rss.livelink.threads-in-node

Verifying domain name issue

I-Leadership — Tue, 28 Jul 2026 11:34:53 GMT

We're trying to verify our custom domain in Entra ID, but it turns out the domain is already claimed on another tenant that we have no access to (unknown account, no admin credentials). Because of that, verification on our own tenant fails.

Normally the fix for a claimed-domain conflict is to open a support request so Microsoft can help release it. The problem: doing that requires a support plan, and purchasing one doesn't work for us. "payment" always succeeds and we dont get an error, but we don't get charged and the account status doesn't change, we have nothing more to go on.

So we're stuck in a loop: we need support to release the domain, but we can't buy the support plan needed to reach support.

Has anyone dealt with a domain claimed on an inaccessible tenant? And is there another route to Microsoft support when the support plan purchase itself fails?

What's New in Microsoft Entra: July 2026

Martin_Coetzer — Fri, 24 Jul 2026 17:47:47 GMT

Welcome to the July edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft Entra.

What went into General Availability (GA) since June 2026?

Microsoft Entra Backup and Recovery - A capability that helps organizations restore a tenant after accidental or malicious changes. On by default, it automatically backs up critical directory objects, including users, groups, applications, Service Principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policies, so admins can return to a known good state. The service takes daily backups of supported objects and retains them for 7 days with Microsoft Entra ID P1 or P2 licenses. Admins can view snapshots, compare changes, and run recovery jobs. This feature is a reliable safety net to minimize downtime and strengthen protection against misconfigurations and security incidents.

Direct admin assignment to external users using email address - Entitlement management admins can assign external users, not in the directory, to an access package with the user's email. Users are invited into the tenant as Guest users and are governed when Microsoft Entra ID Governance is configured.

Bring your own device (BYOD) support for the Global Secure Access Windows client using Microsoft Entra‑registered devices - Enable users and partners to access corporate resources from their own devices. Administrators can assign the Private Application traffic profile to users with internal accounts, including internal guest users. This removes the previous requirement for Windows devices to be domain‑joined.

Microsoft Entra Kerberos key rotation - Improves reliability for environments by using incoming trust referral flows. The update enhances authentication resiliency during key rollover by validating referral tickets with primary and secondary Kerberos keys. This combination reduces the likelihood of authentication failures and minimizes disruption during rotation events.

Domainless SAML federation with a SAML identity provider - Enable external users to sign in to applications or workforce resources using their Identity Provider (IdP)-managed credentials, regardless of their email domain. With no need to match user email domains with preconfigured identity provider domains, this capability simplifies onboarding and access for external users, streamlines invitation redemption, and improves flexibility for cross-organization collaboration in Microsoft Entra.

New in Public Preview

Strengthen AI agent security with Conditional Access - Microsoft Entra Conditional Access has broader controls to secure AI agents that leverage user accounts. Administrators can target agent user accounts more precisely by including, or excluding, agents, or by using custom security attributes for dynamic grouping. Organizations can apply Conditional Access policies, based on agent risk, require compliant devices for agents running on managed endpoints, including Windows 365 for Agents, and enforce device, network, and platform-based access conditions. These enhancements extend Zero Trust protections to agent user accounts while using the familiar Conditional Access policy experience.

Restrict AD group changes to Microsoft Entra provisioning - Designate specific Active Directory (AD) groups so all modifications are managed through the Microsoft Entra provisioning service. This capability helps maintain consistency between Microsoft Entra ID and AD by ensuring group changes are centrally controlled. Reduce configuration drift and improve alignment across identity systems.

Generate unique aliases with custom call-outs - Use custom call-outs with Azure Logic Apps during user provisioning to perform advanced attribute transformations that meet your organization's requirements. Custom call-outs can generate values such as unique employee aliases and are supported for create events in HR inbound, SaaS outbound, and cross-tenant synchronization provisioning flows in Microsoft Entra.

Announcements

Jailbreak/root detection in Microsoft Authenticator - This feature strengthens security by preventing Microsoft Entra credentials from being added or used on jailbroken or rooted devices. Users move to compliant devices to continue using work or school accounts in Authenticator. It is secure by default, requires no admin configuration, and applies to iOS and Android. Personal and third-party accounts are not affected.

Starting August 2026, Microsoft Authenticator on iOS will offer an improved backup and restore experience - Users can back up account names securely by using iCloud and iCloud Keychain with end-to-end encryption. This experience includes work or school accounts, Microsoft personal accounts, and non-Microsoft accounts like Amazon or Google, also third-party time-based one-time password (TOTP). No other credentials are included in the backup. This update removes the need for a Microsoft personal account and simplifies device setup by automatically restoring account names on new iOS devices. Users manage the feature through iCloud settings

New guidance and information

SCIM APIs available in U.S. Government Cloud - Microsoft Entra SCIM 2.0 APIs, which went into GA, in the public cloud, earlier in 2026, are available in Microsoft U.S. Government Cloud. Organizations can use standards-based SCIM operations to provision and manage users and groups in Microsoft Entra ID from external SCIM-compatible identity sources. Enable scalable identity lifecycle management, while you reduce the need for custom integrations.

Tell us what you think!

If you have feedback on this newsletter, fill out the dedicated Microsoft Form.

Blogs

Check out the latest blog posts on our Microsoft Entra Blog and our Microsoft Entra Identity Developer Blog.

What's new in Microsoft Entra?

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecation functionality, and upcoming changes. You can find releases specific for Sovereign Clouds on a dedicated release notes page.

Become a certified Microsoft Identity and Access Administrator

Check out the certification and related training for the Microsoft Identity and Access Administrator available for customers and partners.

-Martin Coetzer

Principal Product Manager, Identity and Network Access, Customer Experience Engineering (CXE)

Microsoft Entra Community | LinkedIn

Learn more about Microsoft Entra

Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.

Modernize SAP Identity Management with Microsoft Entra

Mark_Wahl — Fri, 24 Jul 2026 17:54:07 GMT

Many organizations are rethinking how they manage identity across their SAP landscape as they move away from on-premises identity management systems and adopt a more unified cloud strategy. That shift often starts with a practical question: how do you connect SAP identity processes with the rest of your application estate without introducing more complexity?

That is where the ongoing work between Microsoft Entra and SAP can help. Over the past several years, we have continued to expand integration points that help organizations automate lifecycle changes, apply access policies more consistently, and strengthen governance across SAP and non-SAP applications.

If you are transitioning from SAP Identity Management (SAP IDM), modernizing an existing SAP identity architecture, or looking for better access governance across business-critical systems, the latest integrations in Microsoft Entra can help.

In this post, I’ll highlight what’s new, recap the key integration points, and explain how these capabilities can support your identity modernization journey.

What’s new in Microsoft Entra and SAP integrations

Over the past two years, Microsoft Entra and SAP have continued to deepen interoperability and support more deployment models. Key updates include:

More flexible provisioning patterns between Microsoft Entra and SAP Cloud Identity Services
Support for custom extension attributes on Microsoft Entra users for SAP-specific scenarios
Account discovery to identify accounts in SAP Cloud Identity Services that are not yet correlated with users in Microsoft Entra
OAuth 2.0 client credentials support to secure service-to-service communication between Microsoft Entra and SAP Cloud Identity Services
Integration between Microsoft Entra ID Governance and SAP Identity Access Governance (SAP Identity Access Governance), so organizations can request and govern SAP business roles alongside other access rights

Together, these capabilities help organizations create a more unified identity control plane across SAP and the rest of the enterprise.

