Daily.Entra.NewsA cross-product view of Microsoft Entra changes related to Authentication.
Microsoft Entra ID is optimizing passkey registration via Registration Campaign, Authentication Strengths, and My Sign-Ins to improve compliance with passkey policies and prioritize local device passkeys. These changes, rolling out in late August 2026, require no user interface changes or action from organizations.
| `exp` | int, a Unix timestamp | Specifies the expiration time before which the JWT can be accepted for processing. A resource may reject the token before this time as well. The rejection can occur for a required change in authentication or when a token is revoked. | |
Microsoft Entra will enable passwordless users to change their passwords via My Sign-Ins using strong credentials like passkeys or Windows Hello, without knowing the current password or using SSPR. This feature, disabled by default, requires admin activation and will roll out globally in late October 2026.
- They work with all Microsoft Entra-integrated third-party apps at the authentication plane during sign-in.
Microsoft Entra passkeys on Windows will be generally available from late April 2026, enabling phishing-resistant, passwordless sign-in on Windows devices without explicit opt-in. This supports corporate, personal, and shared devices, with admin controls via Authentication Methods policies and Conditional Access. No action is needed unless blocking is desired.
Microsoft Entra is replacing legacy CAPTCHA in self-service password reset with backend throttling and behavior-based abuse detection to enhance security and accessibility. The rollout starts early August 2026, requires no user or admin action, and maintains current password reset functionality without introducing new controls.
Explicit Forward Proxy for Microsoft Entra Internet Access relies on IP affinity, among other mechanisms, for session management. Although a Conditional Access policy isn't required, we recommend that you configure one that restricts the use of Explicit Forward Proxy to networks that your organization trusts. Additionally, you use Conditional Access policies to assign the Microsoft Entra Internet Access security profiles to users.
Learn how to configure Microsoft Entra ID to automatically provision and de-provision user accounts to Netskope User Authentication.
You can configure Explicit Forward Proxy (preview) to rely on the private IP addresses of devices on your network to associate authenticated users with their devices. To use HTTP header session management with Explicit Forward Proxy, you need to securely communicate the private IP address of the device to the Explicit Forward Proxy feature.
Microsoft Entra improves the Microsoft Authenticator passkey restore experience on iOS with a clearer, guided flow for device migration, available worldwide in August 2026. It affects iOS users with iCloud backups, is enabled by default, requires no admin changes, and no action is needed.
Learn how to back up and restore Microsoft Authenticator account entries when you switch to a new phone, including passkey setup steps.
Learn how Microsoft Entra passkey on Windows enables phishing-resistant authentication with work or school accounts by using Windows Hello as a FIDO2 passkey provider.
Learn about synced passkeys in Microsoft Entra ID, including how to configure, register, and sign in with synced passkeys.
Learn how to enable passwordless security key sign-in to Windows with Microsoft Entra ID using FIDO2 security keys.
Learn how to register a Microsoft Entra passkey on Windows by using Windows Hello as a FIDO2 passkey provider for phishing-resistant sign-in.
Learn how to register a passkey with a FIDO2 security key in Microsoft Entra ID. Use Security info or a prompted sign-in flow.
Learn how to register a synced passkey (FIDO2) as an authentication method on Windows, iOS, or Android by using a browser for phishing-resistant sign-in.
A Microsoft Entra documentation page was updated: Register Passkey Mobile.
Learn how to register passkeys in Microsoft Authenticator on Android and iOS. Sign in to the app, use Security info, or register cross-device.
Learn how to sign in to Microsoft Entra ID with a FIDO2 security key. Sign in to web apps, Windows, and on-premises resources.
Learn how to sign in with a Microsoft Entra passkey on Windows by using Windows Hello as a FIDO2 passkey provider for phishing-resistant authentication.
Learn how to sign in to Microsoft Entra ID with a synced passkey (FIDO2) for your work or school account by using a browser on Windows, iOS, or Android.
