What’s new in Microsoft Entra: September 2026

Welcome to the September edition of “What’s New in Microsoft Entra.” This month, we’re highlighting new generally available and public preview capabilities that strengthen tenant governance, simplify identity lifecycle management, and help organizations secure access in the age of AI. We’re also sharing important change announcements to help you plan ahead.

What went into General Availability (GA) since August 2026?

• Microsoft Entra Tenant Governance - Administrators can discover and get control of shadow IT tenants across their organization, establish least-privilege governance relationships with existing and newly created tenants, and monitor for configuration drift against customer-defined baselines across Microsoft Entra, Intune, Exchange Online, Teams, Purview, and Defender. Tenant Governance empowers administrators to move from ad hoc, portal-by-portal, tenant-by-tenant administration to secure, governed tenant configuration at scale, reducing shadow tenant risk and strengthening the identity foundation for cloud and AI services.
• Improve access governance with User-centric Access Reviews (UAR) - UAR enables reviewers to evaluate a user’s access across multiple resources within a catalog in one unified view, streamlining the process of ensuring that users have right access at the right time. This supports Entra ID groups, connected and disconnected applications, providing customers with a unified review experience across Entra-integrated and external resources.
• Create workflows by cloning an existing workflow in Lifecycle Workflows - Lifecycle Workflows administrators can now create a workflow by cloning an existing workflow in the Microsoft Entra admin center. Start from the Clone action on the workflow list or the Clone an existing workflow card during workflow creation. The cloned workflow opens directly on Review and create page, allowing administrators to modify details, configuration, or tasks before creating it.
• Microsoft Entra Resource Accounts for Teams Devices - Delivers a secure, passwordless identity model for Microsoft Teams Rooms, Teams Panels, Common Area Phones, and other shared Teams devices. Resource Accounts replace legacy password-based authentication with hardware-protected, device-bound credentials that improve security, reliability, and operational efficiency.

New in Public Preview

• Synchronize sAMAccountName with Microsoft Entra Domain Services - Microsoft Entra Domain Services now supports enhanced synchronization of the Security Accounts Manager account name (sAMAccountName) from the onPremisesSamAccountName attribute in Microsoft Entra ID. This update allows applications that took a dependency on this attribute on premises to also have it available in Azure deployments backed by Entra DS. The new synchronization behavior is enabled by default for new managed domains and can also be enabled for existing managed domains, updating existing hybrid users during synchronization. Cloud-only users continue to use mailNickname-based generation when no onPremisesSamAccountName value is available. Available for Enterprise and Premium SKUs.
• Manage identity lifecycle from the cloud with Microsoft Entra Cloud Sync - Microsoft Entra Cloud Sync now enables organizations to provision users, groups, and group memberships from Microsoft Entra ID to on-premises Active Directory Domain Services (AD DS), helping cloud-first organizations manage identities from the cloud while maintaining access to AD-dependent applications. Administrators can provision cloud-native users, SOA-converted users, B2B guests, security groups, and memberships into AD, preserve key identity attributes for continuity, and use Microsoft Entra ID Governance to manage user lifecycle processes and access governance from a unified cloud-based experience.
• Microsoft Entra Global Secure Access MCP Firewall – The Model Context Protocol (MCP) Firewall helps organizations securely adopt AI by bringing centralized visibility, Zero Trust policy enforcement, and runtime protection to MCP traffic between AI agents and remote MCP servers. Security teams can discover shadow MCP servers and tools, allow or block approved servers and individual tools, resources, or prompts, and enforce protocol-version and transport requirements—all without modifying MCP clients, hosts, or servers.

Change announcements

• Enhancements to Security Administrator role - Microsoft Entra is expanding the built-in Security Administrator role to include key identity response actions for non-privileged users, including disabling and enabling user accounts, revoking active sessions, and forcing password resets. This update helps organizations streamline role assignments while maintaining least-privilege access and existing governance and auditing controls. Rollout will be completed by the end of September 2026.
• Replace MemberOf-Based Configurations by November 3, 2026 - The Public Preview of the MemberOf rule operator in Microsoft Entra ID is ending. Organizations using the MemberOf rule operator in dynamic groups, dynamic administrative units (AUs), or entitlement management auto-assignment policies must replace these configurations by November 3, 2026. During Public Preview, Microsoft has observed that MemberOf can affect dynamic membership processing across a tenant and is therefore not recommended for production use. Configurations using this rule operator will stop updating after November 3, 2026. Take action: Migrate before the MemberOf preview ends | Microsoft Learn
• Permission scope update for User.ReadBasic.All - The User.ReadBasic.All gives apps access to only a few basic user properties. It accidentally allows the app to read app role assignments and license details of users. This change is to remove access to these properties. Customers using User.ReadBasic.All to get access to this information should grant User.Read.All, if their apps need to read app role assignment as the least privileged permission and LicenseAssignment.Read.All as the least privileged permission to read license details. If apps need to read both app role assignments and license details, User.Read.All is sufficient. This update addresses a vulnerability and is not a breaking change. Customers using User.ReadBasic.All as intended should experience no disruption.

These updates reflect our continued commitment to helping every organization secure identities, govern access, and confidently adopt AI. I look forward to sharing more Microsoft Entra innovations with you next month.

Onwards,

Yina Arenas

CVP and Chief Product Officer of Identity and Network Access

Follow me on LinkedIn

Additional resources

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecation functionality, and upcoming changes. You can find releases specific for Sovereign Clouds on a dedicated release notes page.

Learn more about Microsoft Entra

Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.

• ⁠Microsoft Entra News and Insights | Microsoft Security Blog
• Microsoft Entra blog | Tech Community
• Microsoft Entra documentation | Microsoft Learn
• Microsoft Entra discussions | Microsoft Community