“This partnership brings together the best of both worlds: Microsoft Entra’s identity-first foundation and SAP Access Governance’s (SAP Identity Access Governance and SAP Access Control) deep business and access risk context, enriched with AI to transform access governance into a continuous, intelligent trust model.”

Swetta Singh, Strategic Product Manager for Access Governance solutions, SAP

A centralized identity control plane for SAP and beyond

Microsoft Entra provides a centralized identity layer that integrates with SAP applications and platforms. With it, organizations can automate joiner, mover, and leaver processes, apply access policies more consistently, and strengthen governance across a broader set of systems.

That kind of consistency matters in complex environments. For example, Cenibra used Microsoft Entra ID Governance to modernize identity management across more than 80 systems, including SAP as a core platform. That approach helped reduce manual work, improve audit readiness, and create a more scalable foundation for managing access.

SAP Cloud Identity Services: More flexible provisioning

SAP Cloud Identity Services centralizes authentication and provisioning across SAP applications. It provides single sign-on and helps organizations provision users and groups more consistently to downstream SAP systems.

The latest integration improvements with Microsoft Entra give organizations more flexibility in synchronizing users and groups across both environments through standards-based approaches. This flexibility helps teams maintain consistent identity data between Microsoft Entra and SAP environments while using SAP Cloud Identity Services to distribute identities to downstream cloud-hosted and on-premises SAP applications.

Some of the recent updates include:

Custom extension attributes for SAP-specific scenarios

Many SAP environments depend on attributes tied to business processes, regions, or organizational structures. Microsoft Entra now supports provisioning custom extension attributes on users in those scenarios, making it easier to align identity data with the needs of SAP applications.

Account discovery for SAP Cloud Identity Services

Microsoft Entra account discovery retrieves accounts from SAP Cloud Identity Services so you can identify accounts that are not yet correlated with users in Microsoft Entra. This visibility can help teams reduce manual investigation and strengthen governance.

OAuth 2.0 client credentials for connector authentication

We have also updated connector authentication to use OAuth 2.0 client credentials. This change helps secure service-to-service communication between Microsoft Entra and SAP Cloud Identity Services and supports a more modern integration approach.

SAP Identity Access Governance integration

SAP Identity Access Governance is SAP’s cloud-based access governance solution. The integration between Microsoft Entra ID Governance and SAP Identity Access Governance connects SAP role governance to a broader access strategy, allowing users to request or receive SAP business roles through Microsoft Entra access packages alongside non-SAP access rights.

This integration matters because access governance often spans applications: employees, contractors, and partners may need coordinated access across SAP and non-SAP resources. Organizations can use the integration to manage those requests consistently across applications.

When a user requests assignment to an access package with an SAP business role through Microsoft Entra, the request is sent automatically to SAP Identity Access Governance. SAP Identity Access Governance then enforces approvals and additional checks within its own governance process. This approach helps organizations connect enterprise-wide access packages in Microsoft Entra with the business role and risk context available in SAP Identity Access Governance.

Microsoft Entra integrates with SAP Cloud Identity Services and SAP Identity Access Governance to support authentication, user provisioning, and identity governance across SAP applications.

Migration projects move faster with the right partner support

A successful transition from legacy IAM products such as SAP IDM often depends on practical experience across both SAP environments and enterprise identity platforms. Many organizations work with partners who can support SAP system integration, Microsoft Entra identity and governance capabilities, and identity strategies that connect SAP with the rest of the application estate.

If you are planning a migration and want to involve a partner, review the partner list in Migrate identity management scenarios from SAP IDM to Microsoft Entra.

Beyond identity: Microsoft Security for SAP

Identity establishes the foundation for securing SAP in your security environment. In addition to Microsoft Entra, Microsoft delivers SAP-aware capabilities aligned with the NIST Cybersecurity Framework:

Identify: Microsoft Purview discovers and classifies sensitive SAP data—including data mirrored into Microsoft Fabric through SAP Datasphere—helping organizations apply more consistent data security policies.
Protect: Microsoft Defender safeguards the endpoints, servers, and cloud resources surrounding SAP applications with continuous, adaptive controls.
Detect: Microsoft Sentinel connects SAP signals across your estate to detect incidents, with built-in analytics rules in an SAP-certified solution that cover known threats. Through strategic partnership with SAP, organizations can also incorporate security telemetry from SAP Enterprise Threat Detection (ETD) and SAP LogServ, providing broader visibility into SAP-specific threats and activities alongside the rest of the enterprise security estate.
Respond: Microsoft Security Copilot accelerates investigation and guides response, helping teams contain SAP incidents faster.

Together with the identity investments described above, these capabilities advance an identity-first Zero Trust strategy across the SAP environment. Microsoft uses these same capabilities across its global SAP estate.

Get started

If you are evaluating your SAP identity strategy, now is a good time to review how your current architecture maps to the latest integration options in Microsoft Entra.

Start with these resources:

As always, I would love to hear about your SAP identity modernization journey and the topics you would like us to cover next.

Thanks for reading,

Mark Wahl
Product Architect, Microsoft Entra
Mark Wahl | LinkedIn

Additional resources

Learn more about Microsoft Entra

Best practices: Open OneDrive/SharePoint sharing but restrict Teams guest access by domain

Bejhan — Fri, 24 Jul 2026 05:49:11 GMT

Hi all,

Since SharePoint Online and OneDrive moved fully to Microsoft Entra B2B for external sharing, we've run into a policy conflict and would like to hear how others are handling it.

Our requirements

Enable OneDrive and SharePoint file sharing with external users, regardless of their email domain.
Restrict Microsoft Teams guest access to a predefined list of approved partner domains.
Continue allowing Teams external access (federated chat and meetings) for all domains.

The problem:

Teams guests, SharePoint guests, and OneDrive guests are now governed by the same Microsoft Entra B2B invitation framework and the single Collaboration restrictions allow/deny list under:
External Identities → External collaboration settings
As a result, restricting guest invitations by domain also restricts OneDrive and SharePoint sharing for domains not on the allowlist.
According to Microsoft's response in the following Q&A, this behavior is currently by design: OneDrive external sharing no longer working with "Allow invitations only to the specified domains" - Microsoft Q&A

Questions to the community

Has anyone implemented a solution where OneDrive/SharePoint sharing remains open to all domains while Teams guest access is restricted to approved domains only?
Are there recommended approaches using Entitlement Management, Access Packages, Connected Organizations, or other Entra capabilities?
Is there any roadmap item for workload-specific collaboration restrictions (e.g., separate policies for Teams guest invitations and SharePoint/OneDrive sharing)?

Any real-world experience or best practices would be greatly appreciated.

Thanks,

Bejhan

Microsoft Entra ID enhances security of branded sign-ins

Adam Steenwyk — Tue, 21 Jul 2026 17:58:43 GMT

To align with Microsoft’s Secure Future Initiative and its focus on identity security and phishing resistance, we’re evolving Microsoft Entra custom branding to help customers deliver sign-in experiences that are more secure, reliable, and consistent.

Beginning October 26, 2026, Microsoft Entra will retire support for custom CSS positioning properties used in custom branding. Full retirement of all custom CSS is planned for later in 2027. Microsoft will provide advance notice ahead of this milestone, along with alternative customization options.

These changes add an additional layer of security by reducing opportunities for deceptive page layouts and helping ensure trusted, recognizable sign-in experiences that better protect users from phishing attacks.

When will this happen?

July 21, 2026: Microsoft Entra ID tenants not using custom CSS positioning properties before July 21, 2026, will not be able to configure them going forward.
October 26, 2026: Microsoft Entra ID will retire custom CSS positioning properties globally.
Later in 2027: Microsoft Entra plans to move towards full custom CSS retirement, with advance notice provided.

