Entra 🆔 News #173 → This week in Microsoft Entra

Learn about Entra Conditional Access policy plans, new passkey and SMS rollout dates, and how AI agents turned a trusted app against Entra tenants.

👋 Hi, Merill and Joshua here with this week’s roundup of the latest news on Microsoft Entra from around the globe 🌍.

Lots of Microsoft news this week. Looks like they’re clearing the deck before Ignite.

Conditional Access policy plans are now in preview. Lots of you wrote about it, so check out the Conditional Access section below.

A few dates got pushed out too. Passkey profiles now go GA in July 2027. And the MemberOf deadline is November 3, or March 31, 2027 if you have ID Governance.

The top post last week was “Active Directory is finally dead” by Spencer Alessi. Glad Spence finally agrees. 😄

I also wrote a guest post on the ConnectWise attack. It shows how a trusted app was turned against Entra tenants, and what to check in your own apps and permissions.

On the podcast this week, Kelvin Tegelaar joins us to talk about the mistakes SaaS builders and admins make with multi-tenant apps. Thanks Kelvin, this one is a must watch!

Enjoy!

---

Sponsored by:

ENow Software Introduces New Entra ID App Onboarding Experience

As requests for SaaS and AI applications grow, Entra ID and M365 teams face more frequent security reviews, time-consuming manual research, and approval bottlenecks.

App Onboarding in AppGov 4.0 helps teams:

• Accelerate approvals and reduce manual work with configurable, multistage workflows and centralized request management.

• Assess security risks efficiently with integrated Microsoft Defender for Cloud Apps risk scores.

• Improve transparency with a self-service portal for requesters to track status and decisions.

Other Highlights: Internal App Catalog. Enhanced Stale Apps reports. Expanded change history across ownership, permissions, credentials, and policies. Actionable AppGov Score recommendations prioritized by effort or impact. Learn More About ENow App Governance Accelerator 4.0

---

⚡️ Microsoft

🏆 General Availability

• Choose your own telephony provider for SMS and voice authentication

• MC1282568 - General Availability: Microsoft Entra passkeys on Windows

🔥 Public Preview

• Create a Microsoft Entra Conditional Access policy plan (preview)

• Migrate Conditional Access policies to a policy plan (preview)

• Include access packages in catalog access reviews (preview)

• Configure cloud firewall for Global Secure Access clients (preview)

📖 Read

• IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment • Rob Lefferts

• AI agents are coming—are your identity controls prepared? • Melanie Maynes

• Why identity needs network insight to make Zero Trust work • Mohammad Zmaili

📺 Watch

• 📺 New Conditional Access policy plans in Microsoft Entra • Etan Basseri

• 📺 Conditional Access for AI Agents in Microsoft Entra • Microsoft Mechanics

• 📺 Satya Nadella’s vision for Security • Microsoft Security

🗣️ Message Center

• MC1529463 - Microsoft Entra ID: Final reminder to replace MemberOf rule operator configurations by November 3, 2026

  • Note: If you are licensed for ID Governance, Microsoft has extended the deadline for the retirement of the MemberOf operator to March 31, 2027

• MC1528006 - Microsoft Authenticator: Improved backup and restore experience for Android

• MC1528000 - Microsoft Entra ID: Reminder to migrate from Microsoft-provided SMS and voice authentication

• MC1518029 - Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication

• MC1530615 - Microsoft Teams: Report guest invitations for security concerns

• MC1532256 - Microsoft Teams: Granular Conditional Access for Teams meetings

• MC1478975 - Microsoft 365 Copilot: Use Microsoft Agent 365 agents as connected agents in declarative agents

Updated timelines

• MC1221452 - (Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants - Update to timeline (Nov 30, 2026→Jul 2, 2027)

• MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method - Update to timeline (Oct-Nov → Nov-Jan 2027)

• MC1465763 - Microsoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in (complete by Sep 2026 → Nov 2026)

---

From the community…

🚀 Most popular posts from last week

• 🥇 Active Directory is finally dead • Spencer Alessi

• 🥈 Connecting Claude to the Entra MCP Server • Klaus Bierschenk

• 🥉 What are Conditional Access Plans? • Daniel Bradley

☀️ Learn

👩‍✈️ AI & Copilot

• Hooray! Your users are about to become agent architects! • Per-Torben Sorensen

• Zero Trust for AI Agents: When Machines Become Identities • Daniel Chronlund

🧰 Workload ID

• SharePoint AI Indexer Permissions: Is Sites.Selected Enough? • Kaspars Jurjāns

👮‍♂️ ID Governance

• PIM for Azure Roles Gotcha • Jay Kerai

• Investigating Identity Threats in Microsoft Entra: What to Watch For and How to Respond • Colby Pryor

• Is this a new request or a extension? • Sandra Saluti

• Microsoft offers free clean-up for inactive Agent IDs • Daniel Bradley

📦 Apps

• You scoped an app to 50 mailboxes. It can still read all of them. • Darius Frank

---

Sponsored by

Maester Cloud turns every Maester and Microsoft Zero Trust Assessment run into a durable evidence trail. See new failures, fixes, accepted risks, and posture changes across every tenant - without digging through old HTML reports.

