Whats New
New featureThe June 2026 update adds the Entra SOC Identity Responder role and updates the Security Operator and AI Administrator roles.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Entra adds SOC Identity Responder as passkey registration optimization rolls out
The period brings a meaningful Entra role addition and a live passkey-registration rollout, plus new HiBob-to-Active Directory hybrid provisioning guidance. Remaining updates sharpen permissions and recovery boundaries: Security Administrator references diverge on identity containment, while Agent ID sponsors cannot restore resources they disable or delete.
- Entra SOC Identity Responder gets explicit containment permissions
Entra ID · GeneralThe permissions reference documents the Entra SOC Identity Responder role for SOC incident response, including disabling users, revoking active sign-in sessions, and resetting passwords.
- Passkey registration optimization runs through mid-September
Entra ID · AuthenticationMicrosoft Entra will better follow administrator policies, prioritize local-device passkeys, and improve successful registration without UI changes. The rollout began in late August 2026 and is scheduled to complete by mid-September; no action is required.
- New HiBob guidance connects Entra provisioning to on-premises AD
Entra ID · ProvisioningNew guidance covers HiBob provisioning and updating users in on-premises Active Directory through Entra API-driven provisioning and the provisioning agent, including prerequisites, permissions, connection setup, and synchronization flow.
- Security Administrator containment guidance now needs reconciliationEntra ID · Authentication
One updated permissions reference describes Security Administrators as reading security information and reports and managing Entra ID and Office 365 configuration while removing identity-containment language; another same-day update says the role can perform containment actions. A separate role table limits the role to non-administrative accounts and excludes action on privileged accounts.
- Agent ID sponsors cannot restore identities they disable
Agent ID · GovernanceSponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities. Owners or administrators must handle recovery.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
12 updates
Microsoft Entra ID
9 updatesDelegate By Task
Feature updateThe documentation now lists Security Administrator, alongside Helpdesk Administrator and User Administrator, for invalidating non-admin users’ refresh tokens.
Permissions Reference
Doc updateThe permissions reference now documents the Entra SOC Identity Responder role and its identity-containment actions, including disabling users, revoking active sign-in sessions, and resetting passwords.
Least privileged roles by task
New featureThe task delegation table now maps identity containment actions for SOC incident response to the Entra SOC Identity Responder role.
Permissions Reference
Doc updateThe permissions reference no longer states that Security Administrators can perform identity containment actions during security incidents. It now describes the role as reading security information and reports and managing configuration in Microsoft Entra ID and Office 365.
Permissions Reference
Doc updateThe role description now states that Security Administrators can perform identity containment actions during security incidents.
Microsoft Entra ID is optimizing passkey registration to better align with administrator policies, prioritize local device passkeys, and improve successful registrations without UI changes. The rollout begins late August 2026, completing by mid-September. No action is required; organizations should continue promoting passkey adoption.
Privileged Roles Permissions
Doc updateThe documentation now lists Security Administrator alongside Security Operator and Entra SOC Identity Responder as limited to non-administrative user accounts and unable to act on privileged accounts.
New documentation explains how HiBob can provision and update users in on-premises Active Directory through Microsoft Entra API-driven provisioning and the provisioning agent. It covers prerequisites, permissions, configuration, and synchronization flow.
Microsoft Entra Agent ID
2 updatesManage Agent Identities End User
Doc updateThe documentation now states that sponsors cannot re-enable disabled agents; an owner or administrator must help re-enable them.
Agent Owners Sponsors Managers
Doc updateSponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities.
Microsoft Entra ID Governance
1 updateApps
Doc updateThe HR integrations table now includes a link for HiBob to Microsoft Entra ID/Active Directory and updates the Rippling provisioning link text.