Who will be affected?

To retire support for positioning properties, Microsoft is helping prevent tenants from creating new dependencies on custom CSS:

Tenants that will be affected and need to take action by October 26, 2026:
- Microsoft Entra ID tenants that already use custom CSS positioning properties. After this date, these properties will be blocked and will no longer function.
Tenants that are not affected:
- Microsoft Entra ID tenants that do not already use custom CSS positioning properties will not be able to configure them after July 21, 2026.
- New Microsoft Entra ID tenants created after January 5, 2026, do not have custom CSS available for custom branding.
- Microsoft Entra External ID tenants.

How will this affect your organization?

Microsoft Entra ID customers using the deprecated positioning properties may see changes to the layout of their branded sign-in experience after October 26, 2026, and won’t have a supported migration or replacement. In most cases, branding elements such as logos, images, or text will remain visible but will appear in their default state once the positioning properties are no longer honored.

If your Microsoft Entra ID tenant uses any of these custom CSS positioning properties below in either Company Branding or Branding Themes , we recommend removing them from your configuration:

position (including top, right, bottom, left, and z-index)
margin (including margin-top, margin-bottom, margin-left, and margin-right)
transform
opacity
overflow
filter
pointer-events
clip-path
mix-blend-mode
translate

Microsoft Entra ID customers who use the properties above will be notified directly in advance.

What do you need to do to prepare?

To determine whether your tenant uses positioning properties and requires you to take action:

Make sure you use a global administrator or branding administrator role.
Navigate to MS Graph Explorer
Sign in into your tenant using the 'profile/sign in' button at the top right corner.

If you have your tenantID, skip to step 5. Otherwise, you can get this by sending a GET request to the organization resource on the MS Graph Explorer. To do this, enter https://graph.microsoft.com/v1.0/organization and run the query. Then, copy the “id” value of the response.
Get all the configured company branding locales by sending a GET request to the branding resource. To do this, enter https://graph.microsoft.com/v1.0/organization/<your tenant ID here>/branding/localizations and run the query.

Copy the contents of the response or export it to a JSON file
Navigate to this tool
Paste the contents from step 6 or upload the exported JSON file to the input in the tool. You should get a list of locales and the properties impacted for each locale. These properties will be deprecated and are encouraged to be removed from your configuration.

Next steps

With these updates, Microsoft Entra custom branding continues to evolve as part of our proactive investment in secure, trusted, and consistent sign-in experiences.

To ensure a smooth transition, we encourage you to review your custom CSS configurations and remove any affected properties ahead of time. This will help you catch and address potential layout issues early, so your users stay protected and your branded sign-in experience remains seamless.

We’ll provide advance notice, guidance, and alternative customization options before broader custom CSS retirement. Thank you for your partnership as we make this transition.

-Adam Steenwyk

Principal Lead Product Manager, Microsoft Identity, Authentication Experiences

Additional resources

Learn more about Microsoft Entra

Prevent identity attacks, ensure least-privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and cloud environments.

Secure AI, web, and private apps with Zero Trust

Sinead_ODonovan — Tue, 21 Jul 2026 05:13:32 GMT

Today's threats don't respect boundaries. As AI agents proliferate across enterprise workflows, employees work from everywhere, and organizations adopt cloud-first architectures, the attack surface has fundamentally shifted. Traditional perimeter security can no longer keep pace with how work actually happens.

Microsoft Entra Internet Access and Microsoft Entra Private Access extend Zero Trust principles to all traffic, ensuring that every access request is verified against identity, device, and risk context, whether it originates from a user, a device, or an AI agent.

Today, we're building on our recent announcement, where we introduced a significant wave of new capabilities across both public preview and general availability. These updates span AI security, data protection, private access, and connectivity resilience, bringing the breadth of our SASE platform to meet the security demands of the AI era.

Now in public preview: deeper controls for AI, data, and access

Microsoft Entra Internet Access and Microsoft Entra Private Access

This July, we’re introducing new capabilities in public preview to help you secure AI interactions, protect sensitive data, strengthen access controls, and improve operational resilience—all through an identity-first approach to security. These capabilities bring deeper visibility and policy enforcement across users, AI agents, devices, locations, and applications, helping you innovate with confidence while maintaining Zero Trust principles.

Network Data Loss Protection (DLP) extends Microsoft Purview data security to the network layer with Microsoft Entra Internet Access. Discover sensitive content in risky AI and cloud apps, block unsafe sharing (including file uploads, prompts, and responses), and apply context-aware controls based on identity and activity.
Microsoft Entra network controls are now available for agents, including Microsoft Copilot Studio agents and those running on user endpoint devices, and local agents such as OpenClaw. These controls can help identify unsanctioned AI usage, restrict connections to only approved web destinations, filter risky file movement, and help block malicious prompt-based attacks before they lead to harmful actions.
Custom Acquire and Agentic Acquire on Entra Internet Access traffic profile enables side by side deployment of Global Secure Access for AI Gateway and Agentic scenarios with other vendors.
Windows 365 for Agents integrates with Global Secure Access platform to provide enterprise-grade network security to agentic Cloud PCs with traffic monitoring, web filtering and threat blocking on agentic sessions.

Figure 1: Demo of Network data security

See the full demo here.

Now generally available: broader coverage and stronger controls for users, applications, and AI

As secure access becomes foundational to every AI, cloud, and hybrid work initiative, organizations need solutions that are both powerful and operationally simple. The latest generally available capabilities for Microsoft Entra Internet Access and Microsoft Entra Private Access help organizations accelerate Zero Trust adoption, extend protection to unmanaged and remote environments, and gain greater visibility into how users, applications, and AI services interact with enterprise resources. The following capabilities are now GA and ready for organizations to deploy:

Browser-based access to internet resources for Microsoft Entra Internet Access extends secure web access to kiosk and BYOD devices using PAC file-based proxy configuration.
BYOD with Client in Microsoft Entra Private Access lets you enforce Zero Trust for unmanaged devices, so employees and contractors can securely access private apps without compromising security or user experience.
Shadow MCP Visibility provides advanced monitoring and analysis capabilities for MCP traffic between client MCP on devices and remote MCP servers. This feature provides thorough visibility into which MCP servers are being used, what tools and resources they expose, and how those tools are invoked.

Want to Learn More?

Join our three-part webinar series, Securing Data and Access in the Era of AI (July 21–23, 9:00 AM PDT), where Microsoft Entra and Microsoft Purview product leaders will share practical guidance for securing data, governing access, and scaling AI adoption with confidence. Save the dates and register to attend.

-Sinead O’Donovan | VP of Product Management, Identity and Network Access

Sinead O'Donovan | LinkedIn

Additional resources

Learn more about Microsoft Entra

Plan your Azure AD B2C migration with the Migration Policy Analyzer

NamitaSingh — Mon, 20 Jul 2026 17:18:24 GMT

Migration planning starts with visibility

One of the first challenges organizations face when planning a migration from Azure AD B2C to Microsoft Entra External ID is understanding exactly what is implemented in their tenant today.

Over time, Azure AD B2C deployments often grow to include custom user journeys, federation integrations, claims transformations, API connections, and tailored sign-up and sign-in experiences. As teams change and solutions evolve, assessing migration scope can become time-consuming and complex.

To help organizations accelerate migration planning, the Migration Policy Analyzer is now Generally Available (GA). This capability analyzes your Azure AD B2C custom policies and generates a structured assessment of the authentication features implemented, reducing the manual effort and guesswork that typically slow down early migration planning.

