

• Microsoft Finally Built Native Backup into Entra ID • Moe Kinani

• 📺 Entra Backup and Recovery in Preview: Don’t Miss This (4 min) • Peter Rising

• 📺 Entra ID Backup. What you Need to Know! (12 min) • Andy Malone

• 📺 Entra ID Tenant Governance is Here! (11 min) • Colby Pryor

• 📺 How to Audit Microsoft Entra with CIS Benchmark v6.0.1 (58 min) • Mario Bien-Aime

🛍️ External ID - Customers

• On Entra External ID (EEID) federation with Entra ID • Rory Braybrook

🔥 Maester

👨🏽‍💻 Merill’s corner

In Melbourne this week? I’ll be presenting a short session on MCP auth at the Identity Management Day Summit.

Come say hi! Register here.

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode of Entra Chat, Microsoft MVP Per Torben walks through the conditional access mistakes he sees even large enterprises making, and the practical framework he actually uses with customers.

You’ll learn how to set up emergency access accounts the right way, why your CA policies should be built more like a firewall than a checklist, and the one naming convention that makes managing dozens of policies actually manageable.

🎧 Hit play, your tenant will thank you.

Sponsored by:

Entra ID Gaps That Cause Outages

In Microsoft Entra ID, outages often start small: an expired client secret, a lapsed certificate, or a suddenly failing integration. Traditional controls don’t track credential expiry or enforce application ownership, so issues appear only after something breaks.

Teams are left asking:

• Which applications can access Microsoft 365 data?

• Is that access still appropriate?

• Who owns the app?

Unclear answers stall reviews, weaken accountability, and slow delivery.

ENow App Governance Accelerator closes these gaps by highlighting expiring credentials, surfacing permission risks, and identifying ownership gaps before they disrupt operations. New Standard Tier pricing makes it accessible for organizations under 10,000 users, typically $3,500–$9,500 annually.

Explore Entra ID Gaps

About Per Torben

Per Torben is a Senior Architect at Crayon and a Microsoft MVP for Identity and Access. Based in Norway, he frequently writes highly-read posts featured on Entra.News and runs the collaborative tech blog “Agder in the Cloud”.

LinkedIn - https://www.linkedin.com/in/pertorbensorensen/

🔗 Related Links

• Agder in the Cloud - https://agderinthe.cloud

• I.D.E.A. for creating/configuring break-glass accounts

  • GitHub - https://github.com/Per-Torben/I.D.E.A.

  • Blog - https://agderinthe.cloud/2026/01/06/introducing-i-d-e-a-and-i-d-e-a-001/

• Protected actions: https://agderinthe.cloud/2025/02/12/protected-actions-adding-extra-guards-to-your-entra-id-gate/

• Conditional Access hardeing (series): https://agderinthe.cloud/2024/12/05/how-to-fix-the-fundamental-flaw-in-conditional-access-part-1-introduction-and-coverage-gaps
  CA geo filter (series): https://agderinthe.cloud/2025/11/06/diving-into-geo-filter-with-entra-conditional-access-part-1

• Entra Backup - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/backup-restore

📗 Chapters

06:22 The importance of Break Glass accounts

09:02 Securing emergency access with FIDO2 and RMAUs

18:10 Configuring Conditional Access: The “Block by Default” strategy

27:26 Managing scope and preventing accidental lockouts

29:31 Persona-based naming conventions for CA policies

35:38 Grouping settings and avoiding bloated policies

41:54 Handling exceptions and travel access with Access Packages

44:55 The flaw in Protected Actions for Conditional Access

53:38 Using the new Entra Backup feature for quick restores

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

Well folks, there’s a lot happening in the Entra world, we have over seven features becoming GA, a bunch of new public preview features, and an upcoming change to enforce CA policies during WHfB registration. Check them all out below.

BTW, I caught up with some Microsoft Entra MVPs to get their take on the big updates—queue it up on Spotify, Apple Podcasts, or watch on YouTube 👇

Enjoy!

Sponsored by:

Announcing the Month of Azure Red Teaming 2026

Altered Security Month of Azure Red Teaming is an initiative to raise awareness and spark discussion around one of the most critical and in-demand skillsets: Azure Red Teaming. Throughout the month we want to keep the community engaged to help infosec professionals and students understand, practice and analyze attack vectors in Azure.

What to expect during the month:

- Four Free Azure Red Team Webinars with hands-on labs (April 10th, 17th, 24th and 30th).

- Flat 20% OFF on the accoladed Azure Red Team certifications: CARTP and CARTE.

- Free labs on Altered Security’s Red Labs Platform

Get ready for a month full of free labs, webinars, blog posts, giveaways and discounts!

Know More

⚡️ Microsoft

🏆 General Availability

• Microsoft Entra expands SCIM support with new SCIM 2.0 APIs for identity lifecycle operations • Joseph Dadzie

• Microsoft Single Sign-On for Linux support for authenticating with Phish-Resistant MFA credentials

• New M365 group creation experience in My Groups

• Microsoft Entra Connect Health now enforces TLS 1.2

• General Availability: Social Identity Providers for Native Authentication via Browser‑Delegated Flows (web-view) in Microsoft Entra External ID • Sasha Mars

• Just‑in‑Time Password Migration in Microsoft Entra External ID

• Enabling Email and SMS OTP MFA in Entra External ID Native Authentication

🔥 Public Preview

• Phased Rollout with the Conditional Access Agent

• Passkey Adoption Campaigns with the Conditional Access Optimization Agent

• Microsoft Entra hybrid join using Microsoft Entra Kerberos

📖 Read

• Troubleshoot the Global Secure Access mobile client with Health check utility • Microsoft Learn

📺 Watch

• Developer Tools for Agent ID: SDKs, CLIs & Samples (37 min) • Kyle Marsh

• Self‑Service Account Recovery with Microsoft Entra (2 min) • Microsoft Security

🗣️ Message Center

• MC1260708 - Microsoft Entra ID: Improved readability for Authentication Methods Policy Update audit logs

From the community…

🚀 Most popular posts from last week

• 🥇Don’t let Entra ID Protection miss your next breach! • Nicola Suter

• 🥈Conditional Access: CA Analyzer Product Updates • Jon Hope

• 🥉How to Automate Inactive Guest User Removal in Microsoft 365 Using Power Automate • Dhinesh

Sponsored by:

Uncover Entra App Risk in Minutes

Most Entra ID tenants contain hundreds of applications with unclear ownership, excessive OAuth permissions, and long-lived secrets. These gaps are difficult to identify using native tools alone, especially at scale.

ENow’s AppGov Score provides a read-only assessment of your Entra environment using 24 Microsoft-aligned checks. It surfaces risky consent grants, privileged service principals, expired credentials, and ownerless apps, then translates findings into a clear, defensible risk score.

Instead of manual reviews or scripting, administrators gain immediate visibility into application sprawl and permission exposure, making it easier to prioritize remediation and improve governance across Microsoft 365.

Get Your App Risk Score

☀️ Learn

👩‍✈️ AI & Copilot

• Your Copilot Studio agent is acting as someone, do you know who? • Derk van der Woude

• 🎙️ Governing the Ungoverned: Agent 365 and Entra Agent ID • Jussi Roine & Tobias Zimmergren

🧰 Workload ID

• 🔐 SPIFFE & SPIRE: The Workload Identity Standard Quietly Powering Zero Trust • Sameer Bhanushali

👮‍♂️ ID Governance

• How to Extend Entra Provisioning to Apps Without SCIM or API • Nick Hunt

• Managing Shared Mailbox Access with Entra ID Governance • Christian Frohn

• 📺 Access Reviews Reimagined: What’s New in Microsoft Entra (6 min) • Peter Rising

🌐 Private Access & Internet Access (GSA)

• 🛠️ GSA Private Access Sizing Planner • Thomas Detzner

📦 Apps

• A Token of Appreciation - JWTs & Microsoft Authentication for Security Research • Tom Rolvers

🫆 Authentication

• Seamless Access: Using QR Code Sign‑In on Android Enterprise Shared Devices with Microsoft Entra • Nicky De Westelinck

👥 User & Group Management

• How to Configure Cross-Tenant Group Synchronization in Microsoft Entra ID • Karthi

• Ownerless Group Policy finally supported by the Graph API • Vasil Michev

🚦 Conditional Access

• Conditional Access Policies are the Best Way to Block Weekend Access to Microsoft 365 • Tony Redmond

• Hidden Gem in Microsoft Entra Conditional Access: Authentication context • Henrik Piecha

🖥️ Devices

• Microsoft Entra Hybrid Join Using Entra Kerberos – Step-by-Step Guide Without Sync Dependency • Sreejith Reghunathan Pillai

🏙️ External ID - Guests & Multi-Tenant Organizations

• 📺 Entra ID - Guest User Governance – Licensing Made Easy (2 min) • Julian Rasmussen MVP

📈 Reporting and Insights

• How to Report Entra ID Group Insights • Tony Redmond

🥷 Security

• Abusing Overly Permissive Roles in Azure File Sync • Christian Bortone

• Common Entra ID Security Assessment Findings – Part 2: Privileged Unprotected Groups • Christian Feuchter

• 🛠️ GoXDR - KQL Query Library • Göksel Atakan

♻️ Sync

• Hard Match & Sync Hijacking! The Part Everyone Skips Over • Moe Kinani

📒 Tenant Configuration

• Entra ID Backup and Recovery • Julian Rasmussen

• Introduction to Microsoft Tenant Governance part 1: basics and establishing relationships • Vasil Michev

• Introduction to Microsoft Tenant Governance part 2: tenant discovery and creation • Vasil Michev

• Microsoft Entra Backup and Recovery: Prerequisites, Backup, and Restore in Detail • Oliver Müller

• Tenant governance • Michael Frank

• 📺 Entra ID Free vs Premium in 2026 - Is Premium Worth It? (22 min) • Andy Malone

🔥 Maester

• Azure DevOps tests for Maester • Sebastian Claesson

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Join us as we talk to three world-class MVPs about their hands-on experience with the new Entra Backup and Recovery and Tenant Governance features.

Our Microsoft MVP guests Nathan McNulty, Ru Campbell, and Thomas Naunheim break down the most exciting new features in Microsoft Entra.

In this episode, we explore:

• The “Shadow Tenant” Problem: One org found 700+ Entra tenants they didn’t know they had.

• Version Control for Admins: Why “Difference Reports” are a total game-changer for troubleshooting.

• Recovery Safeguards: How to protect your tenant from accidental deletions and “sneaky” background changes.

• Backup & Recovery: The truth about Entra Backup vs. Third-Party ISV tools.

About The Guests

Nathan, Ru, and Thomas are highly experienced MVPs specializing in identity security, governance, and Microsoft Entra.

