Daily.Entra.News
Aboutmerill.net
Week in brief

SSPR reset verification changes on 7 September; Excel 2021 has a 24 July authentication deadline

The week of 22 June 2026 was dominated by Microsoft Learn maintenance—353 updates, 17 new pages, and no removals—rather than evidence of a broad Entra feature launch. The material administrator-facing exceptions are concrete: Self-Service Password Reset (SSPR) will require explicitly registered authentication methods from 7 September; older Excel 2021 clients face a 24 July deadline to retain Power Query Organizational Account authentication; and Teams for the web is beginning to honor Microsoft Entra Keep Me Signed In settings. New tenant-recoverability guidance and Global Secure Access automation samples are meaningful security and operations additions, but the supplied records do not establish GA status or a service rollout for them. A separate Conditional Access notice flags improved enforcement for policies with resource exclusions but provides no timing or technical detail.

  • Changed behavior: SSPR will require explicitly registered methodsMicrosoft Entra ID — Self-Service Password Reset

    The 27 June Microsoft 365 Message Center major update says that, beginning 7 September 2026, SSPR password-reset verification will require authentication methods explicitly registered by users. Directory-sourced contact information will no longer suffice unless it is registered. A registration campaign begins 6 August. One other page updated during the week describes synchronized Active Directory Domain Services authentication data as an SSPR bootstrap path, but the supplied evidence does not explain how that path,

  • Client compatibility change: Excel 2021 Power Query authentication has a 24 July deadlineMicrosoft Entra ID authentication in Excel Power Query

    The 25 June notice says Excel Power Query is changing its Organizational Accounts authentication flow for Microsoft Entra ID. Excel 2021 version 21.08 or older must be updated to build 16.0.14334.20754 or later by 24 July 2026, or upgraded to a newer Excel version, to avoid authentication loss. Microsoft 365 and newer Excel versions are stated to be unaffected. This is a client update dependency, not a tenant-side Entra feature launch.

  • Changed behavior: Teams for the web will respect Entra KMSIMicrosoft Entra ID and Microsoft Teams for the web

    The 26 June notice says Teams for the web will respect Microsoft Entra ID Keep Me Signed In settings starting in late June 2026. A session persists only when the user chooses to stay signed in; otherwise, the session clears when the browser closes. Microsoft explicitly says no immediate action is required. The practical change is in session persistence, particularly on shared devices.

  • Upcoming Conditional Access enforcement change has insufficient detail for remediationMicrosoft Entra ID — Conditional Access

    The 23 June Message Center entry flags an upcoming change described as improved enforcement for Conditional Access policies with resource exclusions. The supplied record includes no effective date, affected resource types, or before-and-after enforcement semantics. It is a watch item, but this evidence does not support a specific policy edit or impact assessment.

  • Security and resilience documentation expands for recovery and Global Secure Access operationsMicrosoft Entra ID Backup and Recovery; Microsoft Entra Global Secure Access

    A new Plan for tenant recoverability page covers tenant-scoped recovery under the shared responsibility model. Related updates address deletion impact, supported objects and attributes, object recovery, and difference reports; the documentation says Backup Reader can review difference reports, while Backup Administrator can review and create them, and Global Administrator includes those permissions. The updated application-secret recovery page is explicitly labeled Preview. New Global Secure Access PowerShell pages

For Entra administrators

Use the SSPR registration campaign beginning 6 August to prepare users for the September verification change, and inventory Excel 2021 version 21.08-or-earlier installations for the specified build or upgrade path. The Excel notice says Microsoft 365 and newer Excel versions are unaffected. Teams requires no immediate action according to the notice, although browser-close session behavior will change on shared devices. For the recovery and Global Secure Access material, treat the pages as guidance and automation examples rather than proof of a new or generally available capability. The Conditional Access record is too terse to support a policy change or precise remediation; no effective date or before-and-after behavior is supplied.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Provisioning

233

Blogin Provisioning Tutorial

Updated

Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to BlogIn.