The resulting report helps architects and technical decision-makers understand migration readiness, identify implementation gaps, and prioritize next steps.

Understand your current implementation

Available through the Identity Experience Framework experience in Azure AD B2C, Migration Policy Analyzer performs a deterministic analysis of custom policy definitions. It is important to note that the analysis is scoped to the Azure AD B2C custom policies within IEF; it is not a full tenant-wide scan and produces an inventory of the authentication capabilities implemented in those policies.

The assessment provides guidance on:

Authentication features detected in custom policies
Migration paths to Microsoft Entra External ID
Scenarios that may require custom development
Areas where an alternative architectural approach may be recommended

Rather than manually reviewing policy files, teams receive a structured assessment that can serve as a starting point for migration planning and technical discovery.

Generate a migration assessment in three steps

Getting started requires no policy modifications or additional configuration:

Open the Identity Experience Framework in your Azure AD B2C tenant.
Select a policy and click on Analyze policy to begin policy analysis.
Review and download the generated migration assessment report.

The analyzer scans your custom policy definitions and produces a report that can be shared across engineering, architecture, and business stakeholders.

See Migration Policy Analyzer in action

Migration Policy Analyzer analyzes Azure AD B2C custom policies and generates a migration assessment to help organizations plan their move to Microsoft Entra External ID.

The Migration Policy Analyzer analyzes Azure AD B2C custom policies and generates a migration assessment to help organizations plan their move to Microsoft Entra External ID.

Understand migration readiness

Each detected capability is categorized to help organizations evaluate migration complexity and planning requirements:

Available - Capabilities that can be implemented using existing Microsoft Entra External ID functionality, including common sign-up and sign-in experiences, federation scenarios, verification workflows, and account recovery experiences.
Requires Custom Development - Capabilities that may require extensibility mechanisms, API integrations, partner-developed solutions, or additional application logic.
Architecture Change Recommended- Scenarios that may be better served by a different implementation pattern in Microsoft Entra External ID.
Not Currently Supported- Capabilities that do not currently have a direct implementation path and may require alternative approaches or future evaluation.

For example, a policy that combines social identity federation, REST API claims enrichment, and a custom password reset flow might be categorized as Available for the federation and password reset experiences and Requires Custom Development for the REST API claims enrichment, giving you an immediate sense of where effort will be concentrated.

For each finding, the report provides migration guidance and recommended next steps to support planning discussions.

Turn discovery into a migration plan

The value of the Migration Policy Analyzer extends beyond identifying features; it helps you move from discovery to an actionable plan while reducing migration risk and effort. With a categorized inventory in hand, teams can:

Estimate migration scope and effort
Prioritize proof-of-concept activities
Highlight areas requiring redesign or additional development
Build a phased migration strategy

By establishing a shared understanding of the current state, architects, developers, and business stakeholders can align on migration priorities before implementation begins.

Get started

If you are evaluating a transition from Azure AD B2C to Microsoft Entra External ID, migration planning starts with understanding what is deployed today.

Use the Migration Policy Analyzer to:

Generate an inventory of custom policy capabilities
Understand migration readiness
Identify scenarios requiring additional planning
Evaluate areas that may require redesign or custom development
Begin building your migration strategy

Open your Azure AD B2C tenant, navigate to Identity Experience Framework, and run an analysis to generate your migration assessment. In minutes, you'll have the visibility needed to move from assessment to action, with less manual effort and lower migration risk.

The Migration Policy Analyzer provides the visibility needed to move from assessment to action.

-Namita Singh

Additional resources

Learn more about Microsoft Entra

Is system-preferred first factor overriding Single Sign-On?

RyanSteele-CoV — Fri, 17 Jul 2026 23:02:31 GMT

My colleagues and I have noticed that we've started being prompted to perform a Windows Hello for Business authentication when we use Edge to access web resources that are authenticated with Entra. Previously, this authentication occurred silently through Single Sign-On with the PRT, per Understanding Primary Refresh Token (PRT) in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn.

While investigating what might have caused this change in behavior, I found MC1411574 in the M365 Message Center, which talks about a change to system-preferred authentication that started rolling out in late June 2026, whereby it now applies to the first factor as well as multi-factor authentication. I excluded myself from system-preferred authentication and sure enough, that seems to have restored the previous behavior.

Is it intended that this change to system-preferred authentication will disable SSO, or do we have something misconfigured?

Looking for an on-prem MFA solution for Active Directory and RDP

Grey_ai1 — Wed, 15 Jul 2026 18:07:23 GMT

Hi everyone,

We're reviewing options for adding MFA to our on-premises Active Directory environment.

Most of our users authenticate with Active Directory, while administrators also use RDP for managing Windows servers.

Because part of our infrastructure is isolated from the Internet, we'd prefer an on-premises MFA solution instead of relying on a cloud-only service.

Has anyone implemented something similar recently?

I'm interested in hearing:

Which solution did you choose?
How difficult was the deployment?
Did you run into any compatibility or performance issues?
Is there anything you'd do differently if you were deploying it again?

Any real-world experience or recommendations would be greatly appreciated.

Thanks!

AI agents are everywhere. Are your access controls ready?

Kaitlin_Murphy — Wed, 15 Jul 2026 18:16:41 GMT

At Identiverse 2026, Microsoft Security hosted a Power Breakfast that brought together 150 identity professionals across 10 simultaneous roundtable discussions. Participants came from industries including financial services, healthcare, government, and energy, and represented every stage of AI adoption.

We asked participants what they’ve built to secure agents, what they’ve rolled back, and where control is breaking down.

“The pace has been crazy fast. We have thousands of agents. Most of them are unmanaged.”

Roundtable participant, Identiverse 2026

What your peers are saying about securing agents

Agent sprawl is already here and bigger than most teams realize

Nine in 10 roundtables described unmanaged agent sprawl not as a future risk, but as a present reality. What started as dozens of agents became tens of thousands in months or even weeks. No single audit could capture the full picture. Practitioners described discovering the true number by accident, often finding far more than they expected: “I was doing a demo one day, I looked at our corporate tenant, and we had like 44,000 agents. I just couldn’t believe it, after so little time.”

Agents are proliferating across every cloud, SaaS platform, and vendor environment simultaneously

Nine in 10 roundtables reported agents running across SaaS, multicloud, and third-party environments with no governance visibility. Eight in 10 said shadow AI is already present in their organizations, running across platforms that no single governance layer currently covers and tracked only through network logs, if tracked at all. The challenge isn’t unique to any one platform: every SaaS vendor is now shipping with an agent, every cloud provider has a builder framework, and every team has a developer standing up something new.

“When everybody has a single pane of glass, nobody has a single pane of glass.”

Roundtable participant, Identiverse 2026

Assigning human ownership to agents becomes complex when people change roles or leave organizations

Nine in 10 roundtables raised the ownerless-agents problem. Agents get built, tied to their creator’s identity, and keep running long after that person has changed roles or left the organization—unreviewed, over-permissioned, and undetected. This results in agents with no clear accountability, stale permissions, and no obvious path for review, reassignment, or decommissioning.

Agent-to-agent interactions are where control fails hardest

Eight in 10 roundtables identified agent-to-agent chains as the most difficult security challenge they had encountered. Multiple teams rolled back agent-to-agent deployments after finding they could not maintain consistent governance across the chain.

“I can control point A to point B, but point B needs to talk to point C, and that’s where context was lost. I can control permissions. I can control authentication. I do not know how to control the impact.”

