Microsoft Entra Blog articles

What's New in Microsoft Entra: July 2026

Martin_Coetzer — Fri, 24 Jul 2026 17:47:47 GMT

Welcome to the July edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft Entra.

What went into General Availability (GA) since June 2026?

Microsoft Entra Backup and Recovery - A capability that helps organizations restore a tenant after accidental or malicious changes. On by default, it automatically backs up critical directory objects, including users, groups, applications, Service Principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policies, so admins can return to a known good state. The service takes daily backups of supported objects and retains them for 7 days with Microsoft Entra ID P1 or P2 licenses. Admins can view snapshots, compare changes, and run recovery jobs. This feature is a reliable safety net to minimize downtime and strengthen protection against misconfigurations and security incidents.

Direct admin assignment to external users using email address - Entitlement management admins can assign external users, not in the directory, to an access package with the user's email. Users are invited into the tenant as Guest users and are governed when Microsoft Entra ID Governance is configured.

Bring your own device (BYOD) support for the Global Secure Access Windows client using Microsoft Entra‑registered devices - Enable users and partners to access corporate resources from their own devices. Administrators can assign the Private Application traffic profile to users with internal accounts, including internal guest users. This removes the previous requirement for Windows devices to be domain‑joined.

Microsoft Entra Kerberos key rotation - Improves reliability for environments by using incoming trust referral flows. The update enhances authentication resiliency during key rollover by validating referral tickets with primary and secondary Kerberos keys. This combination reduces the likelihood of authentication failures and minimizes disruption during rotation events.

Domainless SAML federation with a SAML identity provider - Enable external users to sign in to applications or workforce resources using their Identity Provider (IdP)-managed credentials, regardless of their email domain. With no need to match user email domains with preconfigured identity provider domains, this capability simplifies onboarding and access for external users, streamlines invitation redemption, and improves flexibility for cross-organization collaboration in Microsoft Entra.

New in Public Preview

Strengthen AI agent security with Conditional Access - Microsoft Entra Conditional Access has broader controls to secure AI agents that leverage user accounts. Administrators can target agent user accounts more precisely by including, or excluding, agents, or by using custom security attributes for dynamic grouping. Organizations can apply Conditional Access policies, based on agent risk, require compliant devices for agents running on managed endpoints, including Windows 365 for Agents, and enforce device, network, and platform-based access conditions. These enhancements extend Zero Trust protections to agent user accounts while using the familiar Conditional Access policy experience.

Restrict AD group changes to Microsoft Entra provisioning - Designate specific Active Directory (AD) groups so all modifications are managed through the Microsoft Entra provisioning service. This capability helps maintain consistency between Microsoft Entra ID and AD by ensuring group changes are centrally controlled. Reduce configuration drift and improve alignment across identity systems.

Generate unique aliases with custom call-outs - Use custom call-outs with Azure Logic Apps during user provisioning to perform advanced attribute transformations that meet your organization's requirements. Custom call-outs can generate values such as unique employee aliases and are supported for create events in HR inbound, SaaS outbound, and cross-tenant synchronization provisioning flows in Microsoft Entra.

Announcements

Jailbreak/root detection in Microsoft Authenticator - This feature strengthens security by preventing Microsoft Entra credentials from being added or used on jailbroken or rooted devices. Users move to compliant devices to continue using work or school accounts in Authenticator. It is secure by default, requires no admin configuration, and applies to iOS and Android. Personal and third-party accounts are not affected.

Starting August 2026, Microsoft Authenticator on iOS will offer an improved backup and restore experience - Users can back up account names securely by using iCloud and iCloud Keychain with end-to-end encryption. This experience includes work or school accounts, Microsoft personal accounts, and non-Microsoft accounts like Amazon or Google, also third-party time-based one-time password (TOTP). No other credentials are included in the backup. This update removes the need for a Microsoft personal account and simplifies device setup by automatically restoring account names on new iOS devices. Users manage the feature through iCloud settings

New guidance and information

SCIM APIs available in U.S. Government Cloud - Microsoft Entra SCIM 2.0 APIs, which went into GA, in the public cloud, earlier in 2026, are available in Microsoft U.S. Government Cloud. Organizations can use standards-based SCIM operations to provision and manage users and groups in Microsoft Entra ID from external SCIM-compatible identity sources. Enable scalable identity lifecycle management, while you reduce the need for custom integrations.

Tell us what you think!

If you have feedback on this newsletter, fill out the dedicated Microsoft Form.

Blogs

Check out the latest blog posts on our Microsoft Entra Blog and our Microsoft Entra Identity Developer Blog.

What's new in Microsoft Entra?

Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecation functionality, and upcoming changes. You can find releases specific for Sovereign Clouds on a dedicated release notes page.

Become a certified Microsoft Identity and Access Administrator

Check out the certification and related training for the Microsoft Identity and Access Administrator available for customers and partners.

-Martin Coetzer

Principal Product Manager, Identity and Network Access, Customer Experience Engineering (CXE)

Microsoft Entra Community | LinkedIn

Learn more about Microsoft Entra

Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.

Modernize SAP Identity Management with Microsoft Entra

Mark_Wahl — Fri, 24 Jul 2026 17:54:07 GMT

Many organizations are rethinking how they manage identity across their SAP landscape as they move away from on-premises identity management systems and adopt a more unified cloud strategy. That shift often starts with a practical question: how do you connect SAP identity processes with the rest of your application estate without introducing more complexity?

That is where the ongoing work between Microsoft Entra and SAP can help. Over the past several years, we have continued to expand integration points that help organizations automate lifecycle changes, apply access policies more consistently, and strengthen governance across SAP and non-SAP applications.

If you are transitioning from SAP Identity Management (SAP IDM), modernizing an existing SAP identity architecture, or looking for better access governance across business-critical systems, the latest integrations in Microsoft Entra can help.

In this post, I’ll highlight what’s new, recap the key integration points, and explain how these capabilities can support your identity modernization journey.

What’s new in Microsoft Entra and SAP integrations

Over the past two years, Microsoft Entra and SAP have continued to deepen interoperability and support more deployment models. Key updates include:

More flexible provisioning patterns between Microsoft Entra and SAP Cloud Identity Services
Support for custom extension attributes on Microsoft Entra users for SAP-specific scenarios
Account discovery to identify accounts in SAP Cloud Identity Services that are not yet correlated with users in Microsoft Entra
OAuth 2.0 client credentials support to secure service-to-service communication between Microsoft Entra and SAP Cloud Identity Services
Integration between Microsoft Entra ID Governance and SAP Identity Access Governance (SAP Identity Access Governance), so organizations can request and govern SAP business roles alongside other access rights

Together, these capabilities help organizations create a more unified identity control plane across SAP and the rest of the enterprise.

“This partnership brings together the best of both worlds: Microsoft Entra’s identity-first foundation and SAP Access Governance’s (SAP Identity Access Governance and SAP Access Control) deep business and access risk context, enriched with AI to transform access governance into a continuous, intelligent trust model.”

Swetta Singh, Strategic Product Manager for Access Governance solutions, SAP

A centralized identity control plane for SAP and beyond

Microsoft Entra provides a centralized identity layer that integrates with SAP applications and platforms. With it, organizations can automate joiner, mover, and leaver processes, apply access policies more consistently, and strengthen governance across a broader set of systems.

That kind of consistency matters in complex environments. For example, Cenibra used Microsoft Entra ID Governance to modernize identity management across more than 80 systems, including SAP as a core platform. That approach helped reduce manual work, improve audit readiness, and create a more scalable foundation for managing access.

SAP Cloud Identity Services: More flexible provisioning

SAP Cloud Identity Services centralizes authentication and provisioning across SAP applications. It provides single sign-on and helps organizations provision users and groups more consistently to downstream SAP systems.

The latest integration improvements with Microsoft Entra give organizations more flexibility in synchronizing users and groups across both environments through standards-based approaches. This flexibility helps teams maintain consistent identity data between Microsoft Entra and SAP environments while using SAP Cloud Identity Services to distribute identities to downstream cloud-hosted and on-premises SAP applications.

Some of the recent updates include:

Custom extension attributes for SAP-specific scenarios

Many SAP environments depend on attributes tied to business processes, regions, or organizational structures. Microsoft Entra now supports provisioning custom extension attributes on users in those scenarios, making it easier to align identity data with the needs of SAP applications.

Account discovery for SAP Cloud Identity Services

Microsoft Entra account discovery retrieves accounts from SAP Cloud Identity Services so you can identify accounts that are not yet correlated with users in Microsoft Entra. This visibility can help teams reduce manual investigation and strengthen governance.

OAuth 2.0 client credentials for connector authentication

We have also updated connector authentication to use OAuth 2.0 client credentials. This change helps secure service-to-service communication between Microsoft Entra and SAP Cloud Identity Services and supports a more modern integration approach.

SAP Identity Access Governance integration

SAP Identity Access Governance is SAP’s cloud-based access governance solution. The integration between Microsoft Entra ID Governance and SAP Identity Access Governance connects SAP role governance to a broader access strategy, allowing users to request or receive SAP business roles through Microsoft Entra access packages alongside non-SAP access rights.