27 June 2026

Bpanda Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Bpanda.

27 June 2026

Clebex Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Clebex.

27 June 2026

Coda Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Coda.

27 June 2026

Code42 Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Code42.

27 June 2026

Eletive Provisioning Tutorial

Updated

Learn how to automatically provision and deprovision user accounts from Microsoft Entra ID to Eletive.

27 June 2026

Exium Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Exium.

27 June 2026

Freshservice Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Freshservice Provisioning.

27 June 2026

Golinks Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to GoLinks.

27 June 2026

Gong Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Gong.

27 June 2026

Grammarly Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Grammarly.

27 June 2026

H5mag Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to H5mag.

27 June 2026

Joyn Fsm Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Joyn FSM.

27 June 2026

Klaxoon Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Klaxoon.

27 June 2026

Kpn Grip Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to KPN Grip.

27 June 2026

Uipath Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to UiPath.

27 June 2026

Verizon Provisioning Tutorial

Updated

Learn how to automatically provision and de-provision user accounts from Microsoft Entra ID to Verizon Provisioning.

27 June 2026

Tshoot Connect Sso

Updated

1. Ensure Microsoft Entra Connect is installed. Download it from the [Microsoft Entra Admin Center](https://entra.microsoft.com/#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/%7E/GetStarted).

26 June 2026

Fundamentals

33

Security Defaults

Updated

Enable Microsoft Entra ID security defaults to strengthen your organization's security posture with preconfigured MFA requirements and legacy authentication protection.

27 June 2026

Microsoft Entra ID SSPR will require registered authentication methods starting September 7, 2026

New

Starting September 7, 2026, Microsoft Entra ID SSPR will require users to have explicitly registered authentication methods for password reset verification, disallowing directory-sourced contact info unless registered. A registration campaign begins August 6, 2026, urging users to register methods to avoid reset failures.

27 June 2026
Message CenterMC1325414 on mc.merill.net ↗Major updatePlan for change

Configure Security

Updated

A Microsoft Entra documentation page was updated: Configure Security.

27 June 2026

Archive for Microsoft Entra releases and announcements

Updated

The What's new release notes in the Overview section of this content set contain six months of activity. After six months, the items are removed from the main article and put into this archive article.

27 June 2026

Frontline Worker Management

Updated

Learn about frontline worker management capabilities that are provided through the My Staff portal.

27 June 2026

Migrate Group Writeback

Updated

- Cloud-created [security groups](../../../fundamentals/concept-learn-about-groups.md#group-types).

26 June 2026

Overview

Updated

> [!IMPORTANT]

26 June 2026

How to manage groups

New

Instructions about how to create and update Microsoft Entra groups, such as membership and settings.

24 June 2026

Learn About Groups

Updated

- For more information, see [Learn about Microsoft 365 Groups](https://support.office.com/article/learn-about-office-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2).

24 June 2026

Bulk Operations

Updated

- [Bulk operations service limitations](bulk-operations-service-limitations.md)

24 June 2026

Compare

Updated

|**Users**|||

24 June 2026

Create New Tenant

Updated

- To add users, see [Add or delete a new user](./how-to-create-delete-users.md).

24 June 2026

Delegate By Task

Updated

Here are the least privileged roles you should use when performing tasks for [groups](../../fundamentals/how-to-manage-groups.md) in Microsoft Entra ID.

24 June 2026

Groups Concept

Updated

- [Create a role-assignable group](groups-create-eligible.md)

24 June 2026

Groups Dynamic Membership

Updated

- [Manage Microsoft Entra groups and group membership](~/fundamentals/how-to-manage-groups.md)

24 June 2026

Users Default Permissions

Updated

An owner can also add or remove other owners. Unlike those users assigned at least the [Groups Administrator](../identity/role-based-access-control/permissions-reference.md#groups-administrator) role, owners can manage only the groups that they own and they can add or remove group members only if the group's membership type is **Assigned**.