Roundtable participant, Identiverse 2026

How Microsoft Entra Agent ID can help

Microsoft Entra Agent ID is the identity foundation for every AI agent, and it’s where your control starts. Every governance, access, and lifecycle decision flows through agent identity. Without it, none of the controls below are possible. Microsoft Agent 365 builds on that foundation as the unified control plane, giving IT and security teams a single place to see and act on every agent across the organization.

If you have similar pain points around managing agents, here are three actionable starting points for securing them:

1. Build your inventory before you do anything else

You cannot govern what you cannot see. Start here.

The Microsoft Entra admin center shows every agent identity in your tenant across Copilot Studio, Microsoft Foundry, and third-party platforms in one view. Start in Microsoft Entra ID > Agents > Agents overview to get a full picture of the total number of agents with identities, how many were recently created, how many are active, and how many are unmanaged. Then go to Microsoft Entra ID > Agents > Agent identities and run your first audit. Agents without an Agent ID appear as classic agents with no governance controls attached. That list is your backlog and needs to be addressed right away to prevent sprawl.

For agents running outside the Microsoft ecosystem, register them using the Agent 365 CLI and SDK or federated identity credentials. You do not need to migrate them; you need to get them into the registry so they are visible and can be governed.

For third-party agents, running the Agent 365 SDK assigns each agent an agent identity blueprint, an agent identity, and a sponsor from the start, helping ensure that agents are trackable and more secure. A blueprint is a template that defines permissions, policies, and metadata for every agent instance created from it. It provides centralized control, allowing you to manage or disable agents created from it at scale. Skipping blueprints and creating agents as ad hoc service principals is how you end up with the sprawl the roundtable participants described.

2. Assign an owner and a sponsor to every agent, then automate what happens when they leave

The orphaned-agent problem practitioners described has a direct solution. Every agent identity in Microsoft Entra Agent ID requires a sponsor (the person accountable for what the agent does) and an owner (the person responsible for its technical management). Assign both at creation time, at the blueprint layer. If you have existing agents with neither, start there.

When someone leaves your organization, Microsoft Entra lifecycle workflows can automatically trigger an ownership review for every agent associated with that person. You define the escalation path and the window: reassign, pause, or decommission. This replaces the manual scripts your team has been running for service accounts.

Set up recurring access reviews for agent identities. Scope them to surface active permissions, usage signals, and business justification—not just whether the agent still exists. Agents that cannot be justified should be decommissioned, not left running.Best practices for Microsoft Entra Agent ID
Govern agent identities and lifecycle
Lifecycle Workflows overview
Access reviews for agents overview

3. Scope permissions tightly, and apply Conditional Access and RBAC at the blueprint level

Start with enumerated scopes on every blueprint: only the specific delegated permissions the agent needs, nothing more. This is not optional. Agents do not self-restrict.

“An agent doesn’t self-restrict. It’s going to do whatever it feels like it needs to do.”

Roundtable participant, Identiverse 2026

For agents acting on behalf of a user, use the on-behalf-of flow so that user-level access policies apply. For autonomous agents, use the client credentials flow, scoped narrowly. Do not grant application-level permissions when delegated permissions accomplish the same task.

Apply Conditional Access policies at the blueprint level, not agent by agent. Every agent instance created from that blueprint inherits the policy automatically. This is how you extend Zero Trust controls from your workforce to your agents. Next, Microsoft Entra ID Protection analyzes agent behavior to detect anomalies such as unusual access patterns, spikes in activity, or interactions with unfamiliar resources. When an agent is flagged as risky, those signals automatically trigger Conditional Access policies to block or restrict access in real time, moving you from static policies to adaptive protection.

Lastly, turn on sign-in and audit logs in the Microsoft Entra admin center. Agent-initiated events are flagged separately from human-initiated ones. This is your baseline for detecting unauthorized access and demonstrating compliance.

If you have had a similar experience, please share your learnings in the comments!

Kaitlin Murphy

Senior Director, Identity and Network Access Product Marketing

Additional resources

Learn more about Microsoft Entra

Can the built-in "No account? Create one" link redirect to a custom sign-up page?

Lipikasree — Mon, 13 Jul 2026 10:13:42 GMT

I'm using Microsoft Entra External ID with a built-in sign-in/sign-up user flow.

On the Microsoft-hosted sign-in page, the "No account? Create one" link always redirects users to the default Entra sign-up page.

I already have a custom registration page and would like this built-in link to redirect to my custom URL instead.

Is there any supported way to customize the destination of this link in a built-in user flow? If not, could someone confirm whether this behavior is fixed by design?

Thanks!

Using Cloud sync to sync AD to existing Entra Accounts

tjcooper2 — Thu, 09 Jul 2026 22:32:31 GMT

I want to sync in premise AD accounts with existing Entra accounts. The email on both accounts is the same, and I added the Entra/o365 suffix to the domain and set the UPN to that suffix, making both UPN(s) the same. It did not sync. It created a NEW Entra account. I thought I covered all my bases.

How can I get on premise AD and existing Entra accounts to sync?

thank you

Group-Based Licensing (E3 → Business Premium): MutuallyExclusiveViolation – Months Unresolved

DanielZieb — Wed, 08 Jul 2026 06:32:59 GMT

We operate a Microsoft 365 environment with Entra ID, Intune, and Exchange Online. For months, we have been dealing with a critical issue that remains unresolved to this day — despite an active Microsoft Support ticket.

The Technical Problem:

During the migration of approximately 87 user accounts from Microsoft 365 E3 to Business Premium (SPB) via group-based licensing in Entra ID, all affected accounts receive a MutuallyExclusiveViolation error. Microsoft's backend treats E3 and Business Premium as mutually exclusive, blocking the SPB assignment — despite sufficient licenses being available.

A sequential approach (removing E3 first, then assigning Business Premium) is not an acceptable solution: a test run proved that this causes a complete loss of Exchange Online access. For a rollout across 87 productive user accounts, this is not viable. What is required is a seamless, atomic license swap at the backend level — exclusively via group-based licensing.

The Support Problem:

Two support engineers assigned — zero technical progress.
Instead of a substantive solution, we received standard documentation steps that do not address the actual problem.
A false resolution notice was issued — the issue had demonstrably not been resolved. Our own PowerShell tests (Get-MgUser, Get-MgSubscribedSku) and CSV exports from the Entra ID portal disproved this conclusively.
Committed updates from the Engineering Team were not delivered.
Instead, automatically generated follow-up emails were sent with no substantive relation to the ongoing case.
An additional unexplained behavior: a test user appears in the error report of a license group they were never added to — a further backend inconsistency that has not been investigated.

Current Status:

The ticket has been open for months. 87 user accounts cannot be migrated to Business Premium. An escalation to the Team Manager has been initiated. No resolution is in sight.

My Question to the Community:

Has anyone experienced a similar issue with MutuallyExclusiveViolation in group-based licensing (E3 → Business Premium)? Is there a known workaround or an official Microsoft statement on this?

Ticket Reference: #2604241410000669

Govern AI agent identities and access the same way you govern your employees

chiragdayani — Tue, 07 Jul 2026 21:34:53 GMT

In our conversations with customers, we’ve heard consistent feedback: organizations want to embrace AI agents, but they need the same governance rigor they apply to human identities—adapted for the speed and scale of AI. As agents take on real work, the critical question becomes: how do you give each agent the access it needs to be productive without letting that access become a risk?

