Entra 🆔 News #164 → This week in Microsoft Entra

Learn about governing access to an on-premises app from Microsoft Entra ID, syncing Entra ID users to Active Directory with Cloud Sync and more

👋 Hi, Merill and Joshua here with this week’s roundup of Microsoft Entra news from around the globe 🌍.

There’s a bit of a cloud-to-on-prem theme this week.

Entra Cloud Sync can now provision users and groups from Entra ID back to Active Directory, which is now in preview.

There’s also a new preview for keeping a group’s OU and name when changing its Source of Authority. And if you’re working with on-prem apps, there’s a useful walkthrough on governing access to them from Entra ID.

We’ve also got Greg, Eric and Rene on the Entra Chat podcast this week talking all things Entra Groups, so make sure you check it out.

Enjoy!

---

Sponsored by:

Cut the PS: Mailbox Folder Permissions Made Easy

PowerShell is awesome! For automation, bulk-editing, and scheduling. For first-line ad-hoc user support, PowerShell is a resource sinkhole that slows down ticket resolution, sucks in senior IT, and eats up end-user productivity.

To do “simple” mailbox folder permission management using MS standard tooling, your helpdesk needs to juggle five separate cmdlets and hand-type access rights, exact user identities, and SharingPermissionFlags values for calendar delegates.

With EasyEntra, first-line supporters of any level can view and manage mailbox folder permissions in seconds with close to zero training.

And this is just one of many features available in the same application.

“My team and I are blown away with EasyEntra.”
Group IT Manager, RM Curtis, United Kingdom

---

⚡️ Microsoft

🔥 Public Preview

• Configure Microsoft Entra ID to Active Directory provisioning (preview)

• Preserve a group’s organizational unit and name when you convert Source of Authority (preview)

• Tutorial: Govern access to an on-premises app from Microsoft Entra ID (preview)

• Entra Domain Services - Public preview of enhanced security account manager support

📖 Read

• ​​​​​​What’s new in Microsoft Security: August 2026 • Alym Rayani

🗣️ Message Center

• MC1411574 - Microsoft Entra: System-preferred authentication now applies to first-factor authentication

• MC1461704 - Microsoft Defender XDR: Unified response actions across identity accounts

• MC1461705 - Microsoft Defender XDR: Unified identity timeline on the Identity page

• MC1462460 - Microsoft Entra: Domain update for My Account and identity self-service experiences

• MC1462464 - Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retired

---

From the community…

🚀 Most popular posts from last week

• 🥇 Microsoft Graph’s Move Toward More Granular API Permissions • AIMA

• 🥈 Microsoft says use Tenant Restrictions to block personal Copilot access. I have questions. • Adam Fowler

• 🥉 Calculating the Licensing Requirement for Entra Conditional Access Policies • Tony Redmond

---

What happens when the identity services behind Microsoft 365 go down?

Join us this week for a live discussion on 𝗧𝗵𝗲 𝗡𝗲𝘄 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 𝗼𝗳 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗥𝗲𝗰𝗼𝘃𝗲𝗿𝘆 with Merill Fernando, host of Entra.Chat, and Craig Birch of Cayosoft.

---

☀️ Learn

👩‍✈️ AI & Copilot

• Using the Entra ID Agentic ID sample • Rory Braybrook

• Conditional Access for Agents: Blocking Agent Identities with Risk and Custom Security Attributes • Derk van der Woude

• Agent 365 settings explained • Derk van der Woude

• 📺 Hide Your OpenAI Key Behind an agentgateway Proxy and Enforce Entra ID with ChatGTP Desktop APP • Sebastian Maniak

🧰 Workload ID

• App instance property lock gets a scoping mechanism (and some other updates) • Vasil Michev

• New Graph Permissions Pose Questions for Microsoft 365 Tenants • Tony Redmond

• Access Azure Key Vault from a Local Kubernetes Cluster with Azure Arc Workload Identity • Ben Reader

• Instant revocation of service principal bearer tokens with CAE • Simone Oor

⛑️ ID Protection

• Entra ID P2 for SMBs: Is it Worth It and Which License to choose? • Gannon Novak

• Identity Threat Protection Starts After the Login • Derek Morgan

👮‍♂️ ID Governance

• Agentifying Entra ID using SCIM • Darren Robinson

• Microsoft PIM is great - but it has some shortcomings that need fixing • Stian A. Strysse

🌐 Private Access & Internet Access (GSA)

• Entra ID – A new version of the Global Secure Access is available • Benoit HAMET

• What’s New in Entra Global Secure Access Client v2.32.294.0 • Richard M. Hicks

• Global Secure Access – Now with Windows Update support! • Michael Morten Sonne

🫆 Authentication

• Passkeys for dummies • Sapir Federovsky

• Configuring Microsoft Entra ID Authentication for Azure SQL Database using Azure Bicep • Brian Veldman

• Passkeys Explained: What They Are & Why They Win • Phil Wade

• 📺 Microsoft Is Retiring SMS & Voice MFA by 2027 - are you ready? • Rio Hindle

• 📺 SMS MFA → Passkey: What Happens on September 1? • Azure Brother

• 📺 The NEW Passwordless Onboarding Flow | TAP → Passkey → Autopilot → WHfB • Azure Brother

👥 User & Group Management

• Microsoft Entra memberOf Retirement: What Admins Must Do • Merill Fernando

• Microsoft accidentally created a new “All Company” group in Entra ID • Tobias Asböck

• 📺 Your Entra Dynamic Groups Break in November (Silently) • Jonathan Edwards

🤖 DevOps & PowerShell

• Microsoft To Enforce WAM for Delegated Interactive Graph Sessions • Tony Redmond

• New Graph API permissions point to Entra ID diagnostics • Daniel Bradley

• Microsoft just added 13 Graph authentication delete permissions • Daniel Bradley

• Interact with MSGraph API locally • Morten Mynster

🚦 Conditional Access

• 10 Conditional Access Mistakes That Are Probably In Your Tenant Right Now • Jonathan Hope

• Your Entra ID protected action has a gap • Jurre Janssens

🖥️ Devices

• Fix Autopilot Device Enrollment Error 80180003 [7 Solutions] • Prajwal Desai

🥷 Security

• Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques • Niklas Kerner

• PRTremote: hijacking sessions via scheduled tasks • Jake Otte

• 📺 16. Kuba Gretzky: Downgrading FIDO MFA With AI Slop • Kuba Gretzky

♻️ Sync

• Sync Entra ID users to Active Directory with Cloud Sync • Daniel Bradley

📒 Tenant Configuration

• How To Use Entra Native Backup and Recovery • Michael Vink

---

🔥 Maester

• Running a community security baseline in CI: adding Maester to a Terraform and Entra ID GitHub Actions pipeline • Antonio Russo

---

👨🏽‍💻 Merill’s corner

---

---

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

---

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.