🔑 Surprise! Your users have passkeys now. The Entra passkey registration campaign is rolling out, and a lot of admins are finding passkeys in their tenant that they never planned for. If that's you, there's plenty in the Authentication section this week. Shane Mallia looks into why synced passkeys are showing up, Jan Bakker covers the smoother onboarding experience and where to store your passkey, and Steven Weiner shows how to opt out of the campaign with Graph if you need more time. For the bigger picture, Ru Campbell has published a video plus Jonathan Hope's two-part series on the SMS and voice retirement (Part 1, Part 2) covers planning your move off phone-based MFA.
🚨 17 trillion records. That's how many Microsoft records one researcher says they could have accessed. It's a good reminder that apps and service principals are identities too, and they're often the least-watched ones in the tenant. Microsoft's own write-up on Storm-3168 abusing compromised service principals makes the same point. I shared a few practical steps for locking down the apps in your tenant in this LinkedIn post. Worth a read before your next app review.
Enjoy!
Sponsored by:
EasyEntra: Empower First-Level Support to Work Efficiently
Managing standard first-level user support in a hybrid environment is overly complex. To handle even basic tasks, your team needs expertise across multiple platforms like ADUC, Exchange on-premises Admin Center, M365 Admin Center, Entra Admin Center, EXO Admin Center, EXO PowerShell, and Entra Connect PowerShell.
EasyEntra eliminates this complexity and allows first-level support to work without headaches:
✅ Intuitive - The interface mimics the familiar AD Users & Computers layout.
✅ Consolidated - Manage all user settings from a single-pane-of-glass.
✅ Responsive - Preloads all properties for lightning-fast navigation of settings.
✅ Reduces junior IT training - Onboard junior IT staff in minutes.
✅ Protects senior IT staff - Prevent first-level support tickets from escalating.
⚡️ Microsoft
🔥 Public Preview
What’s new in Microsoft Security: September 2026 • Alym Rayani
📖 Read
Unmasking EvilTokens: Getting to the root of device code phishing • Microsoft Threat Intelligence and Microsoft Security Research
Storm-3168: Agentic-driven cloud attacks using compromised service principals • Microsoft Security Research
🗣️ Message Center
📆 Upcoming Events
Prepare your tenant estate for AI: Join our upcoming webinars • Hien Nguyen
Microsoft Entra Tenant Governance in action: Best practices and real-world scenarios - October 6, 2026 ⏰ 9:00 AM–10:00 AM Pacific Time
From the community…
🚀 Most popular posts from last week
🥇 Microsoft delays Entra SMS and voice retirement dates • Daniel Bradley
🥈 Building a Modern Conditional Access Strategy: The Identity Firewall Your Organization Actually Needs • Colby Pryor
🥉 Finally a smooth(er) passkey onboarding experience in Microsoft 365! • Jan Bakker
Sponsored by
Maester tells you what’s failing today. Maester Cloud tells you what changed. Every Maester run lands in one portal, so new failures, fixes, and drift across every tenant surface on their own, with no more diffing old HTML reports.
Drift alerts emailed from your own Microsoft 365 mailbox
5+ years of run history as audit evidence, for unlimited tenants and users
$99/month, self-hosted in your own Azure subscription with guided setup in minutes. Cancel any time. Every subscription funds the free, open-source Maester core.
☀️ Learn
👩✈️ AI & Copilot
Security Copilot is now included as part of Microsoft 365 E5/E7 • Daniel Bradley
📺 Agent ID: Why AI Agents Need Their Own Identity • Rio Hindle
👮♂️ ID Governance
🌐 Private Access & Internet Access (GSA)
📺 Global Secure Access Failure States, Maester 2.2 Active Directory Checks, and OpenAI Misalignment • Cloudy with a Chance of Insights, The MSFT Podcast
Authentication
Synced Passkeys Appearing in Entra? Was SMS the reason? • Shane Mallia
(Mis)understanding Software OATH token in Entra • Dániel Kovács
Where to store your Microsoft 365 passkey? • Jan Bakker
Entra ID telephony providers for SMS and voice MFA: first look • Jan Bakker
Passkeys on the laptop are easy. The phone? Not so much! • Per-Torben Sorensen
How to Run a Passkey Registration Campaign in Entra ID • Kavya
SMS and Voice Retirement, Part 1 • Jonathan Hope
SMS and Voice Retirement, Part 2 • Jonathan Hope
📺 How to Fix Entra Passkey Registration on BYOD [Walkthrough] • Ru Campbell
📺 How to Opt Out of the Entra ID Passkey Registration Campaign with Microsoft Graph • Steven Weiner
👥 User & Group Management
What is dynamicMembershipPriority for Entra Groups? • Daniel Bradley
Permission update for the AI Administrator role in Entra ID • Tobias Asböck
Security operator permission change • Jay Kerai
🤖 DevOps & PowerShell
Graph API adds (limited) support for onPremisesExtensionAttributes for group objects • Vasil Michev
How to Use Separate Apps to Control Access to the Microsoft Graph PowerShell SDK • Tony Redmond
🚦 Conditional Access
Context-based Redirections (Preview): Smarter Security for Every Remote Session • Flavio Meyer
Microsoft Entra Token Protection for Browsers: Same Key, Wrong Car • Dustin Gullett
Entra Protected Actions | Putting Guardrails Around Your Most Critical Admin Tasks • Michael Vink
Conditional Access Emergency Bypass: When an Exclusion Needs to Work Now • Marco Wohler
🥷 Security
♻️ Sync
Entra ID – New version of Entra ID Connect (2.6.91.0) is available with migration workflow to Entra ID Cloud Sync • Benoit HAMET
📺 Time to Switch? Migrate from Entra Connect to Cloud Sync FULL DEMO! • Andy Malone
📒 Tenant Configuration
New Entra event hints at account takeover controls • Daniel Bradley
Granular Delegated Administrative Privileges (GDAP) – where is it not supported/working correctly? • Michael Morten Sonne
How Easy is It to Restore Microsoft 365 Tenants After a Catastrophic Attack • Tony Redmond
⚒️ Toolkit
Where to store your Microsoft 365 passkey? • Jan Bakker
🔥 Maester
Beyond Baselines: Building Custom Identity Security Testing with Maester and PowerShell • Sam Erde, Merill Fernando
👨🏽💻 Merill’s corner
Want to get featured on Entra.News? → Submit your content 😎
Want us to say nice things about your company? Sponsor entra.news 🤩
Love the newsletter? Tell us 💚❤️💜
🪃 Acknowledgement of Country
Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.