Nathan McNulty - LinkedIn - https://www.linkedin.com/in/nathanmcnulty/

Ru Campbell - LinkedIn - https://www.linkedin.com/in/rlcam/

Thomas Naunheim LinkedIn - https://www.linkedin.com/in/thomasnaunheim/

🔗 Related Links

• Microsoft Entra Backup and Recovery Documentation - https://learn.microsoft.com/en-us/entra/backup/overview

• Microsoft Entra Tenant Governance - https://learn.microsoft.com/en-us/entra/id-governance/tenant-governance/overview

• Synced Passkeys - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2

• Microsoft Work IQ CLI (Public Preview) - https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/workiq-overview

• Playwright https://playwright.dev/

• Entra Auth Tracer (Chrome Extension) - https://github.com/darrenjrobinson/EntraAuthTracer

• Unified Risk Score - https://learn.microsoft.com/en-us/defender-xdr/investigate-users#risk-score-tab-preview

📗 Chapters

00:00 Intro to New Entra Features

02:04 Entra Backup and Recovery Deep Dive

10:41 Difference Reports Explained

15:54 Intro to Tenant Governance

23:34 Managing Multi-Tenant Organizations

33:31 Conditional Access Optimization Agent

36:55 The Great Passkey Debate

47:22 Retirements: SP-less Auth & ACS for SharePoint

48:46 Unified Risk Score in Defender

52:38 MVP Tips of the Week

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

The big news this week is the official launch of Entra Backup and Recovery and Entra Tenant Governance, along with new updates to the CA Optimization Agent.

There’s an upcoming change that may impact applications using Microsoft Graph app-only permissions. Check out the blog post “Designing for Eventual Consistency” for more details.

Don’t forget to catch up on this week’s Entra Chat podcast with Emilien Socchi, where we dig into two of his interesting projects.

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• External MFA in Microsoft Entra ID is now Generally Available • Swaroop Krishnamurthy

🔥 Public Preview

• Strengthen Identity Resilience: Recover with Confidence using Microsoft Entra Backup and Recovery • Joseph Dadzie

• Microsoft Entra Tenant Governance: Secure and Manage Multi-Tenant Environments at Scale • Joseph Dadzie

• Evolving Identity Security: How the Conditional Access Optimization Agent Helps You Adapt • Swaroop Krishnamurthy

📖 Read

• Designing for Eventual Consistency for Microsoft Entra • Kyle Marsh

• Identity security is the new pressure point for modern cyberattacks • Rob Lefferts, Nadim Abdo

🗣️ Message Center

• MC1262589 - New M365 group creation and editing in My Groups

• MC1261596 - Notice: Security Copilot will be included as part of your Microsoft 365 E5 plan soon

• MC1260708 - Microsoft Entra ID: Improved readability for Authentication Methods Policy Update audit logs

• MC1248389 - Retirement of -Credential parameter when connecting to Exchange Online PowerShell

From the community…

🚀 Most popular posts from last week

• 🥇Microsoft Quietly Closes Another Loophole for Tenant Domain Enumeration • Daniel Bradley

• 🥈The Sad State of Microsoft Graph and Other APIs • Tony Redmond

• 🥉Conditional Access Optimization Agent knowledge base • Jan Bakker

☀️ Learn

👩‍✈️ AI & Copilot

• From Blueprint to Token: How Entra Agent Identity Inheritance Really Works • Derk van der Woude

• Microsoft 365 E7: The Frontier Suite and the Rise of AI Agents • Konstantin Slavin-Borovskij

• Microsoft Entra Agent ID: A Practical Guide to Blueprints and Agent Identities • Raymond Roethof

💳 Verified ID

• Build secure verification with Microsoft Entra Verified ID (14 min) • Yoel Horvitz

⛑️ ID Protection

• Don’t let Entra ID Protection miss your next breach! • Nicola Suter

• 📺 Sign-In Risk vs User Risk - Most Admins Don’t Know the Difference (14 min) • Jonathan Edwards

📦 Apps

• Common Entra ID Security Assessment Findings – Part 1: Foreign Enterprise Applications With Privileged API Permissions • Christian Feuchter

🫆 Authentication

• 🛠️ Entra Auth Tracer – A Browser Extension for Deep Inspection of Microsoft Entra Authentication Flows • Darren Robinson

• The Exchange attribute SOA switch and licencing woes • Morten Skrubbeltrang

🤖 DevOps & PowerShell

• Authentication Tokens Are Not a Data Contract - Azure DevOps Blog • Angel Wong

• Bulk Convert External Users to Internal Users Using PowerShell • Kanaga

• How to Automate Inactive Guest User Removal in Microsoft 365 Using Power Automate • Dhinesh

• Microsoft Limits App Access to Sensitive Message Properties • Tony Redmond

🚦 Conditional Access

• Block Microsoft 365 Apps using Conditional Access Policy • Prajwal Desai

• Conditional Access: CA Analyzer Product Updates • Jon Hope

🖥️ Devices

• KB5085516 OOB Update Resolves Microsoft account sign in Issues • Prajwal Desai

• 📺 Passwordless Windows for BYOD: Entra ID Passkeys Explained (9 min) • Azure Brother

🏙️ External ID - Guests & Multi-Tenant Organizations

• B2B or Not 2B? Cross-Tenant Delegated Administration with Microsoft Entra Tenant Governance • Thomas Naunheim

🥷 Security

• Microsoft Zero Trust Workshop Expands with a Dedicated AI Pillar • Praba

♻️ Sync

• Getting started with Entra Connect Cloud Sync • Pim Jacobs

📒 Tenant Configuration

• Low-Key Debut for Entra ID Backup and Recovery • Tony Redmond

• Microsoft Entra Backup and Recovery • Rudy Mens

• Microsoft Entra ID Gets Native Backup and Recovery — What You Need to Know • Jon Hope

• Tenant governance | Entra ID • Michael Frank

• 🎙️ Unified Tenant Management with Nik Charlebois-Laprade • Nik Charlebois, Richard Campbell

• 📺 Overview of Entra Backup and Recovery (11 min) • John Savill

🛍️ External ID - Customers

• Connecting Entra External ID (EEID) to Entra ID as an external provider via OIDC • Rory Braybrook

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Two open-source tools Emilien built to find gaps in Conditional Access policies and categorize Azure/Entra roles based on attack paths.

Learn how CA Insight evaluates 250 million sign-in combinations offline in minutes instead of days, why the What If API doesn't scale, and how AZTier helps defenders and pen testers understand privilege escalation risks across Entra ID, Azure, and Microsoft Graph.

Together, these projects help security teams move from reactive log monitoring to a proactive defense strategy.

What’s Breaking and Slowing Your Entra ID Environment?

In Microsoft Entra ID, the same visibility gaps cause two problems:

• Things break

• Work slows down

Expired client secrets disrupt integrations. Certificates lapse and authentication fails. New apps appear with excessive permissions and no clear ownership. At the same time, teams struggle to answer basic questions, which applications have access to Microsoft 365 data, whether that access is still required, and who is responsible for it.

When answers are not immediate, reviews stall and projects slow down.

ENow App Governance Accelerator Credential Guard helps identify expiring credentials and expose permission and ownership gaps.

For organizations under 10,000 users, pricing ranges from $3,500 to $9,500 annually through March 31, 2026.

Find App Access Gaps

Subscribe with your favorite podcast player or watch on YouTube 👇

About Emilien Socchi

Emilien Socchi is a Cloud Security Research Engineer at Storebrand (Oslo, Norway) focusing on the proactive discovery of security issues. With an extensive background in application and cloud penetration testing, Emilien has published practical research and tooling used by defenders. He also maintains several open‑source projects, including Azure administrative tiering models and Entra ID role‑monitoring utilities.

LinkedIn - https://www.linkedin.com/in/emilien-socchi

🔗 Related Links

• CA Insight- https://github.com/emiliensocchi/entra-ca-insight

• Azure Administrative Tiering (AzTier) - https://aztier.com

• AzTier Source: https://github.com/emiliensocchi/azure-tiering

• AzTier Deployer - https://github.com/emiliensocchi/aztier-deployer

📗 Chapters

00:00 The Story Behind CA Insights

16:52 Why the ‘What If’ API Doesn’t Scale

21:09 Building an Offline Evaluation Engine

45:22 Deep Dive into AZTier: A Red Team Perspective

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

With the RSA Conference around the corner, we’ve had some major Entra-related announcements this week.

The biggest new features just announced are the Microsoft Entra Backup and Recovery service and the Entra Tenant Governance feature.

Microsoft also introduced a new AI pillar in their Zero Trust Workshop, along two new (Data and Networking) pillar additions to the Zero Trust Assessment. This now includes a range of automated tests to verify your Entra Private Access and Internet Access configurations.

Don’t forget to add this week’s Entra Chat podcast to your queue. Darren has plenty of tricks up his sleeve when it comes to Entra Provisioning Services, making this a great opportunity to learn from a true expert.

Enjoy!

⚡️ Microsoft

🔥 Public Preview

• New tools and guidance: Announcing Zero Trust for AI • Mike Adams

• Microsoft Entra Backup and Recovery • Microsoft Learn

• Microsoft Entra Tenant Governance • Microsoft Learn

• Microsoft Entra cross-tenant group synchronization • Microsoft Learn

📖 Read

• When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures • Microsoft Threat Intelligence, Microsoft Defender Security Research Team

• Secure access in the age of AI: Key findings from our 2026 Report • Kaitlin Murphy

• Microsoft Entra innovations announced at RSAC 2026 • Irina Nechaeva

🗣️ Message Center

• MC1223829 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions (Updated 18 Mar)

• MC1247893 - Microsoft Entra passkeys on Windows now support phishing-resistant sign-in (Updated 18 Mar)

• MC1255405 - Microsoft Edge for Business: Cross-tenant support using Intune Mobile Application Management (MAM)

• MC1253746 - Microsoft Entra: Passkeys in Microsoft registration campaigns (Updated 18 Mar)

• MC1246002 - Prevent/Fix: Microsoft Baseline Security Mode has automatically trigger Entra Conditional Access policy creation (Updated 18 Mar)

From the community…

🚀 Most popular posts from last week

• 🥇Conditional Access: Finding the Gaps in Your Entra CA Before Attackers Do! • Jon Hope

• 🥈Microsoft Entra Passkeys on Windows now Support Phishing-Resistant Sign-In • Rudy Mens

• 🥉New Microsoft Entra Passkeys for Windows Hello Enter Public Preview • Daniel Bradley

Sponsored by:

What’s Slowing Decisions in Your Entra ID Tenant?