24 June 2026

Native Authentication

Updated

While browser-delegated authentication offers benefits such as reduced attack vectors and support for single sign-on (SSO), it offers limited UI customization options.

23 June 2026

Whats New

Updated

**Service category:** Microsoft Authenticator App

23 June 2026

General

25

Connect Version History

Updated

This article lists all releases of Microsoft Entra Connect and Azure AD Sync.

27 June 2026

Ai Administrator

Updated

- Manage all aspects of Microsoft 365 Copilot

27 June 2026

Ai Reader

Updated

- Read all aspects of Microsoft 365 Copilot

27 June 2026

Ai Reader

Updated

This is a [privileged role](../privileged-roles-permissions.md). Assign the AI Reader role to users who need to do the following tasks:

26 June 2026

Connect Version History

Updated

This article lists all releases of Microsoft Entra Connect and Azure AD Sync.

24 June 2026

Zoom Tutorial

Updated

Zoom is available in the following [national cloud deployments](/graph/deployments).

24 June 2026

Zscaler Beta Tutorial

Updated

Zscaler Beta is available in the following [national cloud deployments](/graph/deployments).

24 June 2026

Connect Sync Staging Server

Updated

The export.csv file contains all changes that are about to be exported. Each row corresponds to a change for an object in the connector space and the object is identified by the DN attribute. The DN attribute is a unique identifier assigned to an object in the connector space. When you have many rows/changes in the export.csv to analyze, it may be difficult for you to figure out which objects the changes are for based on the DN attribute alone. To simplify the process of analyzing the changes, use the `csanalyzer.ps1` PowerShell script. The script retrieves common identifiers (for example, displayName, userPrincipalName) of the objects. To use the script:

23 June 2026

Secure Your Domain

Updated

* If needed, [create a Microsoft Entra tenant][create-azure-ad-tenant] or [associate an Azure subscription with your account][associate-azure-ad-tenant].

23 June 2026

Authentication

13

Tutorial Native Authentication Single Page App React Sdk Sign Up

Updated

1. Create *sign-up/components/InitialForm.tsx* file, then paste the code from [sign-up/components/InitialForm.tsx](https://github.com/Azure-Samples/ms-identity-ciam-native-javascript-samples/blob/main/typescript/native-auth/react-nextjs-sample/src/app/sign-up/components/InitialForm.tsx). This component displays a form that collects user sign-up attributes.

25 June 2026

Howto Sspr Authenticationdata

Updated

Some organizations prefer to bootstrap this process through synchronization of authentication data that already exists in Active Directory Domain Services. This synchronized data is made available to Microsoft Entra ID and SSPR without requiring user interaction. When users need to change or reset their password, they can do so even if they haven't previously registered their contact information.

25 June 2026

Standards

12

Required update for organizational authentication in Excel Power Query (Entra ID)

New

Excel Power Query is updating its authentication flow for Organizational Accounts (Microsoft Entra ID) to enhance security and reliability. Users on Excel 2021 version 21.08 or older must update to build 16.0.14334.20754 or later by July 24, 2026, or upgrade to a newer version to avoid authentication loss. Microsoft 365 and newer Excel versions are unaffected.

25 June 2026
Message CenterMC1403409 on mc.merill.net ↗Prevent or fix issue

Understand Microsoft's SSO model

New

Learn how Microsoft Entra ID implements single sign-on (SSO) as a centralized identity platform for both SAML and OpenID Connect protocols.

24 June 2026

Architecture

3

Monitoring

3

Ad Group Enforcement

Updated

.\Set-CloudSyncSOAPolicy.ps1 -EnforcementMode Audit -Credential (Get-Credential -Message "Enter Domain Admin credentials (format: DOMAIN\Username)")

27 June 2026

Create Review Difference Reports

Updated

You need at least the **Microsoft Entra Backup Reader** role to review difference reports. To review and create difference reports, you need the **Microsoft Entra Backup Administrator** role. The **Global Administrator** role also includes these permissions.

