Entra 🆔 News #157 → This week in Microsoft Entra
Learn about improved restore experience for device-bound Authenticator app passkeys on iOS, Maester Cloud announcement and more!
👋 Hi, Merill and Joshua here with this week’s roundup of the latest news on Microsoft Entra from around the globe 🌍.
Big week for me personally. I shared why I left Microsoft and what’s next: I’m now working full-time on Maester, and Maester Cloud is officially on the way.
If you want to learn more, start with the Maester Manifesto. It explains where this is all heading. Then join the waitlist, or better yet, become a Founding Sponsor and get early access when Maester Cloud launches.
Also, don’t miss this week’s Entra Chat with Katie Knowles. Her research into Agent ID is some of the most interesting I’ve seen, and she breaks down exactly what Microsoft admins need to know as they are onboarding agents into their orgs.
One Compromised Agent ID Blueprint Can Cross Tenant Boundaries
Microsoft Entra Agent ID uses familiar application and service-principal objects under the hood, but its one-to-many hierarchy creates a different security boundary. A blueprint can be associated with many agent identities. When that blueprint belongs to a third-party provider and is trusted across customer tenants, the provider’s credential security be…
Enjoy!
Sponsored by:
Cloud PKI & RADIUS, Built for the Microsoft Ecosystem
Passwordless Wi-Fi, VPN, and device trust run on certificates + RADIUS, but AD CS and NPS struggle with Entra-only & cloud-first environments. EZCA and EZRADIUS by Keytos deliver both as a fully managed service.
Native Entra ID & Intune integration for automated certificate management
Extend or fully replace Microsoft Cloud PKI, AD CS, & NPS
Integrates with 3rd party MDM platforms like Jamf Pro & NinjaOne
BYOD onboarding with Keytos Connect - no MDM or work profile required
Available in Azure Government Cloud (GCC High)
Free, fully-featured 30-day trial - no credit card required
Ready to modernize your PKI and RADIUS? See how Keytos fits your Microsoft environment.
⚡️ Microsoft
🏆 General Availability
Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows
Upcoming change - Improved restore experience for device-bound Authenticator app passkeys on iOS
🔥 Public Preview
Extended Conditional Access protections for Agent’s user accounts
New built-in Entra role for SOC identity response in Microsoft Defender
Prevent unauthorized changes to AD groups with AD group enforcement
📖 Read
Govern AI agent identities and access the same way you govern your employees • Chirag Dayani
Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative • Salim Chawro
5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management • Microsoft Security Team
🗣️ Message Center
MC1423108 - Microsoft Entra: Improved restore experience for Authenticator passkeys on iOS
MC1418116 - Completed: Conditional Access enforcement update for policies with resource exclusions
Sponsored by:
The Identity Sync & Windows Workstation Migrations Solution
ADMT unsupported. MIM nearing end of life. It’s time to modernise your migration approach.
With PowerSyncPro successfully deliver identity and device migrations designed for modern Microsoft environments with confidence and reducing TCO.
✔ DirSync - Synchronise users, groups, contacts and passwords across environments to support coexistence, staged migrations and complex identity scenarios.
✔ Migration Agent - Move Windows devices between AD Joined, Hybrid and Entra Joined states while reducing disruption and preserving the end-user experience.Built for delivering enterprise migrations at scale.
From the community…
🚀 Most popular posts from last week
🥇 A New Face for Risky User Management in Microsoft Entra • Colby Pryor
🥈 How To Enable And Roll Out Microsoft Authenticator Passkeys In Microsoft Entra ID: A Step-by-Step Guide • Charbel Nemnom
☀️ Learn
👩✈️ AI & Copilot
ID Governance
KB - employeeLeaveDateTime show empty (null) • Jan Bakker
📦 Apps
Using “Entra Local” with the MSAL libraries | by Rory Braybrook | The new control plane | Jul, 2026 • Rory Braybrook
Authentication
Microsoft Entra ID Retires Custom Controls For External MFA • Daniel Bradley
Using “Entra Local” with device code flow | by Rory Braybrook | The new control plane | Jul, 2026 • Rory Braybrook
Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect • Jan Bakker
Does anyone even use GitHub for federated authentication? • Sapir Federovsky
👥 User & Group Management
Groups: The Connective Tissue of Microsoft 365 • Jonathan Hope
🤖 DevOps & PowerShell
Use M365Mutator to Make Microsoft 365 Test Data Less Boring • Tony Redmond
How to Report Managers and Direct Reports from Entra ID • Tony Redmond
🚦 Conditional Access
Conditional Access Optimization Agent | Security Copilot | Entra ID • Michael Frank
Why you Shouldn’t bypass MFA for your office IP adresses • Daniel Bradley
📺 Master Conditional Access in Entra ID: Assignments, Conditions, Controls! • Travis Roberts
🥷 Security
Entra Agent ID: Protect, detect, respond • Katie Knowles
Entra ID User App Config Abuse • Elli Shlomo
How the Microsoft Baseline Security Mode Left Ghost Policies in Entra ID • Michael Morten Sonne
DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation • ZeroBEC Team
♻️ Sync
Entra – Reminder to start migrating to Cloud Sync and Exchange writeback • Benoit HAMET
Troubleshooting Entra Connect permissions sync errors • Aaron Guilmette
🔥 Maester
👨🏽💻 Merill’s corner
Want to get featured on Entra.News? → Submit your content 😎
Want us to say nice things about your company? Sponsor entra.news 🤩
Love the newsletter? Tell us 💚❤️💜
🪃 Acknowledgement of Country
Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.