Entra Updates & Release Notes

Type: Changed feature
Service category: Authentications (Logins)
Product capability: User Authentication

General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to attempt decryption with both primary and secondary Kerberos keys, improving resiliency during key rollover operations and reducing authentication disruption during rotation events. For more information, see: Rotate the Kerberos server key for Microsoft Entra Kerberos.

Type: New feature

Service category: BYOD

Product capability: Network Access

We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable users and partners to access corporate resources from their own devices. Administrators can assign the Private Application traffic profile to users with internal accounts, including internal guest users. This removes the previous requirement for Windows devices to be domain-joined. For more information, see: Bring Your Own Device.

Type: New feature

Service category: Microsoft Authenticator App

Product capability: Identity Security & Protection

Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or school accounts in Authenticator app. Users must move to compliant devices to continue using work or school accounts in Authenticator. This capability is secure by default and does not require any admin configuration or control.

Type: New feature

Service category: Conditional Access

Product capability: Identity Security & Protection

Broader Conditional Access controls for AI agents

Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can:

• Target agent's user accounts with greater precision by including or excluding individual agents or dynamically grouping agents using Custom Security Attributes.
• Protect against risky agent activity by applying Conditional Access policies based on Agent Risk.
• Require compliant devices for agents running on managed endpoints, including Windows 365 for Agents, ensuring agents can only operate from devices that meet your organization's compliance requirements.
• Apply device platforms, filter for devices and compliant network conditions to agents running on endpoints, enabling policies based on device state and trusted network locations.

These capabilities extend Zero Trust protections to agent's user accounts while leveraging the familiar Conditional Access policy experience. For more information see: Target agent identities in Conditional Access policies.

Type: New feature
Service category: B2B
Product capability: B2B/B2C

Domainless SAML federation

With a SAML Identity Provider, domainless SAML federation allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and preconfigured IdP domains during sign-in or invitation redemption. Learn more at Add a SAML/WS-Fed identity provider - Microsoft Entra External ID.

Type: New feature

Service category: Entra Backup and Recovery

Product capability: Entra Backup and Recovery

Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policy, so admins can quickly restore them to a previously known good state.

At preview, Entra Backup and Recovery automatically takes daily backup of a tenant's supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for 7 days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.

This gives your organization a reliable, built-in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises. For more information, see: Microsoft Entra Backup and Recovery overview (Preview).

Type: Plan for change
Service category: Microsoft Authenticator App
Product capability: Identity Security & Protection

No action is required.

What is changing?

Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required.

With this update:

• Users who already have iCloud and iCloud Keychain backup enabled for the Authenticator app—and have device-bound Authenticator passkeys on their old device—will automatically benefit from this improved experience.
• Users restoring their Authenticator app on a new iOS device will experience an updated restore flow.

This change streamlines the restore experience by directing users to the right recovery path based on access to their old device and helping them understand cross-device passkey authentication, resulting in a smoother transition to a new phone.

This update applies to iOS devices only. Android support will follow.

Learn more about the changes to backup and restore in Authenticator app.

Type: New feature
Service category: RBAC
Product capability: Identity Security & Protection

Starting June 8 we're introducing a new built-in role in Microsoft Entra—SOC Identity Responder—to further improve how security teams execute identity containment actions initiated from Microsoft Defender using a least-privilege access model.

Previously, performing these actions required SOC analysts to hold multiple high-privilege Entra roles or depend on identity administrators, creating delays during active investigations.

With this update, SOC analysts can be assigned a dedicated role purpose-built for identity response actions, allowing them to perform key actions—such as disabling users, revoking sessions, and forcing password resets—without being granted broad directory administrative privileges.

Access to this role supports flexible assignment models, including role-assignable groups for managing permissions through group membership and delegated ownership. Optional integration with Privileged Identity Management (PIM) enables just-in-time activation and enhanced governance controls.

These actions continue to be enforced and audited by Microsoft Entra, ensuring consistency with existing RBAC and compliance controls.

Type: New feature
Service category: Provisioning
Product capability: Entra Cloud Sync

For customers leveraging group provisioning to AD, this capability ensures that changes to AD groups remain consistent with those managed in Microsoft Entra. With this preview, you can designate specific AD groups so that modifications to those groups can only be made through the Entra provisioning service. Changes made outside of Entra are blocked, helping prevent drift before it occurs and maintaining alignment between Entra ID and AD groups.

Learn more: AD group enforcement documentation.

Type: New feature
Service category: Device Access Management
Product capability: Entra Backup and Recovery

Device Soft Delete

Now available in preview, Device Soft Delete enables administrators to safely remove device objects by moving them to a recoverable state instead of permanently deleting them. This feature allows organizations to restore devices within a defined retention period while preserving critical data such as device identity and associated security artifacts. The feature supports Microsoft Entra joined, registered, and hybrid joined devices and helps reduce risk from accidental deletions while improving device lifecycle management.