In Microsoft Entra ID environments, application sprawl and uncertainty slow decisions, not just visibility. Hundreds of enterprise applications and service principals with persistent OAuth permissions and unclear ownership make it difficult to answer basic questions. Which apps have access to Microsoft 365 data? Is that access still justified? Who owns it?

When those answers are not immediate, reviews take longer, approvals stall, projects slow down, and your team is seen as a blocker rather than a technology enabler.

ENow’s AppGov Score provides a clear view of permission risk, consent practices, and ownership gaps across your tenant. With that visibility, teams can make faster decisions, reduce unnecessary access, and keep work moving without added risk.

Find App Access Blockers

☀️ Learn

👩‍✈️ AI & Copilot

• Is the New Agent 365 Worth $99? • Paul Robichaux

• Microsoft Orphaned Agents Identities: The hidden identity debt in your Entra tenant • Raymond Roethof

• Secure access for AI agents, the new frontier of identity (25 min) • Leandro Iwase, Nick Wryter

🧰 Workload ID

• Securing the Unseen: Why Non-Human Identities Deserve CISO Attention • David Alonso Dominguez

• 📺 Overview of Entra Workload Identities (3 min) • Orin

👮‍♂️ ID Governance

• How to Implement Multi-Stage Approval for High-Privileged Entra Roles Using Entitlement Management and PIM • Sreejith Reghunathan Pillai

• How to Secure Access to Entra Roles with Conditional Access and Privileged Identity Management • Jon Towles

• 📺 Sign-In Risk vs User Risk - Most Admins Don’t Know the Difference (14 min) • Jonathan Edwards

• 🛠️ Access Package Documentor – A Reporting Tool for Entra ID Governance • Christian Frohn

• 🛠️ Entra Provision On Demand PowerShell Module • Darren Robinson

🌐 Private Access & Internet Access (GSA)

• Entra Private Access and VPN Migration Strategies on Entra.News • Richard M. Hicks

• Your Data Has a Back Door. GSA and Purview Are the Deadbolt • Dustin Gullett

📦 Apps

• 🛠️ Privileged App Path Auditor - Audit Entra ID for privilege escalation paths through application permissions, role assignments, and app ownership • Nicolas Blank

🫆 Authentication

• A Beginner’s Deep Dive Guide to Entra Passkeys • Shehan Perera

• 📺 Adding Allowed FIDO Keys and Registering in Microsoft Entra (4 min) • Mobile Jon

• 📺 From Lockouts to Logins: Modern Account Recovery and Passkeys (59 min) • Hana Kim, Jai Maharaj

🤖 DevOps & PowerShell

• The Sad State of Microsoft Graph and Other APIs • Tony Redmond

🚦 Conditional Access

• Conditional Access Optimization Agent knowledge base • Jan Bakker

🖥️ Devices

• 📺 Azure Bastion Enter ID Authentication: Full Requirements Guide #shorts • Travis Roberts

• 📺 Samba 4.24 Brings Entra ID Password Reset Support and Kerberos Hardening (2 min) • DistroTester

• 📺 Setting up Conditional Access for Entra Privileged Identity Management (4 min) • Mobile Jon

🏙️ External ID - Guests & Multi-Tenant Organizations

• Guest Identity Governance in Microsoft Entra ID - IdefixWiki • Julian Rasmussen

📈 Reporting and Insights

• Introducing M365IdentityPosture: Community-Driven Identity Reporting for Microsoft 365 • Sebastian Flæng Markdanner

🥷 Security

• Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found • Nyxgeek

• 🎙️ Episode 126: Microsoft Baseline Security Mode • Michael Howard, Sarah Young

• Microsoft Quietly Closes Another Loophole for Tenant Domain Enumeration • Daniel Bradley

• When OAuth Redirects Become a Phishing Tool • Matej Klemenčič

• 📺 SC-900: Microsoft Security, Compliance, and Identity Fundamentals • Microsoft Learn Course Video Series

• 🛠️ BAADTokenBroker: BAADTokenBroker is a post-exploitation tool designed to interact with Microsoft Entra ID device-bound keys.

• 🛠️ From Enumeration to Findings: The Security Findings Report in EntraFalcon – Compass Security Blog • Christian Feuchter

♻️ Sync

• 📺 Architecture Explained: Integrating On Prem AD with Microsoft Entra ID (9 min) • Thomas Mitchell

📒 Tenant Configuration

• Backup and Recovery for Microsoft Entra • Brian Veldman

• Microsoft Entra ID Backup and Recovery: Native Tenant Backup Is Finally Here • Rawson Wade

• Microsoft Licensing: The BS in Business Standard • Jon Hope

• Microsoft updates the Entra license usage insights blade • Daniel Bradley

• Use Entra Tenant Governance for Native Multi-Tenant Drift Detection • Daniel Bradley

• 📺 Entra Backup & Recovery (Public Preview) (9 min) • RioCloudSync

• 📺 Tenant Configuration Management Creating a Snapshot (7 min) • TechNik

• 📺 What’s NEW in Microsoft 365 & Entra ID March 2026 (16 min) • Andy Malone

🛍️ External ID - Customers

• Creating a feature flag in Azure AD B2C • Rory Braybrook

• Entra External ID (EEID) AADSTS1100001 error with token issuance custom authentication extensions • Rory Braybrook

⚒️ Toolkit

• M365IdentityPosture: PowerShell security reporting framework for Microsoft 365 identity posture assessment. Analyzes Authentication Context, PIM, Conditional Access & more. • Sebastian F. Markdanner

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode Merill sits down with Darren “Doc” Robinson – Microsoft MVP since 2017, former SailPoint Ambassador and one of Australia’s most experienced identity architects.

Darren takes us on a 25+ year journey from Novell networks to modern Microsoft Entra ID, reveals why he’s building custom ECMA2 connectors, and shares the exact PowerShell tools he just open-sourced (Granfeldt uplift, ECMA2 Host Tools, Provision On-Demand module).

We also compare Entra ID Governance vs SailPoint and dive into his latest obsession: MCPs for Entra News and personal AI agents.

Whether you’re migrating legacy apps or levelling up your IGA strategy, this episode is pure gold.

Sponsored by CoreView:

Would you bet your reputation on your current Microsoft 365 security posture?

Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

You could assume it’s fine.

Or you could run the Microsoft 365 Security Posture Check.

It’s free.

It runs locally.

And no, it doesn’t send your tenant data back to us.

We’ll even help you set it up.

Get yours here

About Darren Robinson

Darren is highly accomplished in digital identity and cybersecurity specialising in Identity & Access Management for over three decades. Darren is renowned for driving Digital Identity innovation, building global offerings, and leading high-impact teams to deliver cutting-edge solutions that enhance security posture, operational efficiency, and business value.

🔗 Related Links

• Blog: https://blog.darrenjrobinson.com

• GitHub: https://github.com/darrenjrobinson

• LinkedIn: https://www.linkedin.com/in/darrenjrobinson/

In this episode…

1. Understanding the “Metaverse”

The foundation of Microsoft’s identity strategy dates back to the acquisition of Zoomit in 2000. This introduced the Metaverse—not a VR world, but a “hologram” or central representation of a user that exists across multiple systems like SQL databases and LDAP directories. By correlating these identities into one object, organizations can maintain consistency across a fragmented environment.

2. The Modern Bridge: ECMA and SCIM

As organizations move to the cloud, the “heavy” sync engines like MIM (Microsoft Identity Manager) are being replaced by Entra Cloud Sync. The modern approach uses:

• A Light Shim: A small on-premises component that acts as a member of the domain.

• SCIM Instructions: The Entra provisioning service sends instructions via the SCIM protocol to this shim.

• ECMA Connectors: The Extensible Connector Management Agent (ECMA) translates these cloud instructions into a language legacy on-prem apps can understand, such as SQL or Oracle updates.

3. Scaling with PowerShell 7

One of the biggest hurdles in legacy identity management was performance. Darren Robinson recently uplifted the popular Granfeldt PowerShell Management Agent to support PowerShell 7. This update allows for:

• 64-bit Processing: Handling larger datasets with ease.

• Parallelism: Sending multiple identity updates in parallel rather than waiting for individual “gets,” significantly speeding up sync times.

4. Managing the “Cache”

A common pain point for administrators is the lack of visibility into the ECMA host cache. To solve this, Darren developed a new module that allows practitioners to programmatically query the cache, back up configurations, and document every connector and parameter in the system.

Key Takeaway: Whether you are migrating from legacy solutions like Novell or managing a complex hybrid Entra environment, the goal remains the same: automated, secure, and visible identity lifecycles.

📗 Chapters

00:00 Intro

02:22 The Evolution of Directory Services and Synchronization

08:05 Understanding Sync Engines and the Metaverse

14:45 Modern Identity Provisioning with Entra

17:39 Developing Custom PowerShell ECMA Connectors

20:53 Automating Provisioning with New PowerShell Modules

28:53 The Current Landscape of Identity Governance

31:37 Solving the Disconnected Apps Challenge

35:46 Exploring Model Context Protocol (MCP)

45:34 Leveraging Local AI and LLMs for Identity Tasks

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

This week brings another step forward in the journey toward phishing-resistant identity. Make sure to check the latest Message Center update on passkey profiles and registration, which includes new details about upcoming changes to passkey registration. There’s also big news around the new Microsoft 365 E7 license, which now includes the Entra Suite.

There’s plenty from the community as well. One highlight is the Entra News MCP Server created by fellow Aussie Darren ‘Doc’ Robinson, an incredibly useful way to tap into the collective knowledge of the Microsoft Entra community.

Finally, I caught up with Richard Hicks for the Entra Chat podcast. Having worked through every major era of remote access, from DirectAccess and Always On VPN to Microsoft Entra Private Access, Richard shares the hard-earned lessons he’s learned helping enterprises modernize their VPN strategy. Definitely one to add to your podcast listening queue! 🎧

Enjoy!

Sponsored by:

User Lifecycle: Onboard and Offboard With a Single CmdLet

Fact: Managing hybrid users across AD, Entra ID, and Exchange Online is a breeding ground for missed steps and security gaps - from day one to last day.

EasyEntra’s PowerShell-enabled workflows handle the entire lifecycle:

🚀 Onboard a fully provisioned user in 30 seconds - UI or two-parameter CmdLet.
🚀 Templates defined from existing users in seconds.
🚀 Offboard completely in 10 seconds - UI or single CmdLet.
🚀 Offboarding settings configured once, applied consistently every time.
🚀 Delegate life-cycle management to first-line support - no senior PowerShell skills or tribal knowledge required.

Start your 30-day trial or book a demo - setup takes under a minute - free for tenants with fewer than 25 licensed users.

“It feels almost like a revolution.”
Head of IT, Arjeplog Municipality, Sweden

Wait… One CmdLet?