For example, an agent tasked with analyzing purchase trends and delivering a report needs the ability to read transaction data from an ERP system. Historically, agents may have used shared credentials or access rights borrowed from an employee. As AI adoption grows, organizations are increasingly adopting dedicated agent identities that provide clearer ownership, accountability, and governance. This gives each agent a distinct identity with a named human sponsor and governed access, while providing enterprise security and lifecycle management.

With a distinct identity for each agent, ownership becomes clear, organizations gain visibility into each agent’s access, and access does not accumulate over time. Knowing which agent has what access, who is responsible for it, and whether that access is appropriate is foundational to secure and govern agents—just as it is for your human workforce.

Microsoft Entra surfaces agent identity governance capabilities that are generally available as part of Microsoft Agent 365.

New challenges for governing agent access

Traditional software is relatively static. Once deployed, its capabilities and permissions don’t change without a deliberate software update. Agents are fundamentally different; their capabilities evolve over time, and each new capability represents a change in the agent’s access footprint. This constant evolution means their access needs to change too, and without governance, that access compounds organizational risk.

As organizations scale their AI agent deployments, security and IT teams are facing new challenges that traditional identity governance wasn’t designed for:

Overprivileged access: Agents often receive access at runtime, accumulate access over time, and retain it indefinitely, multiplying security risk across the organization.
No human accountability: When an agent acts autonomously, who is accountable for it? Without clear accountability, no person is responsible for its access or lifecycle.
Manual lifecycle management policies don’t scale: Organizations managing hundreds or thousands of agents across multiple platforms need consistent access governance policies that admins can manage at scale. They can’t rely on manual processes to track sponsors or determine which agent identities and access assignments are still needed.

Govern agent identity and access with Microsoft Entra Agent ID

Microsoft Entra Agent ID enables organizations to govern agent identities and access at scale throughout the agent lifecycle. For example, an agent identity should follow the below identity and access lifecycle process:

Figure 1: Agent identity and access lifecycle.

Govern access for agents with Microsoft Entra access packages

Access packages, a capability within Microsoft Entra Entitlement Management, brings structure and accountability to the entire access lifecycle for agent identities. Organizations can provide access policies that governs how access is requested, approved, and scoped in the first place, and ensures access is reviewed and expires when it's no longer needed. The result is access that's intentional, right-sized, time-bound, and easy to prove in an audit, without slowing teams down. This applies to both assistive agents that require delegated OAuth permissions to act on behalf of users and autonomous agents that operate independently with their own application roles and permissions.

By managing access assignments through access packages, you can:

Scale efficiently when many agents need similar access rights
Delegate approvals to the right decision-makers—application owners, compliance teams, or business stakeholders—for high-risk or compliance-sensitive access
Time-limit access assignments so agents don’t retain access indefinitely

Now consider a scenario where a DevOps agent needs access to certain OAuth permissions. An admin creates an access package policy scoped to agents, with approvals and access expiration settings, so its sponsor can request access on behalf of the agent identity:

Figure 2: Admin experience with access package policy for agents.

Sponsors from across your organization, who don’t need to be IT admins, can use the My Access portal to submit the access request on behalf of the agent identity. The request goes through an approval flow before time-limited access is assigned.

Figure 3: Sponsor experience for requesting an access package on behalf of an agent.

Additionally, Microsoft 365 administrators can use custom policy templates that leverage Microsoft Entra access packages, providing a streamlined experience for governing agent access during onboarding. The AI admin in Microsoft Agent 365 can request Microsoft Entra access packages through Microsoft Agent 365 policy templates. This ensures an agent’s access is secure from day one with approval flows and access expiration, so that the access does not persist longer than needed.

Figure 4: The Agent 365 template to apply access package policy during agent onboarding.

Hold every agent accountable with a named sponsor

Every agent identity and agent identity blueprint in Microsoft Entra can have a designated sponsor—a person accountable for that agent’s access and lifecycle. You can learn more about sponsor responsibilities here.

Agent sponsors provide the human accountability needed to govern agent identities at enterprise scale. By assigning sponsors, organizations can:

Establish clear ownership for every agent identity
Enable business stakeholders, not just IT administrators, to participate in governance decisions
Ensure a responsible person reviews and requests access on behalf of the agent
Empower sponsors to make lifecycle decisions for agent identities, including renewing, extending, or removing agent identities based on ongoing business need
Provide a designated contact for audit, compliance and security reviews
Reduce the risk of orphaned and unmanaged agent identities

Figure 5: Owners and Sponsors of agent identities

Automate the agent lifecycle with Lifecycle Workflows

With Microsoft Entra Lifecycle Workflows, you can add tasks for agent sponsors to your workflows so that as employees change roles, Microsoft Entra automatically:

Notifies the manager and co-sponsors when an agent’s sponsor moves or leaves, helping ensure no agent is left without accountability
Transfers sponsorship automatically to a co-worker or manager, so there’s always a human accountable for every agent, even during organizational transitions

Figure 6: Lifecycle Workflows automate sponsor maintenance when sponsors move or leave.

Sponsors can then see a list of agent identities they are responsible for and take lifecycle actions, such as disabling agent identities when they are no longer needed.

Figure 7: The Manage Agents end-user experience enables sponsors to make lifecycle decisions.

The path forward

Organizations benefit most from AI agents when governance is an enabler, not an afterthought—with guardrails in place from the moment an agent is onboarded. The agentic era extends identity governance to a new class of non-human identities that are more dynamic and numerous than the service accounts of the past. The principles stay the same—least privilege, accountability, lifecycle management, and continuous governance—but the mechanisms must evolve to match the speed and scale of agentic AI.

Get started

Ready to bring your AI agents under control with Microsoft Entra ID Governance for agent identities? Explore Microsoft Agent 365 to start a trial and see how you can observe, govern, and secure agents across your organization.

Chirag Dayani
Sr Product Manager, Microsoft Entra Identity and Access Management
Connect on LinkedIn

Mark Wahl
Principal Product Architect
Connect on LinkedIn

Additional resources

Learn more about Microsoft Entra

Made a self-hosted Entra ID governance portal for app/identity sprawl (open source)

AzAutomationEngineer — Fri, 03 Jul 2026 08:46:42 GMT

Our tenant ended up with hundreds of app registrations and enterprise apps, and the native portal makes you dig through a separate blade for every basic question. Who owns this app? Which secrets die next month? What hasn't been signed into in a year? Which ones have scary Graph permissions? There's no single view for any of it, and half the ownership info was missing anyway.

Entra ID Governance, access reviews, PIM all exist, but they felt heavy (and licensed) for what I actually wanted, which was just a fast list I could scan for routine cleanup.

So I built one. Lightweight portal that runs entirely in your own subscription:

One grid for App Registrations, Enterprise Apps, Managed Identities and Privileged Users
Risk flags per identity: expiring/expired creds, high-risk permissions, no owner, stale sign-in, no CA coverage
Ownership tracking, review and owner-change workflow, CSV export
Tenant health score and a consent posture dashboard
Optional expiry email notifications (needs a SendGrid key)
Reads Graph through a managed identity, so no app secrets for data access and nothing leaves your tenant

Runs about $26-30/month (one B2 App Service plan). B1 is also supported, but it's noticeably slower.

It's not a replacement for Entra ID Governance or PIM, more of a cheap everyday hygiene thing.

Full disclosure, I used AI building this and writing this up. I designed the architecture and functionality, tested it and ran it against my own tenant. It's open source and deployable with Azure DevOps or an Azure CLI script. Data never leaves your own tenant.

Repo (screenshots + setup): Github Repository

Would love feedback, especially what you'd want it to flag that it doesn't, or where the risk scoring feels off. Been building it on and off for a few months with a lot of iteration. Hopefully this could be useful for others as well.