Type

Changed feature

Service category

Entra Connect

Product capability

Entra Connect

The “NetBIOS Name Sysvol Connectivity resolution” test in the AD DS health monitoring agent has been reclassified from an alerting test to an informational test. Going forward, if this test fails, it will no longer generate an alert or require remediation action on your part. Instead, the test runs in the background and logs results for your information only.

What Changed

The NetBIOS Name Sysvol Connectivity test is now informational-only. Previously, when this test failed (e.g. if a domain controller couldn’t resolve the NetBIOS name to access its SYSVOL share), an alert was triggered in Connect Health, prompting you for action. Now, failures in this test will not raise an alert in Microsoft Entra Connect Health.

Why We Made This Change

NetBIOS is a legacy networking protocol that is not critical in modern Active Directory environments. Many organizations no longer rely on NetBIOS name resolution in day-to-day operations. Reclassifying this test as informational reduces noise in your alert feed and allows you to focus on issues that are genuinely critical to your identity infrastructure. In short, we want to ensure that Connect Health alerts highlight meaningful issues and help you prioritize real problems, rather than flagging non-essential conditions.

Type: Changed feature
Service category: Entra Connect
Product capability: Entra Connect

We're enhancing the security posture of Microsoft Entra Connect Sync by introducing interactive admin authorization for configuration changes. With this update, an authorized administrator will need to sign in and explicitly approve changes to sync settings, ensuring that configuration updates are intentional and made by the right person.

What’s changing

• Interactive admin authorization for sync configuration changes: Going forward, changes to sync configuration settings – such as enabling or disabling features – will require interactive authentication from an authorized cloud administrator. Whether you're using the Entra Connect wizard or PowerShell, a verified admin sign-in will be required to complete the action. This strengthens the authorization model for all sync-related configuration changes.
• Greater consistency in admin-driven configuration: We are aligning sync behavior so that configuration decisions made by cloud administrators are consistently respected. The cloud will serve as the source of truth for sync feature state, giving administrators greater confidence that their intended configuration is maintained.
• Updated management paths: All management interfaces for Entra Connect will incorporate delegated admin authentication where needed. Specifically:
  • Entra Connect wizard flows: The installation and configuration wizard will use delegated admin tokens for sync configuration changes, providing a more secure authorization flow.
  • PowerShell cmdlets: PowerShell-based management of sync settings will now prompt for an interactive admin sign-in to complete configuration changes. Ensure you run these commands in a session where you can provide admin credentials.
  • Uninstall behavior: If you uninstall Entra Connect Sync and choose to make cloud-side changes such as converting the tenant to cloud-only synchronization, the uninstall process will require admin authentication before modifying settings in the cloud tenant.

What’s not changing

• Sync functionality and the end-user experience remain unchanged. Everything continues to work as expected when features are enabled or disabled.
• There is no change to how administrators choose to enable or disable sync features; only that these actions now require interactive authentication.

The Microsoft Entra Connect Sync .msi installation file for this change is exclusively available on Microsoft Entra admin center under Microsoft Entra Connect.

Check our version history page for more details on available versions.

Type: New feature
Service category: Provisioning
Product capability: Inbound to Entra ID

Microsoft Entra is introducing workload identity–based authentication for SAP SuccessFactors provisioning. This new capability allows the Microsoft Entra provisioning service to authenticate to SAP SuccessFactors using Entra workload identity and short‑lived tokens instead of static credentials (username and password).

This change helps customers transition to a more secure authentication model in preparation for SAP’s plan to deprecate basic authentication for SuccessFactors APIs by November 2026.

What’s changing

• Customers can switch existing provisioning configurations from basic authentication to workload identity–based authentication directly through updated connectivity settings in the provisioning experience, without needing to recreate or restart their configuration.
• This method removes the need to store long‑lived credentials and uses a standards-based authentication method between Entra and SAP SuccessFactors through SAP Cloud Identity Services. This capability applies to the following provisioning scenarios:
  • SAP SuccessFactors to Active Directory user provisioning
  • SAP SuccessFactors to Microsoft Entra ID user provisioning
  • SAP SuccessFactors writeback (Entra to SuccessFactors)

What this means for you

• If you are currently using basic authentication for any of the above SAP SuccessFactors provisioning integrations, you must upgrade to workload identity-based authentication before November 2026 to ensure uninterrupted operation of the integrations.
• No immediate action is required, but we recommend planning your migration early to avoid last-minute disruption. The new method improves security by:
  • Eliminating stored passwords
  • Using short-lived, verifiable tokens
  • Aligning with SAP’s supported authentication model

Recommended action

• Evaluate the new authentication option once available in your tenant
• Plan and test migration of existing provisioning jobs to workload identity-based authentication
• Update any internal documentation or operational processes that reference basic authentication

Additional information

For detailed configuration guidance and step-by-step instructions visit https://aka.ms/EntraSAPSFConnectivityGuide.