This integration matters because access governance often spans applications: employees, contractors, and partners may need coordinated access across SAP and non-SAP resources. Organizations can use the integration to manage those requests consistently across applications.

When a user requests assignment to an access package with an SAP business role through Microsoft Entra, the request is sent automatically to SAP Identity Access Governance. SAP Identity Access Governance then enforces approvals and additional checks within its own governance process. This approach helps organizations connect enterprise-wide access packages in Microsoft Entra with the business role and risk context available in SAP Identity Access Governance.

Microsoft Entra integrates with SAP Cloud Identity Services and SAP Identity Access Governance to support authentication, user provisioning, and identity governance across SAP applications.

Migration projects move faster with the right partner support

A successful transition from legacy IAM products such as SAP IDM often depends on practical experience across both SAP environments and enterprise identity platforms. Many organizations work with partners who can support SAP system integration, Microsoft Entra identity and governance capabilities, and identity strategies that connect SAP with the rest of the application estate.

If you are planning a migration and want to involve a partner, review the partner list in Migrate identity management scenarios from SAP IDM to Microsoft Entra.

Beyond identity: Microsoft Security for SAP

Identity establishes the foundation for securing SAP in your security environment. In addition to Microsoft Entra, Microsoft delivers SAP-aware capabilities aligned with the NIST Cybersecurity Framework:

Identify: Microsoft Purview discovers and classifies sensitive SAP data—including data mirrored into Microsoft Fabric through SAP Datasphere—helping organizations apply more consistent data security policies.
Protect: Microsoft Defender safeguards the endpoints, servers, and cloud resources surrounding SAP applications with continuous, adaptive controls.
Detect: Microsoft Sentinel connects SAP signals across your estate to detect incidents, with built-in analytics rules in an SAP-certified solution that cover known threats. Through strategic partnership with SAP, organizations can also incorporate security telemetry from SAP Enterprise Threat Detection (ETD) and SAP LogServ, providing broader visibility into SAP-specific threats and activities alongside the rest of the enterprise security estate.
Respond: Microsoft Security Copilot accelerates investigation and guides response, helping teams contain SAP incidents faster.

Together with the identity investments described above, these capabilities advance an identity-first Zero Trust strategy across the SAP environment. Microsoft uses these same capabilities across its global SAP estate.

Get started

If you are evaluating your SAP identity strategy, now is a good time to review how your current architecture maps to the latest integration options in Microsoft Entra.

Start with these resources:

As always, I would love to hear about your SAP identity modernization journey and the topics you would like us to cover next.

Thanks for reading,

Mark Wahl
Product Architect, Microsoft Entra
Mark Wahl | LinkedIn

Additional resources

Learn more about Microsoft Entra

Microsoft Entra ID enhances security of branded sign-ins

Adam Steenwyk — Tue, 21 Jul 2026 17:58:43 GMT

To align with Microsoft’s Secure Future Initiative and its focus on identity security and phishing resistance, we’re evolving Microsoft Entra custom branding to help customers deliver sign-in experiences that are more secure, reliable, and consistent.

Beginning October 26, 2026, Microsoft Entra will retire support for custom CSS positioning properties used in custom branding. Full retirement of all custom CSS is planned for later in 2027. Microsoft will provide advance notice ahead of this milestone, along with alternative customization options.

These changes add an additional layer of security by reducing opportunities for deceptive page layouts and helping ensure trusted, recognizable sign-in experiences that better protect users from phishing attacks.

When will this happen?

July 21, 2026: Microsoft Entra ID tenants not using custom CSS positioning properties before July 21, 2026, will not be able to configure them going forward.
October 26, 2026: Microsoft Entra ID will retire custom CSS positioning properties globally.
Later in 2027: Microsoft Entra plans to move towards full custom CSS retirement, with advance notice provided.

Who will be affected?

To retire support for positioning properties, Microsoft is helping prevent tenants from creating new dependencies on custom CSS:

Tenants that will be affected and need to take action by October 26, 2026:
- Microsoft Entra ID tenants that already use custom CSS positioning properties. After this date, these properties will be blocked and will no longer function.
Tenants that are not affected:
- Microsoft Entra ID tenants that do not already use custom CSS positioning properties will not be able to configure them after July 21, 2026.
- New Microsoft Entra ID tenants created after January 5, 2026, do not have custom CSS available for custom branding.
- Microsoft Entra External ID tenants.

How will this affect your organization?

Microsoft Entra ID customers using the deprecated positioning properties may see changes to the layout of their branded sign-in experience after October 26, 2026, and won’t have a supported migration or replacement. In most cases, branding elements such as logos, images, or text will remain visible but will appear in their default state once the positioning properties are no longer honored.

