Daily.Entra.NewsA cross-product view of Microsoft Entra changes related to Fundamentals.
The updated documentation says passkeys will be automatically enabled for users using SMS or voice on September 1, 2026. From February 1, 2027, tenants without a customer-managed telecom provider will no longer be able to use SMS or voice for MFA. The timeline applies to public cloud; Azure AD B2C and Entra External ID are excluded from this announcement.
Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.
This timeline applies to public cloud environments only. Other cloud environments will follow on a later schedule, and we will provide advance communications to help customers prepare for the transition.
Learn how to prepare for the retirement of Microsoft provided SMS and Voice authentication in Microsoft Entra ID and migrate users to passkeys.
Passkey support for B2B users and internal guest users is planned to be available by the end of calendar year 2026. These users are included in the scope of the retirement of Microsoft-provided SMS and voice authentication.
Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing configurations migrate to a Default passkey profile with a new passkeyType property. Automatic migration and registration campaign updates roll out regionally through October 2026.
Microsoft Entra will make passkeys the default authentication method starting September 1, 2026, retiring Microsoft-provided SMS and voice authentication by February 1, 2027. Customers must configure telecom providers for SMS/voice via the Microsoft Security Store or face disruptions. Passkeys offer stronger, phishing-resistant security at no extra cost.
Explicit Forward Proxy is a traffic acquisition mechanism that's useful in scenarios where installation of the Global Secure Access client is difficult or not possible. Explicit Forward Proxy helps protect internet traffic when users use browsers to access resources from:
Explicit Forward Proxy uses Microsoft Entra ID authentication and authorization to validate user access before allowing network traffic. This validation method allows for adaptive policies in Microsoft Entra Conditional Access, modern credentials like passkeys, and Continuous Access Evaluation with session revocation. Classic proxy authorization methods, such as basic, digest, NTLM, or Kerberos, aren't supported.
Learn how to prepare for the retirement of Microsoft provided SMS and Voice authentication in Microsoft Entra ID and migrate users to passkeys.
For unmanaged devices, you can instruct users to manually enter the PAC file location in browser settings or rely on a network-provided configuration. A network-provided configuration might be Dynamic Host Configuration Protocol (DHCP) or Web Proxy Auto-Discovery (WPAD).
Microsoft Entra now applies system-preferred authentication to first-factor sign-in for tenants in the Microsoft managed state, selecting the most secure registered method. Rollout starts late June 2026. Tenants can keep or change this setting and should update user guidance accordingly.
Learn about mandatory multifactor authentication (MFA) enforcement for Azure, Microsoft 365, and other admin portals, and how to prepare your tenant.
- [Office 365 app in Conditional Access](concept-conditional-access-cloud-apps.md#office-365)
- [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md)
To see risk sign-in events together with risky user events, select the **Aggregate risk signals by risky sign-ins** checkbox.
Learn how unified risk signals correlate identity risk across Microsoft Entra ID Protection and Microsoft Defender to calculate compounded user risk.
The What's new release notes in the Overview section of this content set contain six months of activity. After six months, the items are removed from the main article and put into this archive article.
A Microsoft Entra documentation page was updated: Certificate Based Authentication Certificate Revocation List.
Compare browser-delegated and native authentication in Microsoft Entra External ID and choose the right approach for your customer-facing app.
Learn how admins can create custom authentication strengths with advanced options for passkey (FIDO2) security keys and certificate-based authentication.
Learn about where Microsoft Entra ID stores identity-related data for its European customers.
Learn about where Microsoft Entra ID stores customer-related data for its Japan customers.
Learn about frontline worker management capabilities that are provided through the My Staff portal.
Learn how domain and forest trust relationships work in Active Directory and how they apply to Microsoft Entra Domain Services for cross-forest authentication.
Learn the core concepts of identity and access management (IAM), including authentication, authorization, and identity providers, to secure resources effectively.
Learn about bring your own device (BYOD) with the Global Secure Access clients for Microsoft Entra Private Access and Microsoft Entra Internet Access.
This article describes shows the licensing requirements for Microsoft Entra ID Governance features.