Learn how to sign in with passkeys in Microsoft Authenticator for Android and iOS. Use same-device, cross-device, or native app authentication.
A Microsoft Entra documentation page was updated: Support Authenticator Passkey.
Learn how to enable source IP restoration for Microsoft traffic in Global Secure Access and validate Microsoft Entra sign-in logs.
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Forcepoint Cloud Security Gateway - User Authentication.
Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Palo Alto Networks Cloud Identity Engine - Cloud Authentication Service.
Learn how to use the Conditional Access Optimization Agent to safely deploy a passkey program to roll out phishing-resistant authentication methods.
Learn how to sign in and sign up with alias/username with External ID for customer identity and access management (CIAM). Get detailed steps to enable username as a sign-in identifier and create users with both email address and username.
Use shared helper functions for authentication and alert email in Global Secure Access operations automation scripts.
Learn how to sign up users with email one-time passcode or email and password, and collect user attributes including a username (alias), in an Android app by using native authentication.
Learn how to sign up users with email one-time passcode or email and password, and collect user attributes including a username (alias), in an iOS/macOS app by using native authentication.
Some organizations prefer to bootstrap this process through synchronization of authentication data that already exists in Active Directory Domain Services. This synchronized data is made available to Microsoft Entra ID and SSPR without requiring user interaction. When users need to change or reset their password, they can do so even if they haven't previously registered their contact information.
To sign in a user using username (email) and password, collect the email and password from the user. If the username and password are valid, the app signs in the user.
To sign in a user using the **Email with password** flow, capture the email and password. If the username and password are valid, the app signs in the user.
1. Create *sign-up/components/InitialForm.tsx* file, then paste the code from [sign-up/components/InitialForm.tsx](https://github.com/Azure-Samples/ms-identity-ciam-native-javascript-samples/blob/main/typescript/native-auth/react-nextjs-sample/src/app/sign-up/components/InitialForm.tsx). This component displays a form that collects user sign-up attributes.
Learn how to sign in to Microsoft Entra Connect Sync by using passwordless authentication methods such as FIDO2 security keys and passkeys.
Microsoft Entra External ID pricing is based on monthly active users (MAU), which is the count of unique users with authentication activity within a calendar month. External ID consists of a core offer and premium add-ons. The Microsoft Entra External ID core offering is free for the first 50,000 MAU. For the latest information about usage billing and pricing, see [Billing model for Microsoft Entra External ID](../external-identities-pricing.md).
Learn how to attach custom x-* headers to native authentication network requests in an Android (Kotlin) app to integrate fraud-detection SDKs with Microsoft Entra External ID.
This feature currently supports the following Windows Server distributions:
The following table lists features that are available for authentication in the various versions of Microsoft Entra ID. Plan out your needs for securing user sign-in, then determine which approach meets those requirements. For example, although Microsoft Entra ID Free provides security defaults with multifactor authentication, only Microsoft Authenticator can be used for the authentication prompt, including text and voice calls. This approach might be a limitation if you can't make sure that Authenticator is installed on a user's personal device.
Learn how to authenticate users, configure authorization, and implement the On-Behalf-Of flow for interactive agents to access resources on behalf of users.
Learn how to integrate third-party AI agents with Microsoft Entra Agent ID for secure authentication using sidecar and federation patterns.
Learn how audit and sign-in activities associated with agent identities are logged in Microsoft Entra ID.
Microsoft maintains code samples that demonstrate how to integrate various application types with Microsoft Entra External ID. We provide instructions for downloading and using samples or building your own app based on common authentication and authorization scenarios, development languages, and platforms. Included are instructions for building the project (if applicable) and running the sample application. Within the sample code, comments help you understand how these libraries are used in the application to perform authentication and authorization in an external tenant.
Run the Microsoft Entra SDK auth sidecar on your laptop with Docker Compose and Ollama to see autonomous and on-behalf-of agent authentication working end-to-end.