⚡️ Microsoft

🏆 General Availability

• Email and SMS OTP as Second‑Factor MFA for Native Authentication in Entra External ID • Sasha Mars

🔥 Public Preview

• New myacount.microsoft.com home page

📖 Read

• Secure agentic AI for your Frontier Transformation • Vasu Jakkal

📺 Watch

• QR code authentication: Fast, simple sign‑in designed for Frontline Workers (46 min) • Akshat Goel

• Building MCP on Entra: Design Choices for Enterprise Agents (61 min) • Merill Fernando

🗣️ Message Center

• MC1221452 - (Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants

• MC1247893 - Microsoft Entra passkeys on Windows now support phishing-resistant sign-in

📆 Upcoming Events

Microsoft Security Webinars

• 18 March - Microsoft Entra | From Lockouts to Logins: Modern Account Recovery and Passkeys

• 31 March - Microsoft Entra | Developer Tools for Agent ID: SDKs, CLIs & Samples

From the community…

🚀 Most popular posts from last week

• 🥇Making Global Administrators Safer • Dennis J.

• 🥈Rethinking “Allow my organization to manage my device” Why opt‑in enrollment works better for Intune • Ramya Sharma

• 🥉Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale • Microsoft Threat Intelligence, Microsoft Defender Security Research Team

Sponsored by:

Benchmark Your Entra App Governance

Enterprise applications and service principals accumulate rapidly in Microsoft Entra ID. Over time, many retain OAuth permissions and access to corporate data without clear ownership or regular review.

This creates a growing governance gap. Administrators often lack visibility into which applications hold high-risk permissions and whether those permissions are still justified.

ENow AppGov Score evaluates your Entra ID application environment against 24 governance checks and benchmarks your governance posture. Identify risky permissions, orphaned apps, role assignments, and credential risks that require review. Get your AppGov Score to see where your environment stands and access free community resources for practical guidance. 🛡️🔍

Access Your Score

☀️ Learn

👩‍✈️ AI & Copilot

• Microsoft Ownerless Agents: The silent risk in your Entra tenant • Raymond Roethof

• Microsoft releases new AI self service support experience in Entra • Daniel Bradley

• 📺 How to Enable Entra ID Agent Identity for Copilot Studio Agents (4 min) • Wario W. Wario

🌐 Private Access & Internet Access (GSA)

• Blocking the Microsoft Store Web Installer using Entra Internet Access • Peter van der Woude

• Windows Cloud – Pushing Private Access to the Limit • Julian Jakob

📦 Apps

• Guidance and best practices for ISVs on rotating certificates • Microsoft Learn

• How to Limit Multi-Tenant Applications to Specific Tenants in Entra ID • Thiraviam

• How to Restrict Multi-Tenant Entra Apps to Specific Tenants • Daniel Bradley

• Rethinking application access in Microsoft Entra ID • Sandra Saluti

🫆 Authentication

• Microsoft Entra Passkeys on Windows now Support Phishing-Resistant Sign-In • Rudy Mens

• New Microsoft Entra Passkeys for Windows Hello Enter Public Preview • Daniel Bradley

• Passkeys, Windows Hello And Phishing-Resistant Sign-Ins • Michael Vink

• 📺 [D26] Are passkeys as secure as you think? (43 min) • Fabian Bader

👥 User & Group Management

• New! Switching User Source of Authority (SOA) in Entra ID • Matthew Levy

• 📺 Break the Chain: Convert Synced Distribution Lists to Cloud-Only! (7 min) • Azure Brother

🚦 Conditional Access

• Conditional Access Exclusion: What’s Actually Changing on March 27th and Should You Care? • Rory Wade

• Conditional Access: Finding the Gaps in Your Entra CA Before Attackers Do! • Jon Hope

• Device Code Flow and Authentication Transfer in Conditional Access Rules – One or two rules required? • Brian Reid

• Tracking OAuth scopes in sign‑in logs and upcoming change in conditional access • Martin Rublik

🖥️ Devices

• Edge (MAM) on iOS Keeps removing the Work Account after Sign-in!: Why one Broken identity breaks it All - Just about the Modern Workplace • Joost Gelijsteen

• Happy Little Edge. Securing Windows BYOD with Edge for Business • Dustin Gullett

• Intune – Block automatic mobile device management enrollment (preview) • Benoit Hamet

• MAM for Contractors • Michael Frank

• Microsoft Entra: Hybrid Join Without ADFS • Fabrizio Volpe

• More secure version of the Bitlocker recovery keys export script • Vasil Michev

• 📺 Ditch Public RDP Before It’s Too Late | Entra ID Bastion Setup (8 min) • Travis Roberts

• 📺 Entra ID support for Azure Bastion (4 min) • Brian Veldman

🏙️ External ID - Guests & Multi-Tenant Organizations

• Invite Guest users in a Entra ID Multi-tenant setup • Damien Bowden

📈 Reporting and Insights

• Microsoft Entra Sign-in Diagnostic tool • Mark Oldham

🥷 Security

• Entra ID Password Spraying using APIM as IP-Rotating Mechanism • Patrick Binder

• Uncovering agent logging gaps in Copilot Studio • Katie Knowles

♻️ Sync

• Entra ID – Entra ID Connect/Cloud Sync going to block hard match for privileged roles • Benoit Hamet

📒 Tenant Configuration

• Entra News MCP Server • Darren Robinson

• Microsoft 365 E7 Has Arrived • Ankit Gupta

• Microsoft Entra to Receive Native Backup Capabilities • Daniel Bradley

• New Microsoft 365 E7 Plan Explained • Rudy Mens

• Tenant Switching From Bookmarks • Brian Reid

• 📺 Microsoft Just Launched E7 - Here’s the Truth (7 min) • Jonathan Edwards

• 📺 Why Your Entra ID Still Depends on AD [Fix This] (34 min) • Ru Campbell

🛍️ External ID - Customers

• Getting the sign-up attributes via native authentication in Entra External ID (EEID) • Rory Braybrook

⚒️ Toolkit

• M365 Tenant Analyzer • EasyEntra

• EntraOps v0.6 - AgentID Support, Advanced API Permission Classification & Performance Improvements • Thomas Naunheim

🎙️ Podcasts

• 📺 Episode 423 – Non-Human Identities in Microsoft Entra with Eric Woodruff and Chris Brumm (39 min) • Microsoft Cloud IT Pro Podcast

👨🏽‍💻 Merill’s corner

New homepage in the unified portal for myaccount.microsoft.com

Microsoft just made a big improvement to the end-user identity experience.

The new homepage in the unified portal for myaccount.microsoft.com is now in public preview.

For the first time, users have a single front door for identity tasks.

Instead of navigating multiple pages, the homepage brings everything together

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In this episode, Richard - enterprise security consultant and early Entra Private Access insider - breaks down why traditional VPN is fundamentally broken for today’s threat landscape, how Entra Private Access works under the hood, and the exact crawl-walk-run playbook he uses to migrate enterprise customers without disruption. Plus: his hot take on the Microsoft E7 announcement and why it just changed the pricing conversation forever.

In this episode you’ll learn:

• Why your VPN tunnel is a security liability — and how a single compromised device can expose your entire corporate network

• How Entra Private Access works differently to traditional VPN, and why that architectural shift matters for security

• The “Quick Access” migration strategy that lets you get off legacy VPN fast, without locking everything down on day one

• How to deploy the Global Secure Access client alongside your existing VPN — so you can migrate field-based workers without a single disconnection

• What most teams get wrong about the Entra Private Network Connector — and the scaling pitfalls that catch enterprises off guard

• Why Conditional Access knowledge, not connectivity, is the real key to a successful zero trust migration

• The current limitations of Entra Private Access and how to plan around them

• We also discuss the new ‘E7’ which includes Entra Private Access

About Richard Hicks

Richard Hicks is the founder and principal consultant at Richard M. Hicks Consulting, Inc. A Microsoft Most Valuable Professional (MVP) with more than 30 years of experience implementing secure remote access and public key infrastructure (PKI) solutions, he is a widely recognized enterprise mobility and security infrastructure expert sought after by organizations worldwide. His mission is to help companies provide visibility, control, and assurance for their field-based users and devices, ensuring the highest level of security and productivity for today’s highly mobile workforce.

LinkedIn - https://www.linkedin.com/in/richardhicks/

🔗 Related Links

• Richard’s Blog - https://directaccess.richardhicks.com/

• Richard M. Hicks Consulting, Inc - https://www.richardhicks.com/

• https://directaccess.richardhicks.com/always-on-vpn-vs-entra-private-access/

📗 Chapters

00:00 Intro

01:10 The History of Direct Access and Always On VPN

05:59 Transitioning to Zero Trust and Entra Private Access

11:34 Seamless Side-by-Side VPN Migration

17:37 Using Quick Access to Kickstart Zero Trust

23:43 Changing Mindsets: Identity over IP Addresses

27:55 The New Zero Trust Network Assessment Tool

29:17 Avoiding Pitfalls with the Entra Private Network Connector

33:11 Feature Wishlist: IPv6 and Process Binding

38:46 Hot Takes on the New Entra E7 Suite

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

It’s been a busy week in the Entra community — with new GA and Public Preview features, a flurry of Message Center updates, handy community tools, and much more.

Below is a visual snapshot of this week’s highlights.

🎙️ Also, don’t miss this week’s podcast episode with Nathan McNulty and Daniel Bradley, where we dive into the latest features and upcoming changes.

Enjoy!

Sponsored by:

Would you bet your reputation on your current Microsoft 365 security posture?

Sure, you’ve checked Purview. Maybe tightened Conditional Access. We all do that.

But it’s usually the quiet stuff that bites... permissions that expanded, policies that drifted, exceptions nobody revisited.

You could assume it’s fine.

Or you could run the Microsoft 365 Security Posture Check.

It’s free.

It runs locally.

And no, it doesn’t send your tenant data back to us.

We’ll even help you set it up.