Get the latest Microsoft Entra release notes, including updates on authentication, governance, and AI-powered identity protection for modern enterprises.
Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.
Learn about using QR code authentication method in Microsoft Entra ID to help improve and secure sign-in events for frontline workers.
Enable Microsoft Entra ID security defaults to strengthen your organization's security posture with preconfigured MFA requirements and legacy authentication protection.
Starting September 7, 2026, Microsoft Entra ID SSPR will require users to have explicitly registered authentication methods for password reset verification, disallowing directory-sourced contact info unless registered. A registration campaign begins August 6, 2026, urging users to register methods to avoid reset failures.
- Cloud-created [security groups](../../../fundamentals/concept-learn-about-groups.md#group-types).
Microsoft Teams for the web will respect Microsoft Entra ID's "Keep Me Signed In" (KMSI) settings starting late June 2026. Sessions will persist only if users choose to stay signed in; otherwise, sessions clear on browser close, enhancing security on shared devices. No immediate action is required.
Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.md#create-a-basic-group-and-add-members).
- [Bulk operations service limitations](bulk-operations-service-limitations.md)
- To add users, see [Add or delete a new user](./how-to-create-delete-users.md).
Here are the least privileged roles you should use when performing tasks for [groups](../../fundamentals/how-to-manage-groups.md) in Microsoft Entra ID.
- [Manage Microsoft Entra groups and group membership](~/fundamentals/how-to-manage-groups.md)
Instructions about how to create and update Microsoft Entra groups, such as membership and settings.
- For more information, see [Learn about Microsoft 365 Groups](https://support.office.com/article/learn-about-office-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2).
Learn about how to administer a Microsoft Entra Domain Services managed domain and the behavior of user accounts and passwords
Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.
An owner can also add or remove other owners. Unlike those users assigned at least the [Groups Administrator](../identity/role-based-access-control/permissions-reference.md#groups-administrator) role, owners can manage only the groups that they own and they can add or remove group members only if the group's membership type is **Assigned**.
While browser-delegated authentication offers benefits such as reduced attack vectors and support for single sign-on (SSO), it offers limited UI customization options.
- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).
Instructions about how to add an existing Azure subscription to your Microsoft Entra tenant.
ID Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user is compromised. If a user has risky user sign-in behavior, or their credentials were leaked, ID Protection uses these signals to calculate the user risk level. Administrators can configure risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as:
Instructions about how to find Microsoft Entra ID and how to create a new tenant for your organization.
- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).
This series of exercises covers the fundamentals of Internet Access. The exercises assume that you follow them in order. If you skip around, you might miss a step. For example, in the baseline web-filtering tutorial, you create a security profile and assign it to a Microsoft Entra Conditional Access policy. Subsequent labs instruct you to assign the new policy to this existing security profile rather than creating a new security profile and Conditional Access policy each time.
Instructions about how to add your custom domain name to your tenant.
Learn about the new Microsoft Entra bulk operations experience for managing users, groups, and devices.
Introduction to the Microsoft Entra product family including links to get started.
Compare the default user permissions available in Microsoft Entra ID and learn how to restrict access.
Managing user license assignments individually is time consuming and error prone. If you [assign licenses to groups](~/fundamentals/licensing.md?context=azure/active-directory/users-groups-roles/context/ugr-context) instead, you experience easier large-scale license management.
- **[Entra ID](#entra-id)** — Manage users, groups, devices, applications, roles, and authentication methods.
Learn about Microsoft Entra group-based licensing, including how it works,
Learn the core concepts of identity and access management (IAM), including authentication, authorization, and identity providers, to secure resources effectively.
This article documents licensing requirements for Microsoft Entra features.
How to view restorable users, restore a deleted user, or permanently delete a user with Microsoft Entra ID.
Microsoft Entra External ID user flows are designed for flexibility. Within a sign-up and sign-in user flow, there are built-in authentication events. You can also add custom authentication extensions at specific points within the authentication flow. A custom authentication extension is essentially an event listener that, when activated, makes an HTTP call to a REST API endpoint where you define a workflow action. For example, you could add an [attribute collection](#attribute-collection-start-and-submit-events) workflow to validate the attributes a user enters during sign-up, or you could use a [custom claims provider](#token-issuance-start-event) to add external user data to the token before the token is issued.