If your Microsoft Entra ID tenant uses any of these custom CSS positioning properties below in either Company Branding or Branding Themes , we recommend removing them from your configuration:

position (including top, right, bottom, left, and z-index)
margin (including margin-top, margin-bottom, margin-left, and margin-right)
transform
opacity
overflow
filter
pointer-events
clip-path
mix-blend-mode
translate

Microsoft Entra ID customers who use the properties above will be notified directly in advance.

What do you need to do to prepare?

To determine whether your tenant uses positioning properties and requires you to take action:

Make sure you use a global administrator or branding administrator role.
Navigate to MS Graph Explorer
Sign in into your tenant using the 'profile/sign in' button at the top right corner.

If you have your tenantID, skip to step 5. Otherwise, you can get this by sending a GET request to the organization resource on the MS Graph Explorer. To do this, enter https://graph.microsoft.com/v1.0/organization and run the query. Then, copy the “id” value of the response.
Get all the configured company branding locales by sending a GET request to the branding resource. To do this, enter https://graph.microsoft.com/v1.0/organization/<your tenant ID here>/branding/localizations and run the query.

Copy the contents of the response or export it to a JSON file
Navigate to this tool
Paste the contents from step 6 or upload the exported JSON file to the input in the tool. You should get a list of locales and the properties impacted for each locale. These properties will be deprecated and are encouraged to be removed from your configuration.

Next steps

With these updates, Microsoft Entra custom branding continues to evolve as part of our proactive investment in secure, trusted, and consistent sign-in experiences.

To ensure a smooth transition, we encourage you to review your custom CSS configurations and remove any affected properties ahead of time. This will help you catch and address potential layout issues early, so your users stay protected and your branded sign-in experience remains seamless.

We’ll provide advance notice, guidance, and alternative customization options before broader custom CSS retirement. Thank you for your partnership as we make this transition.

-Adam Steenwyk

Principal Lead Product Manager, Microsoft Identity, Authentication Experiences

Additional resources

Learn more about Microsoft Entra

Prevent identity attacks, ensure least-privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and cloud environments.

Secure AI, web, and private apps with Zero Trust

Sinead_ODonovan — Tue, 21 Jul 2026 05:13:32 GMT

Today's threats don't respect boundaries. As AI agents proliferate across enterprise workflows, employees work from everywhere, and organizations adopt cloud-first architectures, the attack surface has fundamentally shifted. Traditional perimeter security can no longer keep pace with how work actually happens.

Microsoft Entra Internet Access and Microsoft Entra Private Access extend Zero Trust principles to all traffic, ensuring that every access request is verified against identity, device, and risk context, whether it originates from a user, a device, or an AI agent.

Today, we're building on our recent announcement, where we introduced a significant wave of new capabilities across both public preview and general availability. These updates span AI security, data protection, private access, and connectivity resilience, bringing the breadth of our SASE platform to meet the security demands of the AI era.

Now in public preview: deeper controls for AI, data, and access

Microsoft Entra Internet Access and Microsoft Entra Private Access

This July, we’re introducing new capabilities in public preview to help you secure AI interactions, protect sensitive data, strengthen access controls, and improve operational resilience—all through an identity-first approach to security. These capabilities bring deeper visibility and policy enforcement across users, AI agents, devices, locations, and applications, helping you innovate with confidence while maintaining Zero Trust principles.

Network Data Loss Protection (DLP) extends Microsoft Purview data security to the network layer with Microsoft Entra Internet Access. Discover sensitive content in risky AI and cloud apps, block unsafe sharing (including file uploads, prompts, and responses), and apply context-aware controls based on identity and activity.
Microsoft Entra network controls are now available for agents, including Microsoft Copilot Studio agents and those running on user endpoint devices, and local agents such as OpenClaw. These controls can help identify unsanctioned AI usage, restrict connections to only approved web destinations, filter risky file movement, and help block malicious prompt-based attacks before they lead to harmful actions.
Custom Acquire and Agentic Acquire on Entra Internet Access traffic profile enables side by side deployment of Global Secure Access for AI Gateway and Agentic scenarios with other vendors.
Windows 365 for Agents integrates with Global Secure Access platform to provide enterprise-grade network security to agentic Cloud PCs with traffic monitoring, web filtering and threat blocking on agentic sessions.

Figure 1: Demo of Network data security

See the full demo here.