Get yours here:

⚡️ Microsoft

🏆 General Availability

• External Auth Methods is Generally Available

• Expanded attribute support in Lifecycle Workflows attribute changes trigger

• Delegated Workflow Management in Lifecycle Workflows

• Upcoming change – Microsoft Entra Connect security update to block hard match for privileged roles

• Jailbreak Detection in Authenticator App

• Microsoft Entra Connect Sync now supports Windows Server 2025

• Revoke previously approved access package assignments in My Access

🔥 Public Preview

• Rethinking “Allow my organization to manage my device” Why opt‑in enrollment works better for Intune • Ramya Sharma

• GSA: BYOD support for Windows client using Microsoft Entra registration

• GSA: Custom Block pages

• New end user homepage in My Account

📖 Read

• OAuth redirection abuse enables phishing and malware delivery • Microsoft Defender Security Research Team

• Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale • Microsoft Threat Intelligence, Microsoft Defender Security Research Team

📺 Watch

• Conditional Access Optimization Agent: What It Is & Why It Matters (39 min) • Microsoft Security Community

🗣️ Message Center

• MC1221452 - Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants

• MC1243549 - Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B

• MC1246002 - Prevent/Fix: Microsoft Baseline Security Mode has automatically trigger Entra Conditional Access policy creation

📆 Upcoming Events

• Join us for the upcoming Dutch Microsoft Entra Community Meetup • Jan Bakker

From the community…

🚀 Most popular posts from last week

• 🥇Intune Administrator Is the New Domain Admin • James Robinson

• 🥈Difference Between App Registrations and Enterprise Apps • Dhinesh

• 🥉Passkey onboarding in Entra: What Microsoft doesn’t tell you! • Per-Torben Sørensen

☀️ Learn

👩‍✈️ AI & Copilot

• Testing the msgraph Copilot Skill: Giving AI Agents a Local Graph API Brain • Irwin Strachan

🧰 Workload ID

• Become a Wizard of Entra Workload Identities • Eric Woodruff, Thomas Naunheim

• Managed Identities and How I Use Them • Dennis J.

🌐 Private Access & Internet Access (GSA)

• Microsoft Entra Private Access: Secure Access for External Users to Internal Resources • Oliver Müller

• Update Global Secure Access Client With Intune • Marco Wohler

📦 Apps

• How To Use App Registration Deactivation • Colby Pryor

🫆 Authentication

• March 2026 is here! Synced Passkeys and Passkey Profiles rollout? • Matej Klemenčič

• Microsoft Documentation Says Passkeys in Authenticator Can’t Log Into or Unlock Windows workstations ; But They Can • Dr. Emin Huseynov

• 📺 How To Enable Synced Passkeys In Entra ID • Azure Academy

👥 User & Group Management

• Creating New Entra ID Users the PowerShell Way • Dennis J.

• Microsoft Introduces Group Insights in Entra ID (Preview) • Praba

🤖 DevOps & PowerShell

• How to get better with Graph API – Part one • Jan Bakker

🚦 Conditional Access

• Conditional Access Session Controls Sessions Running Forever • Control Alt Delete Tech Bits

🔐 Credential Management

• The Future of Identity: Self-Service Account Recovery (Preview) in Microsoft Entra • Farooque

🖥️ Devices

• Designing an App Protection Policy that don’t backfire on your unmanaged devices - Just about the Modern Workplace • Joost Gelijsteen

• Disable User Enrolling Personal Windows Devices in Intune • Shehan Perera

• Disabling MDM enrollment when adding work or school account • Peter van der Woude

• Entra ID support for Azure Bastion • Brian Veldman

• Under the Hood: How Brokered Authentication Works on iOS & Android - Intune - In Real Life • Somesh Pathak

• 📺 App Protection Policies: BYOD Done Right in Microsoft 365 (15 min) • Jonathan Edwards

🏙️ External ID - Guests & Multi-Tenant Organizations

• SharePoint Online Drops One Time Passcodes for External Access • Tony Redmond

• Entra B2B Replaces SharePoint One-Time Passcode for External Sharing • Admin Droid

🥷 Security

• There’s a Cable Guy in Your Tenant • Jon Haas

• 🎯 SigninLogs Threat Hunting Workbook Your frontline defense against identity-based attacks in Microsoft Sentinel • David Alonso Dominguez

• Making Global Administrators Safer • Dennis J.

• What is ConsentFix Attack and How to Mitigate it in Microsoft 365 • Kanaga

📒 Tenant Configuration

• New UI to manage allowed tenants for Entra ID integrated applications • Vasil Michev

⚒️ Toolkit

• SamErde/DLLPickle: A PowerShell module that helps you get un-stuck from dependency version conflicts that can occur when connecting to multiple Microsoft services in the same session. • Sam Erde

• codeandersen/Group-SOA-Conversion-Tool • Hans Christian Andersen

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Here’s a quick overview of all the topics we covered in this episode (links below).

Sponsored by:

Scan, Score, and Secure Your Applications in Entra

Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. AppGov Score helps IT and Security teams understand where risk exists. The 24-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

• App registrations and enterprise apps for excessive permissions

• Expired or unmanaged secrets

• Ownerless apps

• Risky consent grants, and

• Privileged service principals

Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations, and blast radius so you can prioritize remediation and strengthen your security posture with confidence.

Scan Your Tenant – No Cost

About Nathan McNulty

Senior Security Solutions Architect at Patriot Consulting and Microsoft MVP in security. Nathan is the practice lead for identity and has extensive experience with endpoint deployments and everything Entra.

LinkedIn - https://www.linkedin.com/in/nathanmcnulty/

About Daniel Bradley

Senior Solution Architect for CDW down in the UK and an MVP in Identity Security and M365 for Graph API. Daniel specializes in pre-sales, mergers, acquisitions, and the highly technical migration space.

LinkedIn - https://www.linkedin.com/in/danielbradley2/

🔗 Related Links

• Entra What's New - https://learn.microsoft.com/en-us/entra/fundamentals/whats-new

• Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions - https://techcommunity.microsoft.com/blog/microsoft-entra-blog/upcoming-conditional-access-change-improved-enforcement-for-policies-with-resour/4488925

• XDRInternals - https://github.com/MSCloudInternals/XDRInternals

• Passkey Login - https://github.com/nathanmcnulty/nathanmcnulty/blob/main/Entra/passkeys/PasskeyLogin.ps1

• Graph PM - https://graph.pm

📗 Chapters

03:01 Syncable Passkeys & Registration Changes

18:10 Conditional Access Policy Updates

26:35 Blocking Hard Match for Privileged Roles

35:42 External Authentication Methods GA

43:04 Lifecycle Workflows & Admin Units

48:01 Global Secure Access (GSA) BYOD Preview

53:06 New My Account Portal & Authenticator Updates

58:43 AI Skills & Automating Graph API

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

I’m finally back in Melbourne after an incredible week at Experts Live Denmark in Copenhagen. As Rod Trent beautifully put it in his latest post, it truly felt like a “Tech Family Reunion Like No Other.”

The highlight for me wasn’t just the tech, it was the people. There is something so special about finally shaking hands with folks I’ve only ever known through LinkedIn, Twitter/X, and blog posts. Turning those digital handles into real-world friendships is what makes this community so vibrant.

A massive shoutout to Morten Knudsen and his entire team for organizing such a seamless and high-energy event.

The Gift for You: Open-Source Labs 🔓

I had the honor of hosting a one-day Identity Masterclass with MVPs Thomas, Jan, Klaus, and Pim. We didn’t want the learning to stay in the room, so we’ve open-sourced our labs! You can find the links and hear the behind-the-scenes stories in this week’s Entra Chat podcast.

Let’s get into it ⚡️

Enjoy!

Sponsored by:

Hybrid User Onboarding: One CmdLet – Two Parameters

Fact: Hybrid user onboarding across AD, Entra ID, and Exchange Online is time-consuming and error-prone.

EasyEntra’s new Invoke-EECreateHybridUserFromTemplate CmdLet changes that:

🚀 One command creates a fully provisioned hybrid user in ~30 secs.
🚀 Just two parameters: DisplayName and TemplateName.
🚀 Templates are defined from existing users with an intuitive UI in seconds.
🚀 Schedule onboarding in advance or bulk-create users with a one-liner.
🚀 EasyEntra is free for tenants with fewer than 25 licensed users.

No more context switching between consoles. No more provisioning drift between new hires.
Just fast, consistent, automated onboarding from a single command.

“This product has been a miracle for our Helpdesk.”
Manager of IT Customer Support, Junior Achievement, United States

Learn More

⚡️ Microsoft

🔥 Public Preview

• Microsoft Entra hybrid join using Microsoft Entra Kerberos (preview) • Microsoft Learn

📺 Watch

• Identity Control Plane Under Attack: Consent Abuse and Hybrid Sync Risks (42 min) • Dima Zinkevich, Nestori Syynimaa, Tal Guetta, and Luc van den Ende

• Explore Microsoft Agent 365 security and governance capabilities (7 min) • Irina Nechaeva

• Integrating verification in your app with Microsoft Entra Verified ID – Part I (14 min) Part II (16 min) • Jas Suri, Yoel Horvitz

• How to Set Up Account Recovery with Microsoft Entra (2 min) • Microsoft Security

🗣️ Message Center

• MC1179154 - Microsoft Authenticator app: Upcoming changes to jailbreak and root detection

From the community…

🚀 Most popular posts from last week

• 🥇Microsoft Introduces Entra Hybrid Join using Entra Kerberos • Daniel Bradley

• 🥈What admins can learn from the new Entra ID Groups Insights blade • Jan Bakker

• 🥉PIM for Groups Are You Still Assigning Roles to Users? • Control Alt Delete Tech Bits

Sponsored by:

Scan, Score, and Secure Your Applications in Entra

Application identities represent one of the largest attack surfaces in Entra and are often among the least consistently governed. AppGov Score helps Entra & M365 teams understand where risk exists. The 24-check assessment evaluates Entra ID application integrations against Microsoft-recommended governance practices, analyzing:

• App registrations and enterprise apps for excessive permissions

• Expired or unmanaged secrets

• Ownerless apps

• Risky consent grants, and

• Privileged service principals

Results are delivered as a clear, defensible risk score with actionable findings. No scripts. No manual inventory. Just a fast, read-only scan that reveals app sprawl, identity misconfigurations, and blast radius so you can prioritize remediation and strengthen your security posture with confidence.