Learn about how Microsoft Entra ID Protection identifies risky agents.
Understand the difference between required resource access declarations and inheritable permissions for agent identity blueprints in Microsoft Entra Agent ID.
Enforcing MFA enhances your organization's security by adding an extra layer of verification, making it more difficult for unauthorized users to gain access.
Discover the steps for setting up a customer identity and access management (CIAM) solution in an external tenant, including creating a tenant, registering apps, and setting up user flows for sign-in.
Learn about risk detections and risk levels, including the difference between real-time and offline detections.
Each layer addresses a different class of attacks, reducing the likelihood of compromise and limiting the blast radius.
Learn how Microsoft Entra provides identity-based security controls for AI agents, applications, and services through authentication, governance, and Zero Trust policy enforcement.
Learn how AI agent discovery in Global Secure Access provides network-level visibility into managed and shadow AI agents reaching the internet from your environment.
- [Microsoft Entra ID Auth SDK (sidecar) documentation](/entra/msidweb/agent-id-sdk/overview)
Traditional service principals were designed for static, deterministic workloads. Microsoft Entra Agent ID exists because service principals lack the governance infrastructure AI agents need. There's no enforced sponsorship, no agent-aware audit entries, and no blueprint-managed lifecycle. For more information, see [Agent identities, service principals, and applications](agent-service-principals.md).
To call an API from an agent, you need to obtain an access token that the agent can use to authenticate itself to the API. We recommend using the *Microsoft.Identity.Web* SDK for .NET to call your web APIs. This SDK simplifies the process of acquiring and validating tokens. For other languages, use the [Microsoft Entra ID Auth SDK (sidecar)](/entra/msidweb/agent-id-sdk/overview).
- [Call API: Azure services](../agent-id/call-api-azure-services.md) (New)
Account recovery in Microsoft Entra ID enables users to regain access through identity verification when all authentication methods are lost. Learn how it works.
Learn how to add new custom security attribute definitions or deactivate custom security attribute definitions in Microsoft Entra ID.
Gain visibility into application traffic to gain insights into app categories, risk scores, transactions, and organizational usage patterns.
Learn about using QR code authentication method in Microsoft Entra ID to help improve and secure sign-in events for frontline workers.
Learn how admins can create custom authentication strengths with advanced options for passkey (FIDO2) security keys and certificate-based authentication.
Learn how admins can use Microsoft Entra Conditional Access to distinguish which authentication methods users can use based on relevant security factors.
Learn about Microsoft Entra certificate-based authentication (CBA) without federation.
Learn about certificate user IDs for Microsoft Entra certificate-based authentication without federation
Learn about Microsoft Entra certificate-based authentication on Android devices
Learn how Microsoft Entra certificate-based authentication (CBA) works and the technical concepts you need to set up and manage CBA.
Compare browser-delegated and native authentication in Microsoft Entra External ID and choose the right approach for your customer-facing app.
Learn how to create and manage custom attributes in a Domain Services managed domain.
Use Microsoft Entra custom authentication extensions to customize your user's sign-in experience by using REST APIs or outbound webhooks.
Conceptual article describing the custom claims provider as part of the custom authentication extension framework.
Learn about where Microsoft Entra ID stores identity-related data for its European customers.
Learn about where Microsoft Entra ID stores customer-related data for its Japan customers.
This document explains password policies in a clear and easy-to-understand way.
Learn about Web browser cookies used in Microsoft Entra authentication.
Learn how to configure an external MFA method provider for Microsoft Entra multifactor authentication.
Learn about using passkey (FIDO2) authentication in Microsoft Entra ID to help improve and secure sign-in events
A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I need to know what options are available for integrating Microsoft Entra activity logs with storage and analysis tools so I can choose the best option for my organization..
A Microsoft Entra documentation page was updated: Customer intent: As an IT admin, I want to know how to use the Identity Secure Score and related recommendations to improve the security posture of my Microsoft Entra tenant..
Learn how services store and retrieve Microsoft Entra object data through an RBAC authorization layer.