Understand how the username and password (ROPC) flow works in desktop apps, why it is deprecated, and how to migrate to more secure authentication flows.
Learn how to build a desktop app that calls web APIs to acquire a token for the app using integrated Windows authentication
Learn how to build a desktop app that calls web APIs to acquire a token for the app using username and password.
Learn how to acquire an access token for calling an API in your own Node.js web application.
This document describes how to integrate AD FS sign-ins with the Microsoft Entra Connect Health sign-ins report.
Learn to configure certificates, client secrets, and federated credentials in Microsoft Entra for secure app authentication.
Learn how to attach custom x-* headers to native authentication network requests in an iOS (Swift) app to integrate fraud-detection SDKs with Microsoft Entra External ID.
Learn how to attach custom x-* headers to native authentication requests in a React or Angular SPA to integrate fraud-detection SDKs with Microsoft Entra External ID.
Learn how to add multifactor authentication (MFA) with email and SMS one-time passcodes to an Android app using Microsoft Entra native authentication.
Learn how to add email one-time passcode (OTP) multifactor authentication (MFA) to an iOS or macOS app by using native authentication and enforce MFA with authentication context.
Learn how to register an email one-time passcode as a strong authentication method for MFA-enabled users in an Android app using Microsoft Entra native authentication.
Learn how to register an email strong authentication method for MFA-enabled users in an iOS or macOS app by using native authentication.
Learn how to enable federated identity provider sign-in and sign-up in an Android app using Microsoft Entra native authentication with web-based authentication flow.
Learn how to enable federated identity provider sign-in and sign-up in an iOS app using Microsoft Entra native authentication with web-based authentication flow.
Add password-based single sign-on to an application in Microsoft Entra ID.
Learn how to register phone SMS as a strong authentication method for MFA-enabled users in an iOS or macOS app using native authentication, including configuring client capabilities and handling registration challenges.
Learn how to add sign-in and sign-out with email one-time passcode or username and password in iOS/macOS app by using native authentication.
Learn how to add sign-in and sign-out with email one-time passcode or username and password in Android app by using native authentication.
Learn how to add sign-up using email one-time passcode or email and password, and collect user attributes in an Android mobile app using native authentication.
Learn how to add sign-up using email one-time passcode or email and password, and collect user attributes in an iOS/macOS mobile app using native authentication.
Learn how to add multifactor authentication (MFA) with SMS one-time passcodes to an Android app using Microsoft Entra native authentication.
Learn how to register an SMS one-time passcode as a strong authentication method for MFA-enabled users in an Android app using Microsoft Entra native authentication.
Learn how to authenticate autonomous agents with Microsoft Entra ID, grant application permissions, and optionally create and authenticate as an agent's user account.
Learn how to authenticate users, configure authorization, and implement the On-Behalf-Of flow for interactive agents to access resources on behalf of users.
Assign the Authentication Extensibility Password Administrator role to users who need to do the following tasks:
Learn how to find and address gaps in strong authentication coverage for your administrators in Microsoft Entra ID
Learn about how to enable QR code authentication method in Microsoft Entra ID to help improve and secure sign-in events for frontline workers.
Learn which apps are supported for users to sign in to Microsoft Entra ID using SMS
A Microsoft Entra documentation page was updated: Authentication Track Linkable Identifiers.
Learn how Microsoft Entra Auth SDK (sidecar) manages credentials and tokens for AI agents so that secrets never enter agent code.
Learn how to call web API in an Android (Kotlin) sample app.
Learn how to call a protected API in your Node.js web application using access tokens from Microsoft Entra External ID.
Learn how to acquire multiple access tokens and call an API in Android app by using native authentication.
Learn how to acquire multiple access tokens and call an API in iOS/macOS app by using native authentication.
Learn how to configure Microsoft Entra certificate-based authentication (CBA) in Microsoft Entra ID.