Get Your Baseline Score

☀️ Learn

👩‍✈️ AI & Copilot

• Understanding Microsoft Entra Agent ID • Will Velida

• 📺 Agent 365 and Agent ID Overview (48 min) • John Savill

🧰 Workload ID

• Microsoft Graph – Remembered to restict Mail.Send Application Permission? (App Access Policies) • Michael Morten Sonne

👮‍♂️ ID Governance

• Admin Account Lifecycle Management – Part 2: Security and Accesses • Christian Frohn

• Late Hires, Rehires, and Lifecycle Automation Beyond the Happy Path • Sandra Saluti

• 📺 Entra ID Access Reviews The beginners Guide (19 min) • Andy Malone

• 📺 Simplifying Access Governance with Microsoft Entra ID Access Packages (33 min) • David Nudelman

🌐 Private Access & Internet Access (GSA)

• 📺 Zero Trust, GSA & Defender Automation: Breaking Up with VPNs (feat. Brumm & Bader) (30 min) • Christopher Brumm, Fabian Bader, Frans Oudendorp and Michel van Vliet

📦 Apps

• How to Use Scoped Graph Permissions with SharePoint Lists • Tony Redmond

• Difference Between App Registrations and Enterprise Apps • Dhinesh

• Stop Unintended Tenant-Wide App Access in Microsoft Entra ID • Sreejith Reghunathan Pillai

• 📺 The 1 MISTAKE Everyone is Making with Entra Enterprise Apps (16 min) • Ru Campbell

🫆 Authentication

• Windows Hello for Business Multi Factor Unlock • Marco Wohler

👥 User & Group Management

• Microsoft Entra: One Person One License, Now What? • Daniel Bradley

🤖 DevOps & PowerShell

• Microsoft Graph Delta Query in PowerShell • Alf Løkken

🚦 Conditional Access

• Conditional Access Demo: Time-Bound Access • Jon Hope

• How to Build a Log Analytics Workbook for Unused CA Policies • Klaus Bierschenk

• Troubleshooting Windows First Sign‑in Restore When Conditional Access Gets in the Way • Simon Skotheimsvik

• 📺 Does Your Conditional Access Actually Work? Here’s How to Check (12 min) • Jonathan Edwards

🔐 Credential Management

• Passkey onboarding in Entra: What Microsoft doesn’t tell you! • Per-Torben Sørensen

🖥️ Devices

• Delegating LAPS password retrieval at device level • Dániel Kovács

• Disable MDM Enrollment When Adding a Work or School Account on Windows • Rudy Ooms

• Entra Hybrid-Join Devices Using Microsoft Entra Kerberos • Blesslin Rinu

• How to Disable ‘Allow My Organization to Manage My Device’ Prompt • AIMA

🥷 Security

• Intune Administrator Is the New Domain Admin • James Robinson

• Please, please, please stop using passkeys for encrypting user data • Tim Cappalli

• Step by step guide for getting up and running with least privileged msgraph • Morten Mynster

• The Zero Trust Workshop - Your Free Nitro-Boosted Cybersecurity Strategy Virtualization Review • Paul Schnackenburg

• Untangling Microsoft Graph’s $batch requests in Burp • Katie Knowles

📒 Tenant Configuration

• New Cloud Licensing API in Microsoft Graph for License Management in Public Preview • Dhinesh

🛍️ External ID - Customers

• Azure AD B2C to Entra External ID (EEID) Migration Kit — Attribute Mapping • Rory Braybrook

⚒️ Toolkit

• SamlCertRotation: An automation tool to rotate and set as active Saml certificates in Entra ID • Jeff Bley

• emiliensocchi/entra-ca-insight: Discover gaps in Entra Conditional Access policies before attackers do • Emilien Socchi

🎙️ Podcasts

• Episode 421: Microsoft 365 Mergers and Divestitures with Frank Lesniak • Frank Lesniak, Scott Hoag

• Breaking into Microsoft security as a career • Jussi Roine & Tobias Zimmergren

🔥 Maester

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Organizing an event for over 1,200+ attendees is no small feat, and they pulled it off with incredible energy and precision. It was easily one of the most impressive community gatherings I’ve been a part of.

Amidst that massive crowd, I had the privilege of co-leading a deep-dive Identity Masterclass alongside four exceptional Microsoft MVPs: Jan Vidar Elven, Pim Jacobs, Thomas Naunheim, and Klaus Bierschenk.

We weren’t sure what to expect, but the response was overwhelming. We had over 120 dedicated attendees who stayed with us for the full 7-hour session - diving deep into the weeds of Entra ID, governance, privileged access, Agent ID and more. Instead of theory-heavy slides, we built a practical, end-to-end governance story.

Because we believe this knowledge should be accessible, we are now giving away the labs for free so everyone can skill up, learn, and implement these patterns in their own environments.

Here’s the core of what we covered, and what you will learn in this podcast walk through of the labs and what you can try out yourself today!

Links to GitHub repo and YouTube video below.

Sponsored by:

If you’re a systems administrator, you already know – patching is painful. It’s time-consuming, risky, and one small mistake can mean downtime. So, it gets postponed. Again. And again. What if patching was just… Easy?

Introducing Action1, a cloud-native patch management platform for Windows, macOS, Linux, and third-party apps. You’ll be up and running in five minutes. No infrastructure to maintain. No complexity.

And here’s the best part: you can use Action1 on your first 200 endpoints for free. Forever. No feature limits. No credit card. No hidden tricks. Seriously, It’s NOT a disguised free trial. Too good to be true? Too good and actually true! Check for yourself, go to: on.action1.com/entrachat

So, if you’re looking for an easy-to-use patching tool that would help you save weeks, if not months of your time, go to on.action1.com/entrachat and sign up for “Patching That Just Works”.

Sign up!

1️⃣ Inbound Provisioning: Start with a Source of Truth

Most identity problems start with one issue:

There is no clean, authoritative identity source.

We demonstrated how to use Inbound Provisioning in Entra to:

• Accept identity payloads via Microsoft Graph

• Create users in a disabled state

• Capture attributes like hire date, leave date, department

• Treat HR (or another system) as the lifecycle authority

Why this matters

If identities are manually created:

• Joiners are inconsistent

• Leavers are missed

• Privileged accounts become orphaned

Inbound provisioning allows you to:

• Standardize creation

• Attach lifecycle automation immediately

• Reduce manual admin overhead

Key concept:
Provision first. Enable later. Automate everything in between.

2️⃣ Lifecycle Workflows: Automate Joiner / Mover / Leaver

Once a user is provisioned, lifecycle workflows take over.

We implemented:

• Pre-hire workflow

• Day-one onboarding workflow

• Post-onboarding actions

Triggers included:

• Employee hire date

• Creation time

• Group membership

• Attribute changes

Real-world onboarding pattern

1. Account is created disabled

2. Workflow enables the account at the correct time

3. Temporary Access Pass (TAP) is generated

4. TAP is sent securely

5. Access is assigned automatically

This reduces:

• Manual enablement

• Helpdesk load

• Security gaps

Design principle:
Automation should enforce timing — not people.

3️⃣ Privileged Account Design: Separate the Identities

We had a strong opinion in the session:

Admin accounts should be separate and cloud-only.

Why?

• Syncing privileged accounts from on-prem introduces risk

• HR systems should not directly control privileged identities

• Governance features work best with cloud-native identities

We explored three creation patterns:

1. Inbound provisioning for privileged accounts

2. Access Packages (with auto-assignment or request model)

3. Lifecycle workflows + custom Logic Apps

Each has trade-offs.

What matters most:
Privileged identities must be:

• Separately authenticated

• Phishing-resistant (FIDO2 or passkeys)

• Independently governed

• Linked for offboarding

4️⃣ Linking Identities for Investigation

One challenge in Entra:

There’s no native “this person owns these 3 accounts” view.

We explored identity linking in Microsoft Defender XDR, where:

• Multiple accounts can be associated to one identity

• Incident investigations become clearer

• Privileged activity can be correlated with user context

This becomes critical during:

• Compromise investigations

• Insider threat analysis

• Lateral movement tracking

Security takeaway:
If you can’t correlate identities, you can’t fully investigate them.

5️⃣ Backup & Restore: The Truth About Entra

There is no traditional backup system in Entra.

Instead, you have:

• Soft-delete (with recycle bin)

• Hard-delete (irreversible)

• API-based recovery

• Configuration export strategies

We discussed:

• Protecting deleted items with Protected Actions

• Using Conditional Access to restrict destructive operations

• Exporting configuration JSON regularly

• Monitoring configuration drift

Reality:
If you aren’t exporting your tenant configuration, recovery becomes manual and painful.

Governance is not just about creation — it’s about resilience.

6️⃣ Protected Actions + Conditional Access

A powerful but underused feature:

Protected Actions.

You can require Conditional Access enforcement before allowing:

• Hard deletes

• Sensitive configuration changes

Example:

• Only allow permanent deletion from a compliant device

• Only allow from a trusted location

• Require phishing-resistant authentication

Even Global Admins must pass policy.

Security mindset shift:
Admin role ≠ unlimited ability.

7️⃣ Agent ID & Blueprints: The Future of Identity for AI

We also explored Agent ID — one of the newer capabilities in Entra.

Why not just use a service principal?

Because agents:

• Need stronger guardrails

• Must support per-user instances

• Require conditional access enforcement

• Must be auditable at scale

Blueprints allow:

• A parent definition of permissions

• Individual agent instances per user

• Centralized governance over many agents

As AI agents scale, identity must scale securely with them.

Forward-looking insight:
Agent governance will soon be as important as user governance.

8️⃣ Design Philosophy Behind the Lab

The entire masterclass was built around one principle:

Identity is a lifecycle, not a login.

We covered:

Provision → Enable → Assign → Elevate → Monitor → Protect → Offboard → Recover

If any step is manual, inconsistent, or undocumented — risk increases.

The labs give you a complete pattern you can implement in your own tenant.

🎯 What You Should Do Next

1. Watch/listen to the full podcast where we walk you through the labs.

2. Go try out the labs at github.com/IdentityMan/MasterclassELDK26 in your own tenant.

About us

• Jan Vidar Elven, Security MVP - https://www.linkedin.com/in/janvidarelven

• Pim Jacobs, Security MVP - https://www.linkedin.com/in/pimjacobs89

• Thomas Naunheim, Security MVP - https://www.linkedin.com/in/thomasnaunheim

• Klaus Bierschenk, Security MVP - https://www.linkedin.com/in/klabier

🔗 Related Links

• https://github.com/IdentityMan/MasterclassELDK26

• https://discord.entra.news

• https://on.action1.com/entrachat

📗 Chapters

00:00 Intro

00:50 Open Sourcing the Entra Lab

03:42 Entra ID Inbound Provisioning

08:05 Lifecycle Workflows and Governance

10:57 Securing Privileged Admin Accounts

16:21 Offboarding and Linked Identities

19:51 Sponsor: ActionOne

21:02 Entra ID Backup, Restore & Protected Actions

26:08 Exploring Agent ID and Blueprints

30:28 How to Access the Open Source Lab

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

This edition is coming to you from Copenhagen, Denmark 🇩🇰 where I’m spending the week at Experts Live Denmark. I’m looking forward to catching up with the incredible Entra community here and hearing how organizations across the region are approaching identity and device modernization.

In this week’s Entra Chat, I sat down with Michael and Prem to unpack how large enterprises are moving to cloud-native devices using Entra Join and Intune and what it really takes to make that transition successful at scale.

Enjoy!

