Week of 23 February 2026 — Entra.News Daily

Week in brief

External ID clarifies Graph-based alias validation and SMS limits; Global Secure Access documents filtering and Prompt Shield previews

The week of 23 February 2026 was overwhelmingly a Microsoft Learn maintenance cycle: all 1,551 supplied records are marked Updated, with no New, Removed, or Message Center items; 1,531 are Entra ID updates. The strongest administrator-relevant exceptions are specific guidance for External ID authentication, Global Secure Access and Internet Access filtering, Prompt Shield, and Lifecycle Workflows. The feed does not establish a new general-availability release, retirement, or tenant-wide behavior change. Its representative Entra ID material is largely refreshed partner SSO/provisioning tutorials and fundamentals guidance.

External IDDocumentation clarification — External ID custom username validation uses Microsoft Graph
The Sign In Alias guidance says a custom regular expression can be set through `validationRegEx` on the `authenticationAttributeCollectionInputConfiguration` Microsoft Graph resource, with an example for updating a self-service sign-up user-flow page layout. It explicitly says the setting is not currently exposed in the admin center. This is a configuration clarification, not evidence of a new feature or availability change. Teams needing custom validation should use the documented Graph-based path rather than look
External IDSupport and licensing clarification — External ID SMS is not a first-factor option
The Multifactor Authentication Customers update states that SMS in external tenants is available at an additional cost for second-factor verification and self-service password reset, but is not supported for first-factor authentication. This clarifies a support and cost boundary rather than reporting a pricing change. Customer authentication and SSPR designs should be assessed separately, and SMS should not be planned as primary sign-in.
Global Secure Access and Internet AccessCapability guidance — Global Secure Access and Internet Access web filtering includes a preview URL option
The updated Web Content Filtering material describes Microsoft Entra Internet Access's first Secure Web Gateway features as domain-name-based filtering integrated with Microsoft Entra ID and Conditional Access, producing user-aware and context-aware policies. The configuration text allows a web category, fully qualified domain name, or valid URL; the URL option is explicitly marked Preview. This is not a general-availability announcement.
Global Secure AccessSecurity preview — Global Secure Access Prompt Shield targets prompt injection
The Prompt Shield page, explicitly labeled preview, says Microsoft's AI Gateway Prompt Shield is intended to protect enterprise generative AI applications from prompt-injection attacks. The supplied evidence gives no general-availability timing, deployment scope, or prerequisites, so this supports evaluation by AI and security teams rather than a production rollout decision.
ID GovernanceGovernance clarification — Lifecycle Workflows can be scoped and triggered from custom attributes
Delegated workflow management guidance says Lifecycle Workflows or Global administrators manage workflows by default, while Administrative Units can scope specific administrators to specific workflows. A related page describes custom attribute triggers for users whose organizational movement is represented by attributes outside the default trigger set. These are documented governance controls, not a dated launch signal. Teams using Lifecycle Workflows can review Administrative Unit boundaries, delegated access, and

For Entra administrators

Most administrators need no broad rollout action from this feed alone. Review the affected paths if you use External ID customer sign-in or SSPR, Global Secure Access or Internet Access filtering, AI Gateway security capabilities, or Lifecycle Workflows. The numerous updated partner provisioning and SSO pages should be rechecked for integrations you operate, but their status and summaries do not demonstrate new connectors or changed provisioning behavior. Preserve the documented preview, additional-cost, and admin-center-versus-Graph distinctions in implementation plans.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Updated

Updated

24 February 2026

Fundamentals

System-preferred multifactor authentication (MFA)

Updated

Learn how to use system-preferred multifactor authentication

28 February 2026

Configure Security

Updated

| [Quick Access has user or group assignments](zero-trust-protect-networks.md#quick-access-has-user-or-group-assignments) | Microsoft Entra Suite Add-on for Microsoft Entra ID P2 |

26 February 2026

Whats New

Updated

> Get notified about when to revisit this page for updates by copying and pasting this URL: `https://learn.microsoft.com/api/search/rss?search=%22Release+notes+-+Azure+Active+Directory%22&locale=en-us` into your ![RSS feed reader icon](./media/whats-new/feed-icon-16x16.png) feed reader.

25 February 2026

What Is App Proxy

General

Agent Id

Updated

1. Under **Target resources**, select the following options:

27 February 2026

Microsoft Entra ID Governance

3 updates

Governance

Microsoft Entra Id Governance Licensing For Guest Users

Updated

Learn how Microsoft Entra ID is licensed for guest users.

26 February 2026

Delegated workflow management

Updated

Workflows by default, unless specified during creation, are managed by users with either the Lifecycle Workflows, or Global, administrator roles. As workflows grow and change to meet the needs of members of your organization, so does the need to limit who can manage them. With delegated workflow management, you can scope management of workflows using [Administrative Units](../identity/role-based-access-control/administrative-units.md). When scoped, specific admins are only granted access to manage specific workflows. Scoping allows for greater security within your environment by following Microsoft's least privileged access guidelines by only giving access to specifically what's needed.

25 February 2026

Use Custom attribute triggers in lifecycle workflows

Updated

Lifecycle Workflows allows you to trigger workflows to run automatically for users that meet the execution conditions of the workflow. There are many default attributes that you can use to trigger workflows, but sometimes you might require triggering a workflow based on a specific attribute not offered by default. Using custom attribute triggers, you can trigger a workflow to run for users based on when they move within your organization based on:

25 February 2026

Microsoft Entra External ID

6 updates

Authentication

Email OTP

Updated

Self-service password reset (SSPR) in Microsoft Entra External ID gives customers the ability to change or reset their password, with no administrator or help desk involvement. If a customer's account is locked or they forget their password, they can follow prompts to unblock themselves and get back to work.

28 February 2026

Sign In Alias

Updated

You can set a custom regular expression for input validation by configuring the `validationRegEx` for the username attribute. This setting isn't currently available in the admin center UI, but you can configure it using Microsoft Graph. To set this value, use the [authenticationAttributeCollectionInputConfiguration](/graph/api/resources/authenticationattributecollectioninputconfiguration) resource type. For reference, see the example on [updating the page layout of a self-service sign up user flow](/graph/api/authenticationeventsflow-update#example-2-update-the-page-layout-of-a-self-service-sign-up-user-flow).

25 February 2026

Fundamentals

Multifactor Authentication Customers

Updated

SMS is available at an additional cost for second-factor verification and for self-service password reset in external tenants. It isn't currently supported for first-factor authentication.

28 February 2026

2 updates

Conditional Access

Configure Web Content Filtering

Updated

Microsoft Entra Internet Access's first Secure Web Gateway (SWG) features include web content filtering based on domain names. Microsoft integrates granular filtering policies with Microsoft Entra ID and Microsoft Entra Conditional Access, which results in filtering policies that are user-aware, context-aware, and easy to manage.

27 February 2026

General

Current Known Limitations

Updated

Known limitations for Internet Access include:

27 February 2026

Microsoft Entra Global Secure Access

> [!NOTE]

24 February 2026

Troubleshooting

Troubleshoot the Windows Global Secure Access client: Health check

Updated

Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.

25 February 2026