Now generally available: broader coverage and stronger controls for users, applications, and AI

As secure access becomes foundational to every AI, cloud, and hybrid work initiative, organizations need solutions that are both powerful and operationally simple. The latest generally available capabilities for Microsoft Entra Internet Access and Microsoft Entra Private Access help organizations accelerate Zero Trust adoption, extend protection to unmanaged and remote environments, and gain greater visibility into how users, applications, and AI services interact with enterprise resources. The following capabilities are now GA and ready for organizations to deploy:

Browser-based access to internet resources for Microsoft Entra Internet Access extends secure web access to kiosk and BYOD devices using PAC file-based proxy configuration.
BYOD with Client in Microsoft Entra Private Access lets you enforce Zero Trust for unmanaged devices, so employees and contractors can securely access private apps without compromising security or user experience.
Shadow MCP Visibility provides advanced monitoring and analysis capabilities for MCP traffic between client MCP on devices and remote MCP servers. This feature provides thorough visibility into which MCP servers are being used, what tools and resources they expose, and how those tools are invoked.

Want to Learn More?

Join our three-part webinar series, Securing Data and Access in the Era of AI (July 21–23, 9:00 AM PDT), where Microsoft Entra and Microsoft Purview product leaders will share practical guidance for securing data, governing access, and scaling AI adoption with confidence. Save the dates and register to attend.

-Sinead O’Donovan | VP of Product Management, Identity and Network Access

Sinead O'Donovan | LinkedIn

Additional resources

Learn more about Microsoft Entra

Plan your Azure AD B2C migration with the Migration Policy Analyzer

NamitaSingh — Mon, 20 Jul 2026 17:18:24 GMT

Migration planning starts with visibility

One of the first challenges organizations face when planning a migration from Azure AD B2C to Microsoft Entra External ID is understanding exactly what is implemented in their tenant today.

Over time, Azure AD B2C deployments often grow to include custom user journeys, federation integrations, claims transformations, API connections, and tailored sign-up and sign-in experiences. As teams change and solutions evolve, assessing migration scope can become time-consuming and complex.

To help organizations accelerate migration planning, the Migration Policy Analyzer is now Generally Available (GA). This capability analyzes your Azure AD B2C custom policies and generates a structured assessment of the authentication features implemented, reducing the manual effort and guesswork that typically slow down early migration planning.

The resulting report helps architects and technical decision-makers understand migration readiness, identify implementation gaps, and prioritize next steps.

Understand your current implementation

Available through the Identity Experience Framework experience in Azure AD B2C, Migration Policy Analyzer performs a deterministic analysis of custom policy definitions. It is important to note that the analysis is scoped to the Azure AD B2C custom policies within IEF; it is not a full tenant-wide scan and produces an inventory of the authentication capabilities implemented in those policies.

The assessment provides guidance on:

Authentication features detected in custom policies
Migration paths to Microsoft Entra External ID
Scenarios that may require custom development
Areas where an alternative architectural approach may be recommended

Rather than manually reviewing policy files, teams receive a structured assessment that can serve as a starting point for migration planning and technical discovery.

Generate a migration assessment in three steps

Getting started requires no policy modifications or additional configuration:

Open the Identity Experience Framework in your Azure AD B2C tenant.
Select a policy and click on Analyze policy to begin policy analysis.
Review and download the generated migration assessment report.

The analyzer scans your custom policy definitions and produces a report that can be shared across engineering, architecture, and business stakeholders.

See Migration Policy Analyzer in action

Migration Policy Analyzer analyzes Azure AD B2C custom policies and generates a migration assessment to help organizations plan their move to Microsoft Entra External ID.

The Migration Policy Analyzer analyzes Azure AD B2C custom policies and generates a migration assessment to help organizations plan their move to Microsoft Entra External ID.

Understand migration readiness

Each detected capability is categorized to help organizations evaluate migration complexity and planning requirements:

Available - Capabilities that can be implemented using existing Microsoft Entra External ID functionality, including common sign-up and sign-in experiences, federation scenarios, verification workflows, and account recovery experiences.
Requires Custom Development - Capabilities that may require extensibility mechanisms, API integrations, partner-developed solutions, or additional application logic.
Architecture Change Recommended- Scenarios that may be better served by a different implementation pattern in Microsoft Entra External ID.
Not Currently Supported- Capabilities that do not currently have a direct implementation path and may require alternative approaches or future evaluation.

For example, a policy that combines social identity federation, REST API claims enrichment, and a custom password reset flow might be categorized as Available for the federation and password reset experiences and Requires Custom Development for the REST API claims enrichment, giving you an immediate sense of where effort will be concentrated.

For each finding, the report provides migration guidance and recommended next steps to support planning discussions.

Turn discovery into a migration plan

The value of the Migration Policy Analyzer extends beyond identifying features; it helps you move from discovery to an actionable plan while reducing migration risk and effort. With a categorized inventory in hand, teams can:

Estimate migration scope and effort
Prioritize proof-of-concept activities
Highlight areas requiring redesign or additional development
Build a phased migration strategy

By establishing a shared understanding of the current state, architects, developers, and business stakeholders can align on migration priorities before implementation begins.