⚡️ Microsoft

🔥 Public Preview

• Introducing Security Dashboard for AI (Now in Public Preview) • Amanda Lowe

📺 Watch

• AI with Zero Trust Security (11 min) • Michael Madrigal

From the community…

🚀 Most popular posts from last week

• 🥇Securing Entra ID Administration: Tier 0 • Sean Metcalf

• 🥈Blocking Tor/Botnet/Anonymous Proxy access to M365 • Frank van Zandwijk

• 🥉🛠️ Conditional Access Framework (2026.2.1) • Joey Verlinden

☀️ Learn

👩‍✈️ AI & Copilot

• Remediating Agent Identities for Identity Admins and SOCs | Hybrid Brothers • Robbe Van den Daele

• 📺 Entra ID - Block risky Agents with Conditional Access (3 min) • Julian Rasmussen

🧰 Workload ID

• How to Use Scoped Graph Permissions to Access SharePoint Files • Tony Redmond

• Primer: Use RBAC for Applications to Control App Use of the Mail.Send Permission • Tony Redmond

⛑️ ID Protection

• Migrate your Entra ID risk policies to Conditional Access • Erik Lindeboom

• Require Risk Remediation in Entra Conditional Access • Kenneth van Surksum

• 📺 Microsoft Doesn’t Wait For You Anymore (Auto-Remediation) (10 min) • Jonathan Edwards

👮‍♂️ ID Governance

• 📺 What If Governance Wasn’t Overhead BUT Your Strongest Security Control? • Tee Earls, Ramiro Calderon, Jef Kazimer, Russell Smith

• PIM for Groups Are You Still Assigning Roles to Users? • Control Alt Delete Tech Bits

• Stop Identifying Users by Display Name • Sandra Saluti

📦 Apps

• App Registration Ownership: A Silent Path to Persistence in Entra Id • Gabriel Delaney

• How to Deactivate Application in Microsoft Entra ID • Ali Tajran

• Tag your Entra ID applications with custom data • Tom Aafloen

🫆 Authentication

• Passkey Profiles And Auto-Enable • Michael Vink

• 📺 Microsoft Automatic Passkey Rollout (9 min) • RioCloudSync

• 📺 The Hidden Traps in Microsoft Entra Passkey Rollouts [MVP Lessons] (41 min) • Ru Campbell, Eric Woodruff

👥 User & Group Management

• What admins can learn from the new Entra ID Groups Insights blade • Jan Bakker

🤖 DevOps & PowerShell

• Send mail using Azure Automation, PowerShell and a managed identity • Damien Van Robaeys

• Using Dev Proxy with the Microsoft Graph PowerShell SDK • Tony Redmond

🚦 Conditional Access

• Conditional Access: MFA for All… But Not the Same • Jon Hope

• How Conditional Access Policies Are Evaluated in Microsoft Entra ID • Lukas Beran

• STOP THE CAP: Making Entra ID Conditional Access Make Sense Offline • Lee Robinson

• Why ‘Never persistent’ isn’t really never persistent: understanding browser sessions in Microsoft 365 Web Apps • Peter Klapwijk

🖥️ Devices

• Microsoft Introduces Entra Hybrid Join using Entra Kerberos • Daniel Bradley

🥷 Security

• 📺 Advanced Active Directory to Entra ID Lateral Movement Techniques - Black Hat USA 2025 (39 min) • Dirk-jan Mollema

• Uncovering Malicious OAuth Campaigns in Entra ID • Shahar Dorfman, Sapir Federovsky

• Federated Identity Credential Injection - Proof of Concept • Rogier Dijkman

♻️ Sync

• 📺 The Hybrid Exit Strategy: Making Entra ID the Source of Authority (8 min) • Azure Brother

📒 Tenant Configuration

• A neat Entra ID way to find out what entity a GUID belongs to • Rory Braybrook

• Decommissioning Old Tenants • Brian Reid

• Monitoring Entra ID Configuration Drift with entrasnapshot.com and UTCM APIs • Sebastian Wild

🛍️ External ID - Customers

• Azure AD B2C to Entra External ID (EEID) Migration Kit — Evaluating the login • Rory Braybrook

⚒️ Toolkit

• magic-tool/magic: The MAGIC tool is a wrapper around the Microsoft Graph Python SDK, designed to download incident response-relevant data from M365 environments. • Alexander Gödeke

👨🏽‍💻 Merill’s corner

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

In our latest episode of Entra Chat, we sat down with enterprise veterans Michael Brunker and Prem Kothandapani to deconstruct their recent, massive rollout. They successfully converted nearly 40,000 devices from on-premises Active Directory to Entra Joined in just nine to ten months—all with a lean team of 10–15 people.

Here are the high-stakes lessons they learned from the trenches of modern management.

The “Nuclear Option”: Cleaning Up 20 Years of GPO Debt

One of the most controversial decisions the team made was what they called the “nuclear option” regarding Group Policy Objects (GPOs). Instead of porting over decades of legacy policies that no one fully understood, they chose to start from scratch.

By building a new security baseline from the ground up in Intune, they ensured the new environment was clean, modern, and free from the “stale” configurations that often plague legacy estates.

Killing the “VPN Tax”

For the end user, the primary driver for this migration was a radically improved experience. In a cloud-native world, the dependency on legacy VPN technology disappears.

• Work from Anywhere: Users can sign on and get access without the friction of starting a VPN or worrying about office cabling.

• Security at the Edge: Moving to Entra ID shrinks the attack surface by removing devices as a direct entry point to your core on-prem Active Directory.

Sponsored by:

If you’re a systems administrator, you already know – patching is painful. It’s time-consuming, risky, and one small mistake can mean downtime. So, it gets postponed. Again. And again. What if patching was just… Easy?

Introducing Action1, a cloud-native patch management platform for Windows, macOS, Linux, and third-party apps. You’ll be up and running in five minutes. No infrastructure to maintain. No complexity.

And here’s the best part: you can use Action1 on your first 200 endpoints for free. Forever. No feature limits. No credit card. No hidden tricks. Seriously, It’s NOT a disguised free trial. Too good to be true? Too good and actually true! Check for yourself, go to: on.action1.com/entrachat

So, if you’re looking for an easy-to-use patching tool that would help you save weeks, if not months of your time, go to on.action1.com/entrachat and sign up for “Patching That Just Works”.

Sign up now!

The “Gnarly” Problems: What Breaks First?

Success wasn’t just about the big picture; it was about mastering the “fundamental basic building blocks”. Michael and Prem highlighted several technical hurdles that can derail a migration if not handled early:

• The Proxy Trap: Many organizations fail to update their proxy server allow-lists with the specific Microsoft URLs required for cloud authentication.

• App Authentication: Moving from Kerberos-based device auth to OAuth and modern cloud flows requires rigorous testing across different “personas,” such as front line workers versus corporate office users.

The Secret to Scaling: Small Teams, Big Strategy

Perhaps the most surprising takeaway was that a project of this scale didn’t require an army. By focusing on a “small team” of highly skilled engineers and dedicated communications experts, they maintained momentum and avoided “stop-start” migration fatigue.

Want to hear the full technical breakdown, including how they handled zero-downtime requirements for front line workers?

About Michael Brunker

Michael Brunker has approaching 40 years in the IT industry and has operated as an enterprise architect across major organizations like BP, Woodside, and Telstra.

LinkedIn - https://www.linkedin.com/in/michaelbrunker/

About Prem Kothandapani

Prem Kothandapani is an EndPoint Architect with over 14 years of experience in endpoint computing and major migrations, having worked at NBN, Australian Unity, and Telstra.

LinkedIn - https://www.linkedin.com/in/premnath-kothandapani-41744153/

📗 Chapters

00:00 Cloud-Native Device Management

02:58 The True Cost of Legacy Infrastructure

07:47 Moving to Modern Management

11:13 The Blueprint for a 40,000 Device Migration

20:07 Handling Complex App Dependencies

28:07 Crafting a Seamless User Migration Experience

33:28 Automating with Graph API and Autopilot

43:09 Avoiding the Co-Management Trap

55:01 The New Starter Experience

57:24 Migration Velocity and Lessons Learned

Podcast Apps

🎙️ Entra.Chat - https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill

The End of an Era: Alex Simons is Retiring

The biggest news this week is that Alex Simons, who has led the Entra product team for years, announced his retirement from Microsoft.

It’s hard to overstate Alex’s impact. While many have contributed to the org over the years, if there is one person who truly shaped and molded Entra into what it is today, it’s him. From fostering the unique culture of the Identity team to serving as the primary face of the brand, Alex is one of those rare “unicorns” who did it all. His passion for the product and the customer never wavered. Even in his final month, I saw him personally reviewing docs and proposals for the standards specs we are contributing toward Agentic AI.

I’ve even heard that my own team, the Microsoft Identity Customer Experience Engineering (CxE) org, was something he personally championed to create.

To give you an idea of his “customer-obsessed” mindset: back in 2017, long before I joined Microsoft, I started following Alex on Twitter. Out of the blue, he sent me a DM offering to help if I ever ran into trouble with Azure AD. That wasn’t an anomaly; it was the culture he built. While we’re sad to see him go, please join us in wishing him incredible fun and success in his “second career” as a volleyball coach! 🏐

A Piece of Entra Lore

Fun fact: Did you know there is a tweet memorializing the actual birth of Azure Active Directory (now Entra ID) by Alex himself? I can’t believe it’s now February 2026, 13 years later, and that historic post only has one like!

Let’s change that. Go smash the like button on it and become a part of Entra ID history!

This Week on Entra Chat

We tried something a little different this week. Ewelina Paczkowska and Daniel Bradley joined me to count down the top five Entra stories of the month, including some critical changes admins need to prep for right now.

I’m planning to do this monthly wrap-up moving forward. Watch the episode and let me know what you think!

Enjoy!

Sponsored by:

Hybrid User Onboarding: One CmdLet – Two Parameters

Fact: Hybrid user onboarding across AD, Entra ID, and Exchange Online is time-consuming and error-prone.

EasyEntra’s new Invoke-EECreateHybridUserFromTemplate CmdLet changes that:

🚀 One command creates a fully provisioned hybrid user in ~30 secs.
🚀 Just two parameters: DisplayName and TemplateName.
🚀 Templates are defined from existing users with an intuitive UI in seconds.
🚀 Schedule onboarding in advance or bulk-create users with a one-liner.
🚀 EasyEntra is free for tenants with fewer than 25 licensed users.

No more context switching between consoles. No more provisioning drift between new hires.
Just fast, consistent, automated onboarding from a single command.

