Friday, 13 November 2026

Starting mid-November 2026, Microsoft Entra ID will add risk-based CAPTCHA verification for SMS and voice MFA to prevent automated fraud. Some users may need to complete CAPTCHA before receiving codes or calls. Administrators should prepare users, ensure network readiness, and promote phishing-resistant methods.

For reused Windows Autopilot devices with a new owner, the new owner must contact a non-device owner administrator to obtain the BitLocker recovery key, even when the new owner is an administrator.

A new article documents how to publish and test policy versions, roll out changes using report-only assignments, switch enforcement, roll back, and delete or restore policies.

A new article explains how to create custom Microsoft Entra resource policies with Rego, including policy structure, selectors, operations, parameters, naming and versioning rules, supported built-ins, and a sample application naming policy. The capability is marked preview.

New guidance explains how to use a customer-owned single-tenant application for read-only Microsoft Graph calls through `fetchAsPolicy()`, independently of the caller’s permissions. It covers required roles, application permissions, federated identity setup, and admin consent.

New documentation explains how to find built-in policies, create custom definitions, manage assignments and versions, restore or delete items, and configure privileged policy reads through the admin center.

A new preview article explains request matching, Rego applicability and compliance checks, enforcement modes, simulated evaluations, diagnostics, and up to 10 minutes of assignment propagation delay.

A new article explains parameter schemas, assignment values, defaults, validation, supported types, Rego access, and update behavior for resource policies.

A new page lists limits for policy definitions, assignments, Rego content, evaluations, Microsoft Graph reads, and API requests, along with permitted Rego built-ins.

The documentation explains how to assign a built-in resource policy in report-only mode and test simulated compliant and noncompliant requests using Microsoft Graph Explorer, without creating applications or writing Rego.

A new guide explains how to test policies, use report-only assignments, review evaluation audit events, resolve violations, manage temporary application exceptions, and enable enforcement.

The tutorial shows how to observe real requests, review evaluation audit events, enable enforcement, verify recovery, and remove a built-in resource policy assignment. It also documents prerequisites, roles, Graph permissions, and cleanup steps.

A new preview reference lists resource types, actions, and operation categories that custom Entra resource policies can target. It also explains derived-type handling through `includeDerivedTypes`.

The licensing documentation now explains that most preview resource policy operations require an Entra ID Governance service plan; P1 or P2 alone is insufficient. It also documents operation exceptions, continuing role/API requirements, and `doNotEnforce` assignment behavior.

The guide now presents resource policy as an independent adoption path, alongside tenant discovery, governance relationships, and configuration management. It adds links to resource policy setup, tutorials, and safe deployment guidance.

The page now explains that governance policy templates define cross-tenant access for governance relationships and that creating a template does not create a resource policy assignment. The page date and customer-intent metadata were also updated.

The use-case documentation now includes governing agent identities and their access rights, alongside employee, guest, partner, and application governance.

The documentation adds tenant-level export of MicrosoftGraphPolicyLogs to Log Analytics, Azure Storage, or Event Hubs, including prerequisites and KQL analysis guidance.

The documentation adds procedures for evaluating custom and assigned policies with simulated requests, inspecting normalized input, interpreting results, and investigating unexpected enforcement outcomes.

The new article explains how to query preview evaluation audit events through Microsoft Graph Explorer to investigate requests and assess assignment impact, including policy decisions, versions, errors, and affected applications.

The documentation explains that assignment changes can take up to 10 minutes to affect requests, recommends `evaluateAssignedPolicies` for testing, and lists diagnostics to collect for unexpected results.

The documentation adds Resource policy (preview), which evaluates matching Microsoft Graph requests. Administrators can use built-in or Rego-based custom policies, test them in doNotEnforce mode, enforce blocking, and inspect audit events. It does not scan or remediate existing resources automatically.

A new article explains policy definitions, versions, assignments, scopes, parameters, applicability, enforcement modes, and permissions across the admin center and Microsoft Graph. It notes that definitions do not enforce policies and assignments target exact versions.

The new documentation describes policies that evaluate matching Microsoft Graph requests and can record or block noncompliant configuration changes. It covers built-in and custom Rego policies, simulated evaluations, audit logs, and enforcement modes.

The documentation now states that TOTP authentication in external tenants will become generally available at the end of November 2026, with rollout completing in early December 2026.