Bring business logic into PIM role activation workflows

Kaitlin_Murphy — Wed, 01 Jul 2026 16:35:45 GMT

Privileged access often depends on business context that lives outside Privileged identity Management (PIM)—ticket validity, HR status, compliance checks, or on-call schedules. With custom extensions for Microsoft Entra Privileged Identity Management, organizations can bring that context directly into activation workflows.

We’re excited to announce the preview of custom extensions for Microsoft Entra Privileged Identity Management (PIM), a powerful new capability that lets you integrate your organization’s business logic directly into PIM role activation workflows.

The challenge

Many organizations need governance controls that go beyond what PIM offers natively. While PIM already supports MFA, justification, and approval workflows, organizations also often want to:

Validate ticket numbers against an ITSM system
Enforce HR-based access rules, such as employment status
Integrate compliance or audit workflows before granting activation
Apply dynamic approval logic based on the specific context of a request

Until now, these validations required manual processes outside of PIM, which can create gaps in enforcement and auditability.

Introducing PIM custom extensions

With custom extensions, PIM can now call your REST API during role activation. Your API evaluates the request against your business rules and returns a decision that PIM enforces automatically.

How it works:

A user requests role activation in PIM.
PIM sends a structured request payload to your custom extension API, including details like principalId, roleDefinitionId, justification, ticketInfo, and scheduleInfo.
Your API applies your business logic and validates the ticket, checks HR status, or runs compliance checks.
Your API returns a decision—Approved, AutoApproved, or Denied—along with a reason.
PIM enforces the decision and logs the interaction for audit.

Supported scope

In this preview, custom extensions support:

PIM for Groups
PIM for Microsoft Entra roles
PIM for Azure resources

The extension is invoked synchronously during the activation workflow (pre-approval stage), enabling real-time decisioning.

Audit and traceability

Every extension interaction is fully auditable. Each response includes an evaluationId, evaluationOutcome, and reason, giving you end-to-end traceability for compliance reviews and security investigations.

Get started

Setting up PIM custom extensions involves five steps:

Create a new custom extension API — a REST API (HTTP POST) that implements your business logic.
Secure the API with Microsoft Entra ID — register an app and implement token validation.
Onboard the extension in PIM — use Microsoft Graph API to create the custom extension object.
Link the extension to role settings — enable Require pre-approval custom extension in PIM role settings.
Activate and validate — test the end-to-end flow by activating a role.

Example scenarios

Scenario	Extension logic
Ticket validation	Verify that the ticket ID is valid and assigned to the requester
HR compliance gate	Confirm that the requester meets the required criteria
Auto-approval for on-call	Auto-approve activation for users who are currently on call
Deny after hours	Deny activation outside approved maintenance windows

What's next

Microsoft Entra ID Governance helps you protect, monitor, and audit access to critical assets while ensuring employee productivity. It gives you the ability to ensure the right people have the right access to the right resources with the right controls—preventing identity attacks, enforcing least privilege access, and unifying access control across your environment.

We’re continuing to enhance custom extensions, and your feedback during this preview will shape the future of extensible governance in Microsoft Entra. We recommend enabling PIM custom extensions end-to-end and sharing your feedback here.

-Kaitlin Murphy

Senior Director, Product Marketing

Kaitlin Murphy | LinkedIn

Additional resources

Learn more about Microsoft Entra

Protect sensitive data in motion across SaaS and AI apps with Microsoft Purview and Microsoft Entra

SuleTatar — Wed, 01 Jul 2026 16:32:24 GMT

Once, securing data meant protecting them within the confines of endpoints and managed apps. It lived inside boundaries you controlled. Today, those boundaries have disappeared—and with them, the old playbook for data security.

Data security must keep up with how data moves in the AI-era

Organizational data now travels constantly between trusted endpoints and unmanaged web apps, SaaS apps, and most critically, generative AI tools over the network. Employees type and paste sensitive information into prompts, upload work-related files to external services or personal cloud storage, and interact with systems that sit entirely outside the traditional enterprise perimeter. AI has expanded the risk surface for potential enterprise data loss.

Traditional data loss prevention (DLP) approaches lack real-time visibility and enforcement, often flagging incidents after data has already left the organization. In other cases, vendors rely heavily on physical network appliances that are complex and expensive to deploy, or compute-intensive resources that can add latency. In the era of AI, that model breaks down quickly.

Enabling real-time data protection for how work happens

To address this shift, we’re announcing the extension of data security to the network layer, powered by Microsoft Purview and Microsoft Entra, now in public preview.

This integration brings together data context and identity-aware enforcement to help protect sensitive data in transit, in real-time:

Detect how sensitive data is shared to shadow AI tools, unmanaged SaaS apps, and personal cloud repositories.
Help block or limit data exposure in real-time based on identity, user activity, and data context.
Unify investigation workflows by correlating identity, data, and insider risk signals across Microsoft Purview, Microsoft Entra, and Microsoft Defender.

By combining Microsoft Purview data classification, DLP policies, and insider risk detection with identity-aware enforcement at the network layer through Microsoft Entra, organizations can dynamically apply protections based on:

The sensitivity of the data
Who the user is
How that user has interacted with sensitive data over time

Together, these capabilities help protect data in motion across browser sessions, SaaS usage, and AI interactions (including prompts and responses), all at the speed and scale that today’s work demands. The result is a more complete, consistent approach to data protection that follows the data instead of relying on fixed, at-rest controls.

What this changes in practice

With network-level visibility and enforcement, security teams can finally understand how sensitive data is moving across unmanaged SaaS and AI apps, not just within Microsoft applications or endpoint devices.

Prevent employees from sharing proprietary or sensitive organizational data to potentially risky locations such as consumer AI apps.

That includes scenarios that have historically been difficult to see and protect, including:

Text that’s inputted directly into unmanaged apps and email services, such as prompts and responses
Files that are uploaded to personal cloud storage repositories
Files and text that could be scanned and processed by unsanctioned plugins or add-ins
Files and text that are shared outside of a managed browser session

See the full demo here.

Most importantly, protection preempts data leakage. Instead of relying on downstream detection, organizations can detect and block sensitive data in transit before it’s exposed. Because enforcement is tied to identity and user context, policies can adapt based on risk without introducing unnecessary friction for end users.

Underneath, this is powered by a unified policy model, where the classification and protection policies defined in Microsoft Purview for the rest of your data estate are also enforced consistently at the network layer through Microsoft Entra. This reduces the need to juggle multiple point solutions to secure data holistically across your environment.

A shift to real-time data protection

This shift reflects a broader transformation in how data and network security teams must operate.

Traditional approaches rely on static boundaries and after-the-fact controls. That model breaks down when data is continuously exchanged across SaaS apps and AI systems.

Data protection now needs to operate in real-time and in the flow of user activity.

Network data security – now available in Microsoft 365 E7* – plays a critical role in enabling this shift by extending enforcement beyond endpoints and applications to the network itself, helping protect data wherever it moves.

Learn more

As organizations adopt AI at scale, securing data and access during AI and agent use becomes mission-critical.

Join our three-part webinar series, Securing Data and Access in the Era of AI, to see how Microsoft Entra and Microsoft Microsoft Purview help protect data, govern access, and reduce risk across your AI journey.

Register for the webinar series: Securing data and access in the era of AI with Microsoft Entra and Microsoft Purview

See it in action.