“This product has been a miracle for our Helpdesk.”
Manager of IT Customer Support, Junior Achievement, United States

Learn More

⚡️ Microsoft

🔥 Public Preview

• Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access • Microsoft Learn

📺 Watch

• Microsoft Entra Agent ID explained (10 min) • Leandro Iwase

From the community…

🚀 Most popular posts from last week

• 🥇Entra – You can now disable registered applications (preview) • Benoit Hamet

• 🥈Microsoft Disables NTLM by Default in Upcoming Windows Releases • Lokesh

• 🥉Entra Connect Sync 2.6.1 released - Icewolf Blog • Andres Bohren

Sponsored by:

Live Entra Webinar: Application Security Roadmap

[ Feb 25, 2026 | 1 PM ET ] Most organizations know they have application risk in Entra ID. Far fewer know where to start, what to prioritize, or how to operationalize governance without slowing the business. In this expert-led session we’ll lay out a practical, phased roadmap for securing applications in Entra ID. You’ll learn:

• How to inventory and classify applications by risk, access, and business impact

• How to apply least privilege and lifecycle ownership to apps at scale

• A realistic roadmap for reducing app attack surface without breaking integrations

This webinar is designed for teams who are past awareness and ready for execution. Join us to build a roadmap toward continuous control in Entra. All registrants will receive the recording.

Register Now

☀️ Learn

👩‍✈️ AI & Copilot

• AI Agent Architecture & Security: Deep Dive • Seyfallah Tagrerout

⛑️ ID Protection

• 🧩 Manually set an Entra user as Risky via Microsoft Graph • Tom Aafloen

👮‍♂️ ID Governance

• How to use access packages to manage group memberships • Lukas Beran

• 🛠️ Free Entra ID PIM Assessment Tool • Kaido Järvemets

• 🛠️ PIMfox for Entra – Get this Extension for 🦊 Firefox • Michel de Rooij

🌐 Private Access & Internet Access (GSA)

• Entra Private Access and Bring Your Own Device (BYOD) • Richard M. Hicks

• Microsoft Entra Private Access BYOD: Access Internal Resources with Entra Registered Devices • Oliver Müller

• Prompt Injection is the New Phishing…. Here’s how GSA Can Help • Dustin Gullett

• 📺 Episode 35 - “Entra Global Secure Access - Internet Access”, a secure identity-driven Web Gateway. (28 min) • Matthew Levy, Dinant Paardenkooper

📦 Apps

• 🧩 Deactivating an Entra ID Application • Tony Redmond

• 🧩 How to Find and Remove Application Owners from Disabled Applications • Daniel Bradley

• Securing Aspire Apps with Microsoft Entra ID • Jean-Marc Prieur

🫆 Authentication

• 🧩 How to find unattested device-bound passkeys in Entra ID • Jan Bakker

• 📺 Authentication Contexts in Microsoft 365 – Explained Simply (10 min) • Jonathan Edwards

• 📺 Everything Azure Admins Know About Azure Auth Just Changed (7 min) • Azure Academy

• 📺 Passkeys in Entra: Passwords Are Dead — Here’s How to Enable Them Today (9 min) • Peter Rising

🤖 DevOps & PowerShell

• Using Dev Proxy to Identify Excessive Microsoft Graph Permissions in Your PowerShell Scripts • Brad Wyatt

🚦 Conditional Access

• Blocking Tor/Botnet/Anonymous Proxy access to M365 • Frank van Zandwijk

• 🛠️ Conditional Access Framework (2026.2.1) • Joey Verlinden

• 📺 Conditional Access Documenter • Brian Veldman

🖥️ Devices

• How to enable Platform SSO (PSSO) for Apple macOS using Intune • James Vincent

🏙️ External ID - Guests & Multi-Tenant Organizations

• B2B Guest: Stop Losing External Users To Blank Planner • Flavio Meyer

• Using Google Workspace and Gmail as External Identities in Windows 365 • Dieter Kempeneers

🥷 Security

• Securing Entra ID Administration: Tier 0 • Sean Metcalf

• Phishing Persistence: 10 Steps to Securing a Compromised M365 Account • Andy Lombardo

• I wrote a 4-part guide on building an on-prem PKI with PowerShell • Michael Waterman

• 🛠️ Zero Trust Assessment Tool • Moe Kinani

• 🛠️ OAuthBandit: OAuthBandit is a post-exploitation tool that automates the extraction, validation, and exploitation of Microsoft OAuth tokens from compromised Windows endpoints • Hamza Kondah

• 🛠️ Getting Started with the BlackCat - A PowerShell Module that consolidates the techniques a red team or security auditor needs into a single, well-documented module • Rogier Dijkman

📒 Tenant Configuration

• Being careful with the ability to configure the preferred Entra tenant domain name • Peter van der Woude

• 🧩 Unified Tenant Configuration Management (UTCM) APIs in Microsoft Graph • Brian Veldman

• 🛠️ Solving tenant configuration drift with UTCM - Introducing TenantBaseline • Ugur Koc

🛍️ External ID - Customers

• Using the ROPC flow with Azure AD B2C • Rory Braybrook

🔥 Maester

• Introducing Maester 2.0 🚀 • Maester Core Team

• Maester and UTCM Are Complementary Tools for Microsoft 365 Tenant Management • Tony Redmond

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Microsoft is automatically enabling passkey profiles in Entra ID, and if you don’t configure them yourself, your tenant will be migrated with default settings.

In this episode of Entra Chat, I sat down with Microsoft Security MVPs Daniel Bradley and Ewelina Paskowska to break down what this really means for Microsoft 365 administrators.

But passkeys aren’t the only story this month.

1️⃣ Passkey Profiles Are Becoming the Default

Starting March 2026:

• Passkey profiles will be auto-enabled

• Tenants that haven’t configured profiles will be migrated

• Registration campaigns will shift from Authenticator-first to passkey-first

This is a major shift toward phishing-resistant authentication.

You’ll now be able to:

• Separate hardware-backed vs synced passkeys

• Apply granular group-based controls

• Enforce stronger authentication for privileged users

2️⃣ Source of Authority Conversion Is Finally GA

For years, admins used messy delete-and-restore hacks to convert synced users to cloud-only.

Now it’s officially supported.

You can convert individual users from on-premises authority to cloud-managed — without breaking hybrid entirely.

Why this matters:

• Easier M&A transitions

• Full access to Entra ID Governance features

• Cleaner lifecycle management

• Reduced dependency on legacy infrastructure

For hybrid environments moving toward cloud-first identity, this is huge.

Sponsored by:

If you are a systems administrator managing endpoints every day, you’ve probably postponed patching at least once — not because you forgot… But because you didn’t feel like gambling with uptime. Meanwhile, the backlog grows, vulnerabilities pile up, and patching stays stuck in manual mode.

Action1  fixes that.

Action1 is a cloud-native patch management platform for Windows, macOS, Linux, and third-party apps — all from one place, no VPN needed. Curious how easy it is to start? You can use it on your first 200 endpoints, for free, forever, with no functional limits. It’s not a disguised free trial. No credit card required, no hidden limits, no tricks.

All you have to do is visit on.action1.com/entrachat and get started today.

So, if you’re looking to automate patching at scale and get weeks— even months—of your time back, go to on.action1.com/entrachat and sign up for patching—that—just—works.

Visit Action1 and get started today

3️⃣ App Registration Deactivation (A Quietly Powerful Feature)

Microsoft added the ability to deactivate app registrations.

Instead of deleting an app (and losing configuration), you can now:

• Immediately stop token issuance

• Preserve metadata and permissions

• Investigate safely

• Re-enable without rebuilding

For incident response scenarios — especially in multi-tenant or MSP environments — this is a big step forward.

4️⃣ Conditional Access Behavior Changes

There’s also a change impacting tenants with Conditional Access policies targeting “All resources” but excluding certain apps.

Previously, certain minimal-scope apps could bypass enforcement under specific conditions.

That loophole is closing.

Admins should:

• Review message center notifications

• Audit legacy apps

• Validate MFA handling before rollout

As always with identity changes: being proactive is critical.

5️⃣ Sync Security Hardening (Hard Match Protection)

Microsoft is adding additional validation to protect against malicious hard matching scenarios in hybrid environments.

This reduces the risk of identity takeover via manipulated on-prem objects.

It’s automatic — but important to understand if you manage hybrid identity or MSP transitions.

Watch the full episode for the deep technical breakdown and real-world implications.

About Daniel Bradley

Daniel is a Senior Solution Architect for CDW and Microsoft MVP in Identity & Graph API. He is a avid writer who enjoys investigating new features and building practical tools to share with the community through his blog. He also is one of the moderators for the r/entra subreddit.

• Website: https://ourcloudnetwork.com

• LinkedIn: https://www.linkedin.com/in/danielbradley2

• X: https://x.com/DanielatOCN

About Ewelina Paczkowska

Ewelina is a Solution Architect at Theatscape and a Microsoft Security MVP. She is a content creator and speaker who enjoys breaking down complex solutions into clear, practical guidance. Ewelina is also an organiser of the Microsoft 365 Security & Compliance user group and the creator behind Welka’s World, where she shares insights and real-world knowledge around Microsoft security and compliance.

• Website: https://welkasworld.com

• LinkedIn: https://www.linkedin.com/in/ewelinapaczkowska

• X: https://x.com/WelkasWorld

🔗 Related Links

• MC1221452 - Microsoft Entra ID: Auto-enabling passkey profiles - https://mc.merill.net/message/MC1221452

• Ability to convert Source of Authority of synced on-prem AD users to cloud users is now available - https://learn.microsoft.com/en-us/entra/identity/hybrid/user-source-of-authority-overview

• Service Principal creation audit logs for alerting & monitoring - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/understand-service-principal-creation-with-new-audit-log-properties

• Deactivate an app registration - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/deactivate-app-registration

• MC1223829 - Upcoming Conditional Access change: Improved enforcement for policies with resource exclusions - https://mc.merill.net/message/MC1223829

• Microsoft Entra Connect security hardening to prevent user account takeover - https://learn.microsoft.com/en-us/entra/fundamentals/whats-new#general-availability---microsoft-entra-connect-security-hardening-to-prevent-user-account-takeover

📗 Chapters

06:16 Converting Source of Authority to Cloud

15:37 Auto-Enabling Passkey Profiles

24:33 Deactivating App Registrations

31:56 Conditional Access for Excluded Apps

38:48 Sync Jacking Protection

41:45 Unified Tenant Configuration Management

46:31 Service Principal Creation Logs

Podcast Apps

🎙️ Entra.Chat → https://entra.chat

🎧 Apple Podcast → https://entra.chat/apple

📺 YouTube → https://entra.chat/youtube

📺 Spotify → https://entra.chat/spotify

🎧 Overcast → https://entra.chat/overcast

🎧 Pocketcast → https://entra.chat/pocketcast

🎧 Others → https://entra.chat/rss

Merill’s socials

📺 YouTube → youtube.com/@merillx

👔 LinkedIn → linkedin.com/in/merill

🐤 Twitter → twitter.com/merill

🕺 TikTok → tiktok.com/@merillf

🦋 Bluesky → bsky.app/profile/merill.net

🐘 Mastodon → infosec.exchange/@merill

🧵 Threads → threads.net/@merillf

🤖 GitHub → github.com/merill