Learn about generally available and public preview identity and network access capabilities released in the past 30 days.
Over the last few months, I've spent a lot of time with customers and our teams on one of the biggest security shifts ahead of us: securing an enterprise where people and AI agents are both acting on behalf of the business.
It’s a challenge shaping Microsoft's approach to Secure AI. And while AI makes the challenge urgent, the underlying problem is broader. Organizations need to give more people, applications, workloads, and agents access to more resources, while maintaining control without adding more friction and complexity.
Identity and network access are at the center of the transition.
Customers are clear about what they need. Across my conversations with identity and network access leaders and practitioners, and through our ongoing customer research, four outcomes consistently rise to the top:
- Keep my organization trusted and resilient
- Give users and agents secure access without friction
- Reduce the cost and complexity of access management
- Adopt AI safely at enterprise scale
So, we're making a change to this blog.
Starting this month, we’re organizing “What’s New” around the outcomes you're trying to achieve, rather than around our product architecture. Our goal is to make the connection between what we're shipping, the challenges you’re having, and where we're headed much clearer. I welcome your feedback on this new approach in the comments.
What I'd pay attention to this month
We’re acting on your feedback with new capabilities that:
- Continue to make access more adaptive. Universal Continuous Access Evaluation in Global Secure Access can now use additional user-risk and device-revocation signals, including when a device is deleted, disabled, or becomes noncompliant.
- Take complexity out of everyday identity operations. From a guided path to Cloud Sync to Microsoft-managed certificates for TLS inspection, several of this month's updates are about making stronger security easier to deploy and operate.
Here's everything new in Microsoft Entra since September.
Outcome: Keep my organization trusted and resilient
Device signals added to Continuous Access Evaluation (CAE) in Global Secure Access
Give hybrid users fast, seamless, and secure access with Universal Continuous Access Evaluation (CAE) in Global Secure Access. Universal CAE adapts access based on a user’s location, optimizing the experience on the corporate network while maintaining strong security controls. It now supports user-risk and device-revocation signals, including when a device is deleted, disabled, or becomes noncompliant.
Public Preview
Outcome: Give users and agents secure access without friction
Improved device registration user experience for Windows
When users access resources through supported native applications protected by Microsoft Entra Conditional Access policies that require token protection, they may need to register their device before access is granted. The improved experience lets users complete registration directly during sign-in—without navigating a separate workflow.
General Availability
Streamline access request workflows for users in ServiceNow
Users can request access packages and view their request history directly in ServiceNow. Designated approvers can review and approve or deny requests without leaving ServiceNow. Access packages, policies, and approver assignments remain centrally managed in Microsoft Entra ID Entitlement Management, combining a streamlined user experience with consistent governance.
General Availability
Enable B2B guest access with Global Secure Access
Guest users can connect through Global Secure Access while signed in to their home organization’s Microsoft Entra ID account. The client detects partner tenants where the user is a guest and offers an option to switch to the customer tenant context. Private traffic is then routed through the customer’s Global Secure Access service for secure, streamlined access.
Public Preview
Outcome: Reduce the cost and complexity of access management
Simplify migration from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync
The guided migration tool gives eligible organizations a structured path from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync. It brings key activities into one workflow: assessing readiness, setting up the provisioning agent and Cloud Sync configuration, activating Cloud Sync through a controlled transition, and validating the environment after activation.
General Availability
Move SAP SuccessFactors Provisioning to Workload Identity-based authentication
Microsoft Entra now supports Workload Identity-based authentication for SAP SuccessFactors provisioning, replacing long-lived usernames and passwords with Entra-managed credentials and short-lived, standards-based access tokens. Customers can upgrade authentication in place on existing provisioning jobs, without recreating or restarting them. This helps organizations move to a more secure model ahead of SAP SuccessFactors’ planned deprecation of basic authentication for its APIs in November 2026. The option supports inbound provisioning to Active Directory and Microsoft Entra ID, as well as writeback scenarios, while reducing manual credential handling and rotation.
General availability
Clear null or empty attribute values within Microsoft Entra provisioning
Microsoft Entra provisioning can now clear an existing target attribute when the corresponding source attribute is null or empty. Also known as null-value provisioning, this capability keeps target systems synchronized when values are removed from the system of record. It is available for API-driven inbound provisioning, Workday inbound user provisioning, and SAP SuccessFactors inbound user provisioning to Microsoft Entra ID and on-premises Active Directory.
Public Preview
Generate unique aliases with custom call-outs
Use custom call-outs with Azure Logic Apps during user provisioning to perform advanced attribute transformations for your organization. For example, custom call-outs can generate unique employee aliases. They are supported for create events in HR inbound, SaaS outbound, and cross-tenant synchronization provisioning flows in Microsoft Entra.
General availability
Discover and govern application groups and memberships
Microsoft Entra ID Governance can now discover groups and group memberships in connected applications. Administrators can identify local or orphaned groups without a matching Microsoft Entra object, as well as groups and users without a corresponding application assignment in Microsoft Entra ID. This helps organizations reconcile access, investigate potentially unauthorized access, and identify groups that should be governed through Microsoft Entra ID Governance.
Public Preview
Gain efficiency with Microsoft-managed certificates for TLS inspection in Global Secure Access
Previously, TLS inspection required customers to provision and manage their own certificates and trust chains. With Microsoft-managed certificates, Microsoft provisions the inspection certificate, removing the need for customers to operate their own certificate authority or public key infrastructure to use TLS inspection.
Public Preview
Outcome: Adopt AI safely at enterprise scale
AI is changing the security problem.
For decades, much of identity and access has been built around understanding who is requesting access, what they should be allowed to do, and under what conditions. Now we need to answer those same questions for AI agents that can reason, act, use tools, access data, and operate on behalf of people and organizations.
That's why Secure AI is an area I'm personally spending a lot of time on across Microsoft.
I believe the answer has to start with visibility and control. Organizations need to know what agents exist, understand what they can access and do, contain them within appropriate boundaries, and continuously adapt those protections as the agent, its context, and its risk change.
Identity and network access are foundational to that system, but they're not sufficient on their own. Securing AI will require us to connect identity, access, network, endpoint, data, application, and runtime signals with the ability to act when risk changes.
At Microsoft Ignite, November 17–20, we'll share much more about how we're approaching this across Microsoft, including the role Microsoft Entra and Agent 365 will play.
This is one of the areas I'm most excited about, and one you'll hear much more about from me.
Onwards,
Yina Arenas
CVP and Chief Product Officer of Identity and Network Access
Learn more about Microsoft Entra
Secure access for people and agents to AI, applications, and resources with comprehensive identity and network access solutions.
Microsoft