Sule Tatar, Senior Product Marketing Manager, SCI Identity

-Vivian Ma, Senior Product Marketing Manager, Microsoft Purview Data Security

Vivian Ma | LinkedIn

*Network data security capabilities are also available to customers with both a Purview ME5 (or equivalent) and Entra Internet Access (or equivalent) license.

Learn more about Microsoft Microsoft Purview

Dynamically secure your data with an integrated approach across your multi-structured data estate, devices, and generative AI apps and agents.

Learn more about Microsoft Entra

Best approach to detect multiple user accounts signing in from the same physical device

RaedSalah — Wed, 01 Jul 2026 09:10:12 GMT

Hi Everyone,

Working on environment: D365 Finance & Operations (cloud).

Goal:
I need to detect when more than one Dynamics user account is being used
from the same physical device, and ideally count how many distinct users
are active on that device. The business reason is this is not permissible to login with more than one account in the same device.

For example:
User X has device D1, User Y has device D2.
User X logged in with his account using Device D2 (which is user's Y device).

I want to know if this happened, cause it's not permissible behavior in the organization.

For more illustration some users have blank devices id when I see Microsoft Entra.

Or if I could find out when a user logs in and integrate it with D365 F&O to store the device the user logged into in a custom log table or anything that tells me that this user account is opened on more than one device or this device has more than one logged-in user account.

Microsoft Entra Backup and Recovery is now generally available

CindyCrane — Tue, 30 Jun 2026 18:27:57 GMT

Microsoft Entra Backup and Recovery is now generally available. Microsoft Entra customers licensed for Entra ID P1 or P2 now can restore supported critical identity data after accidental changes or malicious updates, rolling out to all workforce tenants this week.

Identity resilience and disaster recovery are top challenges for IT teams. Microsoft Entra Backup and Recovery helps address both by automatically backing up core directory objects daily. Supported objects include users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, and authentication and authorization policy, helping administrators return their environment to a previously known‑good state.

Microsoft Entra Backup and Recovery is a built-in backup and recovery solution that lets you recover critical Microsoft Entra directory objects to a previously known good state after accidental changes or security compromises. The overview dashboard highlights alerts, recent backups, difference reports, and protected actions.

Get started today with the built-in backup and recovery solution in Microsoft Entra | Microsoft Learn

What's changed since public preview?

Based on feedback from the Backup and Recovery public preview, we’ve increased the retention period for supported directory objects from 5 days to 7 days to provide extended protection.

Identity admins now have more flexibility when viewing available snapshots, generating difference reports to understand what changed, and running recovery jobs to restore objects to a prior state. These capabilities help teams quickly assess what changed and take action to return to a known good state.

But recovery is not just about restoring objects. It’s about being prepared to return your tenant to a known‑good state under pressure. Entra Backup and Recovery fits into a broader tenant recoverability strategy so you can reduce disruption, respond to common recovery scenarios, and recover with confidence.

Why recoverability matters

Accidental deletion, misconfiguration, and malicious changes can disrupt sign‑in, block access to business‑critical applications, and quickly impact downstream operations.

Backup and Recovery provides an important foundation for restoring supported objects, but tenant recoverability requires a broader approach. Recoverability is the ability to restore tenant configuration and identity objects to a known‑good state after unintended or malicious changes, using clear processes and supported recovery paths.

This means recovery readiness is not a single solution. It is a combination of capabilities, processes, and preparation across your organization.

Layers of Recovery: Best Practices

Organizations that recover quickly combine built‑in capabilities like Backup and Recovery with additional layers of preparation and control.

Key elements of a strong tenant recoverability strategy include:

Built‑in recovery for supported objects: Use Microsoft Entra Backup and Recovery to restore supported objects and configuration changes within the retention window.
Maintaining a known‑good configuration state: Regularly capture tenant configuration using tools such as Tenant Configuration Management APIs and Microsoft Graph exports to support recovery beyond built‑in capabilities.
Operational readiness: Define recovery processes, retain audit and sign‑in logs, and establish recovery objectives so that recovery actions can be executed under pressure.
Reducing blast radius: Apply least‑privilege access, Privileged Identity Management, and protected actions to limit the scope of potential incidents and simplify recovery.

Together, these layers help organizations move from reactive fixes to a structured recovery strategy.

"Overall, we like the functionality offered by Microsoft Entra Backup and Recovery. The API support looks solid as well."

– A large European automobile manufacturer

Scenario: Conflicting identity changes disrupt access

To illustrate how organizations can use Backup and Recovery, let’s walk through a potential scenario using a fictitious company called “Contoso”.

Here's the situation:

The IT team at Contoso relies on Microsoft Entra Conditional Access policies and Privileged Identity Management to protect access to business-critical applications. Policies are tightly controlled, and administrative access is granted just in time.

But during a routine day, remote workers suddenly can’t sign in to a critical ordering application. Nothing appears compromised, and the application itself is healthy. The team needs to understand what changed—and restore access quickly.

Step 1: Identify and restore application access.

An administrator runs a Microsoft Entra Backup and Recovery difference report against a recent snapshot and correlates it with Entra audit logs to identify recent changes. The report shows a Conditional Access policy was modified by a known administrator. The update accidentally blocked the remote worker group from accessing the ordering application. Using Backup and Recovery, the administrator restores the policy to a previous state. Access is quickly re‑enabled.

Step 2: Investigate beyond the initial fix.

With access restored, the team continues investigating to understand how an unintended policy change reached production. They review Microsoft Entra Tenant Governance monitoring signals to identify any related configuration changes.

Step 3: Detect configuration drift.

Tenant Governance signals reveal drift in role governance configuration during the same timeframe: a change to role eligibility settings broadened who could administer the Conditional Access policy. This change does not align with the approved configuration baseline.

Step 4: Confirm conflicting changes.

Correlating audit logs with the drift findings, the team reconstructs the sequence. To resolve an urgent, unrelated issue, an administrator had temporarily modified role-eligibility settings — unintentionally allowing a second administrator to edit the Conditional Access policy and block the remote worker group. Two well-intended changes, made independently, combined to cause the outage.

Step 5: Restore governance baseline and prevent recurrence.

The team initiates an established workflow to restore role governance configuration to the approved baseline. Because Contoso routinely practices scenarios like this during Business Continuity and Disaster Recovery (BCDR) drills, the team is able to coordinate rapidly. They restore both application access and governance controls, reducing the likelihood of similar issues in the future.

Recover with confidence: Get started today

Microsoft Entra Backup and Recovery provides a built‑in foundation for restoring supported identity data that organizations can adopt as part of a layered recoverability approach that combines built‑in capabilities with preparation, governance, and operational discipline.

Microsoft Entra Backup and Recovery is built as an API‑first, extensible platform that gives customers the flexibility to design backup and recovery workflows aligned to their operational needs. These same APIs enable independent software vendors (ISVs) to integrate and deliver complementary solutions that extend Entra with their domain expertise.

By aligning Backup and Recovery with a broader identity resilience strategy, organizations can reduce downtime, respond faster to change‑related incidents, and maintain confidence in the integrity of their identity environment.

Ready to strengthen your identity resilience?

Learn how to enable Microsoft Entra Backup and Recovery in your production environment with Microsoft Learn documentation.

- Cindy Crane, Principal Product Manager

Additional resources

Read the new monthly blog series: What’s new in Microsoft Security

Learn more about Microsoft Entra

EntraID integration with Biostar 2

SancroNelly — Fri, 26 Jun 2026 12:05:16 GMT

Hi all, I have issue integrate entra ID with biostar. The sync keep fail, anyone have done the integration before? Need advise on the integration steps. Thank you.