Hi folks, Merill and Joshua here with this week’s roundup of the latest Microsoft Entra news from around the globe 🌍
A stolen refresh token is one of the most useful things an attacker can walk away with. In this week’s Entra Chat episode we dig into what Global Secure Access adds on top of Entra ID to shut that down, from Universal CAE to securing agents.
Some highlights from this week’s issue
👉 The Microsoft Digital Defense Report 2026 is out, plus a community breakdown of the key takeaways
👉 Message Center: passkey support for B2B users, and a reminder to replace memberOf dynamic group rule
👉 Darren Robinson’s two-part series on MCP skills as IAM guardrails for agentic identity lifecycle
👉 A deep dive into a device code phishing campaign
👉 Maester 2.3 is here. Moar products, moar tests! New coverage for GitHub, Azure DevOps, Agent ID, Intune, GSA and macOS
👉 Configuring emergency accounts, accepted risks, custom domains and more lands in Maester Cloud!
Enjoy!
Stolen Tokens, Agents and Universal CAE: What Global Secure Access Adds to Entra ID
A phished and stolen refresh token is one of the most useful things an attacker can take from your tenant. It is a long-term artifact, which is why so many phishing attempts go after it. Alex Pavlovsky’s answer to that attack is a feature every Entra ID P1 tenant already owns.
Enjoy!
Sponsored by:
EasyEntra: Empower First-Level Support to Work Efficiently
Managing standard first-level user support in a hybrid environment is overly complex. To handle even basic tasks, your team needs expertise across multiple platforms like ADUC, Exchange on-premises Admin Center, M365 Admin Center, Entra Admin Center, EXO Admin Center, EXO PowerShell, and Entra Connect PowerShell.
EasyEntra eliminates this complexity and allows first-level support to work without headaches:
✅ Intuitive - The interface mimics the familiar AD Users & Computers layout.
✅ Consolidated - Manage all user settings from a single-pane-of-glass.
✅ Responsive - Preloads all properties for lightning-fast navigation of settings.
✅ Reduces junior IT training - Onboard junior IT staff in minutes.
✅ Protects senior IT staff - Prevent first-level support tickets from escalating.
⚡️ Microsoft
📖 Read
Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027 • SharePoint Team
Post-quantum authentication: Why organizations should start testing certificate ecosystems now • Microsoft Security Research
📺 Watch
📺 Microsoft Entra Tenant Governance in action: best practices and real-world scenarios • Ben Athawes, Jeff Staiman and Nik Charlebois
🗣️ Message Center
MC1459133 - Microsoft Entra ID: Passkey support for B2B users
MC1437671 - Microsoft Entra: Passwordless password change in My Sign-Ins
From the community…
🚀 Most popular posts from last week
🥇 Microsoft Enforces Conditional Access on Outlook Attachments with a Dedicated Entra Application • Karthi
🥈 Dynamic PIM role activation picker • Aaron Guilmette
🥉 Known EWS Apps that need Allow-Listing or a Migration – with AppIDs • Rudy Mens
Sponsored by:
Get your Entra ID Applications Ready for 2027
Get your Entra ID Applications Ready for 2027
📆If your organization’s 2027 plans include new agents, apps, and SaaS integrations, your Entra tenant will also see more identities, permissions, credentials, and access to govern.ENow’s Entra ID App Governance Playbook covers the five governance gaps that increase your attack surface and potential blast radius, from over-permissioned applications to expired client secrets that disrupt business operations and productivity. We’ll show you what to triage first, starting with tenant-wide defaults. Follow the playbook over the next 3 months, and you’ll start 2027 with stronger governance and security postures and a foundation for ongoing Entra ID application lifecycle governance.
📖 Inside: Microsoft’s client secret guidance, practical recommendations, and an FAQ you can share with your team.
☀️ Learn
👩✈️ AI & Copilot
Agent ID Effective Access: From Inventory to Permission Intelligence • David Alonso Dominguez
🧰 Workload ID
Securing SharePoint access with Managed Identities and Sites.Selected permission • Damien Van Robaeys
⛑️ ID Protection
📺 Your Entra Risk Policies Retired. Here’s What Replaces Them • Jonathan Edwards
👮♂️ ID Governance
My scripts grew up: introducing SiSGovernance • Sandra Saluti
Users can now manage their sponsored Entra ID guest accounts in My Account (Preview) • Tobias Asböck
AI MCP Skills as IAM Policy: Guardrails for Agentic Identity Lifecycle Orchestration (Part 1) • Darren Robinson
AI MCP Skills as IAM Policy: Guardrails for Agentic Identity Lifecycle Orchestration (Part 2) • Darren Robinson
Zero-trust Microsoft Entra ID • Keith Doolan
🌐 Private Access & Internet Access (GSA)
Microsoft Entra Global Secure Access: Prompt Injection Protection for Generative AI • Oliver Mueller
Multiple Traffic Forwarding Profiles for Private Access • Alexander Appelby
Authentication
What’s the hardest part of a passwordless rollout? • Michael Duddington
The authentication debate has a blind spot • Joël Prins
Key takeaways from the Microsoft Digital Defense Report 2026 • Niklas Tinner
MFA Passed. The Attacker Still Got In. • Carlos Perez
🤖 DevOps & PowerShell
🚦 Conditional Access
Zero Trust - Conditional Access Architecture • Guillaume Bossiroy
📺 Microsoft Entra Conditional Access Made Easy Complete Beginner Guide 2026 • Andy Malone
🖥️ Devices
Citrix DaaS – Entra ID SSO in Co-existence with FAS • Julian Jakob
How to Disable SMTP AUTH in Exchange Online • Ali Tajran
Inside Intune: Faster compliance updates for Windows devices • Rudy Ooms
🥷 Security
Borrowing Windows Hello keys for authentication and persistence • Dirk-jan Mollema
Anatomy of a device code phishing campaign • Nicola Suter
📒 Tenant Configuration
Five boundaries before an IAM pipeline runs • Felix Elliott
🛍️ External ID - Customers
Build your own Tenant Portal (with AI, in an afternoon) • Mateusz Jendza
🔥 Maester
Maester 3.0: a new test engine, and a heads-up for preview users • Merill Fernando
👨🏽💻 Merill’s corner
What’s new in Maester Cloud this week
Control which Maester tests run in each tenant, review new tests before they run, record accepted risks properly, and save the views you use every day.
Want to get featured on Entra.News? → Submit your content 😎
Want us to say nice things about your company? Sponsor entra.news 🤩
Love the newsletter? Tell us 💚❤️💜
🪃 Acknowledgement of Country
Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.