26 June 2026

Developer

2

Governance

2

Groups Lifecycle

Updated

For more information on Microsoft Entra groups, see:

24 June 2026

Branding

1

Get Started Premium

Updated

Now that you have Microsoft Entra ID P1 or P2, you can [customize your domain](add-custom-domain.md), add your [corporate branding](./how-to-customize-branding.md), [create a tenant](create-new-tenant.md), and [add groups](./how-to-manage-groups.md) and [users](./how-to-create-delete-users.md).

24 June 2026

Troubleshooting

1

Architecture

1

Id Protection Guide Introduction

Updated

- A test user who isn't an administrator to verify that policies work as expected before you deploy real users. To create a user, follow the steps in [How to create, invite, and delete users](../fundamentals/how-to-create-delete-users.md).

24 June 2026

Fundamentals

1

Source Ip Restoration

Updated

- It improves the accuracy of risk detection in [Microsoft Entra ID Protection risk detections](/entra/id-protection/concept-identity-protection-risks).

23 June 2026

Governance

6

Fundamentals

1

Fundamentals

2

Choose Authentication Approach

Updated

Compare browser-delegated and native authentication in Microsoft Entra External ID and choose the right approach for your customer-facing app.

27 June 2026

Add Member To Group

Updated

Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.md#create-a-basic-group-and-add-members).

24 June 2026

General

2

Tenant Configurations

Updated

Learn about tenant configurations in Microsoft Entra External ID, including the differences between workforce and external tenants.

27 June 2026

Architecture

1

Deployment External Operations

Updated

Learn about edge protection, domains, subscriptions, consumer app security, and fraud tactics in security operations for Microsoft Entra External ID.

28 June 2026

Authentication

1

Sign in with alias

Updated

Learn how to sign in and sign up with alias/username with External ID for customer identity and access management (CIAM). Get detailed steps to enable username as a sign-in identifier and create users with both email address and username.

27 June 2026

Standards

1

Direct Federation

Updated

Set up direct federation with SAML 2.0 or WS-Fed identity providers so users can sign in with work accounts. Understand attributes and claims for federation.

27 June 2026

General

6

Architecture

1

Gsa Deployment Guide Internet Access

Updated

At this point, you completed initiate and plan stages of your Secure Access Services Edge (SASE) deployment project. You understand what you need to implement for whom. You defined which users to enable in each wave. You have a schedule for each wave's deployment. You have met [licensing requirements](../global-secure-access/overview-what-is-global-secure-access.md#licensing-overview). You're ready to enable Microsoft Entra Internet Access.

24 June 2026

Fundamentals

1

Security

1

Security operations for network access

New

Security operations guide for Microsoft Entra Global Secure Access covering detection patterns and Sentinel analytics for Private Access, Internet Access, Remote Networks, and Microsoft Traffic.

25 June 2026

General

2

Zscalerprivateaccess Tutorial

Updated

Zscaler Private Access (ZPA) is available in the following [national cloud deployments](/graph/deployments).

24 June 2026

Architecture

1

Provisioning

1

General

1

Security

1

General

6

Universal Tenant Restrictions

Updated

- [Enable Global Secure Access signaling for Microsoft Entra ID and Microsoft Graph](how-to-source-ip-restoration.md#enable-global-secure-access-signaling-for-microsoft-entra-id-and-microsoft-graph)

23 June 2026

Fundamentals

3

Operations

Updated

| Guide | What it covers |

25 June 2026

Monitoring

2

PowerShell samples for Global Secure Access

Updated

Use these PowerShell samples to automate common Global Secure Access tasks, including connector registration, client install, traffic forwarding bypasses, break glass scenarios, TLS certificate creation, operations monitoring, and recovery.

26 June 2026

Architecture

1

Authentication

1

Governance

1

Security

1

Security Operations

Updated

- [Microsoft Entra Security Operations Guide](https://aka.ms/AzureADSecOps)

26 June 2026