Get started

If you are evaluating a transition from Azure AD B2C to Microsoft Entra External ID, migration planning starts with understanding what is deployed today.

Use the Migration Policy Analyzer to:

Generate an inventory of custom policy capabilities
Understand migration readiness
Identify scenarios requiring additional planning
Evaluate areas that may require redesign or custom development
Begin building your migration strategy

Open your Azure AD B2C tenant, navigate to Identity Experience Framework, and run an analysis to generate your migration assessment. In minutes, you'll have the visibility needed to move from assessment to action, with less manual effort and lower migration risk.

The Migration Policy Analyzer provides the visibility needed to move from assessment to action.

-Namita Singh

Additional resources

Learn more about Microsoft Entra

AI agents are everywhere. Are your access controls ready?

Kaitlin_Murphy — Wed, 15 Jul 2026 18:16:41 GMT

At Identiverse 2026, Microsoft Security hosted a Power Breakfast that brought together 150 identity professionals across 10 simultaneous roundtable discussions. Participants came from industries including financial services, healthcare, government, and energy, and represented every stage of AI adoption.

We asked participants what they’ve built to secure agents, what they’ve rolled back, and where control is breaking down.

“The pace has been crazy fast. We have thousands of agents. Most of them are unmanaged.”

Roundtable participant, Identiverse 2026

What your peers are saying about securing agents

Agent sprawl is already here and bigger than most teams realize

Nine in 10 roundtables described unmanaged agent sprawl not as a future risk, but as a present reality. What started as dozens of agents became tens of thousands in months or even weeks. No single audit could capture the full picture. Practitioners described discovering the true number by accident, often finding far more than they expected: “I was doing a demo one day, I looked at our corporate tenant, and we had like 44,000 agents. I just couldn’t believe it, after so little time.”

Agents are proliferating across every cloud, SaaS platform, and vendor environment simultaneously

Nine in 10 roundtables reported agents running across SaaS, multicloud, and third-party environments with no governance visibility. Eight in 10 said shadow AI is already present in their organizations, running across platforms that no single governance layer currently covers and tracked only through network logs, if tracked at all. The challenge isn’t unique to any one platform: every SaaS vendor is now shipping with an agent, every cloud provider has a builder framework, and every team has a developer standing up something new.

“When everybody has a single pane of glass, nobody has a single pane of glass.”

Roundtable participant, Identiverse 2026

Assigning human ownership to agents becomes complex when people change roles or leave organizations

Nine in 10 roundtables raised the ownerless-agents problem. Agents get built, tied to their creator’s identity, and keep running long after that person has changed roles or left the organization—unreviewed, over-permissioned, and undetected. This results in agents with no clear accountability, stale permissions, and no obvious path for review, reassignment, or decommissioning.

Agent-to-agent interactions are where control fails hardest

Eight in 10 roundtables identified agent-to-agent chains as the most difficult security challenge they had encountered. Multiple teams rolled back agent-to-agent deployments after finding they could not maintain consistent governance across the chain.

“I can control point A to point B, but point B needs to talk to point C, and that’s where context was lost. I can control permissions. I can control authentication. I do not know how to control the impact.”

Roundtable participant, Identiverse 2026

How Microsoft Entra Agent ID can help

Microsoft Entra Agent ID is the identity foundation for every AI agent, and it’s where your control starts. Every governance, access, and lifecycle decision flows through agent identity. Without it, none of the controls below are possible. Microsoft Agent 365 builds on that foundation as the unified control plane, giving IT and security teams a single place to see and act on every agent across the organization.

If you have similar pain points around managing agents, here are three actionable starting points for securing them:

1. Build your inventory before you do anything else

You cannot govern what you cannot see. Start here.

The Microsoft Entra admin center shows every agent identity in your tenant across Copilot Studio, Microsoft Foundry, and third-party platforms in one view. Start in Microsoft Entra ID > Agents > Agents overview to get a full picture of the total number of agents with identities, how many were recently created, how many are active, and how many are unmanaged. Then go to Microsoft Entra ID > Agents > Agent identities and run your first audit. Agents without an Agent ID appear as classic agents with no governance controls attached. That list is your backlog and needs to be addressed right away to prevent sprawl.

For agents running outside the Microsoft ecosystem, register them using the Agent 365 CLI and SDK or federated identity credentials. You do not need to migrate them; you need to get them into the registry so they are visible and can be governed.

For third-party agents, running the Agent 365 SDK assigns each agent an agent identity blueprint, an agent identity, and a sponsor from the start, helping ensure that agents are trackable and more secure. A blueprint is a template that defines permissions, policies, and metadata for every agent instance created from it. It provides centralized control, allowing you to manage or disable agents created from it at scale. Skipping blueprints and creating agents as ad hoc service principals is how you end up with the sprawl the roundtable participants described.