Learn how to simplify the user experience with combined Microsoft Entra multifactor authentication and self-service password reset registration.
Learn how to install identity packages and sign-in components to an ASP.NET Core application and enable user authentication.
Topic that shows how to configure certificate authorities for Microsoft Entra certificate-based authentication.
A Microsoft Entra documentation page was updated: Configure Citrix ADC (header-based authentication) for Single sign-on with Microsoft Entra ID.
Learn how to enable Microsoft Entra multifactor authentication and SSO for an Oracle E-Business Suite application via Datawiza.
Learn to configure F5 BIG-IP Access Policy Manager (APM) and Microsoft Entra SSO for header-based authentication.
Learn how to implement secure hybrid access (SHA) with single sign-on (SSO) to Kerberos applications by using F5 BIG-IP advanced configuration.
Enable Microsoft Entra multifactor authentication and SSO for Oracle JD Edwards application using Datawiza Access Proxy
Enable Microsoft Entra multifactor authentication and SSO for Oracle PeopleSoft application using Datawiza Access Proxy
Learn how to integrate third-party AI agents with Microsoft Entra Agent ID for secure authentication using sidecar and federation patterns.
Learn how to set up a custom authentication extension that validates Verified ID claims during Microsoft Entra account recovery using an Azure Function and REST API.
Learn how to develop and register a Microsoft Entra custom authentication extensions REST API. The custom authentication extension allows you to add logic to attribute collection.
Learn how to prepare your Node.js client web app to call a protected API using access tokens from Microsoft Entra External ID.
Learn how to use the Authentication events trigger for Azure Functions library to create a trigger function that uses the token issuance start event.
Create a self-signed public certificate to authenticate your application.
Describes how to use Azure PowerShell to create a Microsoft Entra application and service principal, and grant it access to resources through role-based access control. It shows how to authenticate application with a certificate.
Learn about customizing the language experience in your user flows in Microsoft Entra External ID.
Learn how to enable passkeys (FIDO2) in Microsoft Entra ID.
Learn how to manage external MFA methods for Microsoft Entra multifactor authentication
Learn how to use additional context in multifactor authentication (MFA) notifications.
A Microsoft Entra documentation page was updated: Customer intent: As an identity administrator, I want to plan for mandatory MFA for users who sign in to Azure portal..
Persona-specific guidance to deploy passwordless and phishing-resistant authentication for organizations that use Microsoft Entra ID.
Remote desktop connection guidance to deploy passwordless and phishing-resistant authentication for organizations that use Microsoft Entra ID.
Detailed guidance to deploy passwordless and phishing-resistant authentication for organizations that use Microsoft Entra ID.
Detailed guidance for planning the prerequisites to deploy passwordless and phishing-resistant authentication for organizations that use Microsoft Entra ID.
services: active-directory
A Microsoft Entra documentation page was updated: Customer intent: As an identity administrator, I want to understand how users can register a passkey in Microsoft Authenticator..
A Microsoft Entra documentation page was updated: Customer intent: As an identity administrator, I want to understand how users will register a passkey using a browser or with a security key. .
A Microsoft Entra documentation page was updated: Customer intent: As an identity administrator, I want to understand how users will sign in with a security key. .
A Microsoft Entra documentation page was updated: Customer intent: As an identity administrator, I want to understand... .
A script to postpone enforcement for a tenant where users are unable to sign in after rollout of mandatory MFA requirement for the Azure portal, Microsoft Entra admin center, or Microsoft Intune admin center
Learn about the Microsoft Entra recommendation to migrate to Microsoft Entra multifactor authentication from MFA server
A Microsoft Entra documentation page was updated: Customer intent: As an IT administrator, I want to learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Forcepoint Cloud Security Gateway - User Authentication so that I can streamline the user management process and ensure that users have the appropriate access to Forcepoint Cloud Security Gateway - User Authentication..