• Keep 5+ years of tenant history in your chosen Azure region

• Compare runs, spot drift, and get change alerts

Become a Founding Supporter for $99/month (also avaiable on Azure Marketplace) to fund open-source Maester development, shape the roadmap.

---

🫆 Authentication

• Allow password change after secure sign-in • Jan Bakker

• Optimizations for passkey registration experience you might have missed • Jan Bakker

• Microsoft Entra CAPTCHA for SMS and Voice Authentication • Mezba Uddin

• A new workaround for authentication strength Conditional Access policy loops: Microsoft Authenticator Credential Registration service principal • Jan Bakker

👥 User & Group Management

• Soft-delete functionality for custom Entra ID roles • Vasil Michev

• How to Create a Security Group with Nesting Disabled • MEZBA UDDIN

🤖 DevOps & PowerShell

• Bringing Day Zero Microsoft Graph Support to Azure Bicep • Brian Veldman

🚦 Conditional Access

• Zero Trust - Conditional Access Policy Maturity • Guillaume Bossiroy

• Migrate Conditional Access Policies to Policy Plans • Rudy Mens

• Building a Conditional Access Analyzer That Works Entirely Offline • Daniel Chronlund

• Microsoft Launches Preview for Entra ID Conditional Access Policy Plans • Tony Redmond

• Policy Plans Change How You Organize Conditional Access • Jonathan Hope

• Conditional Access Policy Plans in Microsoft Entra ID • Blesslin Rinu

• Don’t Let Your Exclusions Ghost You: Conditional Access Policy Plans • Kevin Villarreal

🖥️ Devices

• Intune STIG Audit: What Happens After You Click Create • Rudy Ooms

• BitLocker Recovery Key Missing in Intune? Find It, Fix It and Catch the Keys That Lie • Mark Oldham

• Platform SSO not working on macOS: causes, in order • Golam Rafi Badhon

🏙️ External ID - Guests & Multi-Tenant Organizations

• (2026-10-30) How To Remove Yourself From An Entra ID Guest Account “Hostage” Situation? • Jorge de Almeida Pinto

• Microsoft Entra ID now supports Passkeys for B2B guest users • Tobias Asböck

• Microsoft 365 Multitenant Organization (MTO) Setup Guide: Cross-Tenant Sync, Teams Collaboration & Exchange Address Book • Sreejith Reghunathan Pillai

• Cleaning Up Entra ID Guest Accounts: Remove, Review or Keep • Matej Klemenčič

🥷 Security

• Enclave: AuthMask: We Made Microsoft Authenticator Hand Over Tokens to an App With Zero Permissions • Ofek Levin

• A second look at AuthCodeFix (ConsentFix) • Christopher Brumm

• Device Code Phishing: Prevention, Detection and Response • Christopher Brumm

📒 Tenant Configuration

• Entra License Usage: Finally Find Out Who’s Using the P1 and P2 You Pay For • Mark Oldham

• Minimizing Active Directory • Michael Nielsen

• 📺 Microsoft 365 & Entra ID Just Changed! What’s NEW? Oct:Nov 2026 • Andy Malone

🛍️ External ID - Customers

• Using passkeys with Entra External ID (EEID) • Rory Braybrook

Microsoft Learn - Entra Docs

• Microsoft disables public contributions to Entra docs • Daniel Bradley

---

⚒️ Toolkit

• EntraOps 1.1 is available! • Thomas Naunheim

• GitHub - Jinssi/AuthFlowMap: Interactive map of OAuth, Conditional Access, Entra Agent ID and MCP authentication flows, step by step • Aapo Latvala

---

🔥 Maester

---

👨🏽‍💻 Merill’s corner

• Inside ConnectWise Attack: How AI Agents Turned a Trusted App Against Entra ID Tenants

---

---

• Want to get featured on Entra.News? → Submit your content 😎

• Want us to say nice things about your company? Sponsor entra.news 🤩

• Love the newsletter? Tell us 💚❤️💜

---

🪃 Acknowledgement of Country

Entra.News is created on Wurundjeri land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.