2. Assign an owner and a sponsor to every agent, then automate what happens when they leave

The orphaned-agent problem practitioners described has a direct solution. Every agent identity in Microsoft Entra Agent ID requires a sponsor (the person accountable for what the agent does) and an owner (the person responsible for its technical management). Assign both at creation time, at the blueprint layer. If you have existing agents with neither, start there.

When someone leaves your organization, Microsoft Entra lifecycle workflows can automatically trigger an ownership review for every agent associated with that person. You define the escalation path and the window: reassign, pause, or decommission. This replaces the manual scripts your team has been running for service accounts.

Set up recurring access reviews for agent identities. Scope them to surface active permissions, usage signals, and business justification—not just whether the agent still exists. Agents that cannot be justified should be decommissioned, not left running.Best practices for Microsoft Entra Agent ID
Govern agent identities and lifecycle
Lifecycle Workflows overview
Access reviews for agents overview

3. Scope permissions tightly, and apply Conditional Access and RBAC at the blueprint level

Start with enumerated scopes on every blueprint: only the specific delegated permissions the agent needs, nothing more. This is not optional. Agents do not self-restrict.

“An agent doesn’t self-restrict. It’s going to do whatever it feels like it needs to do.”

Roundtable participant, Identiverse 2026

For agents acting on behalf of a user, use the on-behalf-of flow so that user-level access policies apply. For autonomous agents, use the client credentials flow, scoped narrowly. Do not grant application-level permissions when delegated permissions accomplish the same task.

Apply Conditional Access policies at the blueprint level, not agent by agent. Every agent instance created from that blueprint inherits the policy automatically. This is how you extend Zero Trust controls from your workforce to your agents. Next, Microsoft Entra ID Protection analyzes agent behavior to detect anomalies such as unusual access patterns, spikes in activity, or interactions with unfamiliar resources. When an agent is flagged as risky, those signals automatically trigger Conditional Access policies to block or restrict access in real time, moving you from static policies to adaptive protection.

Lastly, turn on sign-in and audit logs in the Microsoft Entra admin center. Agent-initiated events are flagged separately from human-initiated ones. This is your baseline for detecting unauthorized access and demonstrating compliance.

If you have had a similar experience, please share your learnings in the comments!

Kaitlin Murphy

Senior Director, Identity and Network Access Product Marketing

Additional resources

Learn more about Microsoft Entra

Govern AI agent identities and access the same way you govern your employees

chiragdayani — Tue, 07 Jul 2026 21:34:53 GMT

In our conversations with customers, we’ve heard consistent feedback: organizations want to embrace AI agents, but they need the same governance rigor they apply to human identities—adapted for the speed and scale of AI. As agents take on real work, the critical question becomes: how do you give each agent the access it needs to be productive without letting that access become a risk?

For example, an agent tasked with analyzing purchase trends and delivering a report needs the ability to read transaction data from an ERP system. Historically, agents may have used shared credentials or access rights borrowed from an employee. As AI adoption grows, organizations are increasingly adopting dedicated agent identities that provide clearer ownership, accountability, and governance. This gives each agent a distinct identity with a named human sponsor and governed access, while providing enterprise security and lifecycle management.

With a distinct identity for each agent, ownership becomes clear, organizations gain visibility into each agent’s access, and access does not accumulate over time. Knowing which agent has what access, who is responsible for it, and whether that access is appropriate is foundational to secure and govern agents—just as it is for your human workforce.

Microsoft Entra surfaces agent identity governance capabilities that are generally available as part of Microsoft Agent 365.

New challenges for governing agent access

Traditional software is relatively static. Once deployed, its capabilities and permissions don’t change without a deliberate software update. Agents are fundamentally different; their capabilities evolve over time, and each new capability represents a change in the agent’s access footprint. This constant evolution means their access needs to change too, and without governance, that access compounds organizational risk.

As organizations scale their AI agent deployments, security and IT teams are facing new challenges that traditional identity governance wasn’t designed for:

Overprivileged access: Agents often receive access at runtime, accumulate access over time, and retain it indefinitely, multiplying security risk across the organization.
No human accountability: When an agent acts autonomously, who is accountable for it? Without clear accountability, no person is responsible for its access or lifecycle.
Manual lifecycle management policies don’t scale: Organizations managing hundreds or thousands of agents across multiple platforms need consistent access governance policies that admins can manage at scale. They can’t rely on manual processes to track sponsors or determine which agent identities and access assignments are still needed.

Govern agent identity and access with Microsoft Entra Agent ID

Microsoft Entra Agent ID enables organizations to govern agent identities and access at scale throughout the agent lifecycle. For example, an agent identity should follow the below identity and access lifecycle process:

Figure 1: Agent identity and access lifecycle.

Govern access for agents with Microsoft Entra access packages

Access packages, a capability within Microsoft Entra Entitlement Management, brings structure and accountability to the entire access lifecycle for agent identities. Organizations can provide access policies that governs how access is requested, approved, and scoped in the first place, and ensures access is reviewed and expires when it's no longer needed. The result is access that's intentional, right-sized, time-bound, and easy to prove in an audit, without slowing teams down. This applies to both assistive agents that require delegated OAuth permissions to act on behalf of users and autonomous agents that operate independently with their own application roles and permissions.

By managing access assignments through access packages, you can:

Scale efficiently when many agents need similar access rights
Delegate approvals to the right decision-makers—application owners, compliance teams, or business stakeholders—for high-risk or compliance-sensitive access
Time-limit access assignments so agents don’t retain access indefinitely

Now consider a scenario where a DevOps agent needs access to certain OAuth permissions. An admin creates an access package policy scoped to agents, with approvals and access expiration settings, so its sponsor can request access on behalf of the agent identity:

Figure 2: Admin experience with access package policy for agents.

Sponsors from across your organization, who don’t need to be IT admins, can use the My Access portal to submit the access request on behalf of the agent identity. The request goes through an approval flow before time-limited access is assigned.

Figure 3: Sponsor experience for requesting an access package on behalf of an agent.

Additionally, Microsoft 365 administrators can use custom policy templates that leverage Microsoft Entra access packages, providing a streamlined experience for governing agent access during onboarding. The AI admin in Microsoft Agent 365 can request Microsoft Entra access packages through Microsoft Agent 365 policy templates. This ensures an agent’s access is secure from day one with approval flows and access expiration, so that the access does not persist longer than needed.

Figure 4: The Agent 365 template to apply access package policy during agent onboarding.

Hold every agent accountable with a named sponsor

Every agent identity and agent identity blueprint in Microsoft Entra can have a designated sponsor—a person accountable for that agent’s access and lifecycle. You can learn more about sponsor responsibilities here.

Agent sponsors provide the human accountability needed to govern agent identities at enterprise scale. By assigning sponsors, organizations can:

Establish clear ownership for every agent identity
Enable business stakeholders, not just IT administrators, to participate in governance decisions
Ensure a responsible person reviews and requests access on behalf of the agent
Empower sponsors to make lifecycle decisions for agent identities, including renewing, extending, or removing agent identities based on ongoing business need
Provide a designated contact for audit, compliance and security reviews
Reduce the risk of orphaned and unmanaged agent identities

Figure 5: Owners and Sponsors of agent identities

Automate the agent lifecycle with Lifecycle Workflows

With Microsoft Entra Lifecycle Workflows, you can add tasks for agent sponsors to your workflows so that as employees change roles, Microsoft Entra automatically:

Notifies the manager and co-sponsors when an agent’s sponsor moves or leaves, helping ensure no agent is left without accountability
Transfers sponsorship automatically to a co-worker or manager, so there’s always a human accountable for every agent, even during organizational transitions

Figure 6: Lifecycle Workflows automate sponsor maintenance when sponsors move or leave.

Sponsors can then see a list of agent identities they are responsible for and take lifecycle actions, such as disabling agent identities when they are no longer needed.

Figure 7: The Manage Agents end-user experience enables sponsors to make lifecycle decisions.

The path forward

Organizations benefit most from AI agents when governance is an enabler, not an afterthought—with guardrails in place from the moment an agent is onboarded. The agentic era extends identity governance to a new class of non-human identities that are more dynamic and numerous than the service accounts of the past. The principles stay the same—least privilege, accountability, lifecycle management, and continuous governance—but the mechanisms must evolve to match the speed and scale of agentic AI.

Get started

Ready to bring your AI agents under control with Microsoft Entra ID Governance for agent identities? Explore Microsoft Agent 365 to start a trial and see how you can observe, govern, and secure agents across your organization.

Chirag Dayani
Sr Product Manager, Microsoft Entra Identity and Access Management
Connect on LinkedIn

Mark Wahl
Principal Product Architect
Connect on LinkedIn

Additional resources

Learn more about Microsoft Entra

Bring business logic into PIM role activation workflows

Kaitlin_Murphy — Wed, 01 Jul 2026 16:35:45 GMT

Privileged access often depends on business context that lives outside Privileged identity Management (PIM)—ticket validity, HR status, compliance checks, or on-call schedules. With custom extensions for Microsoft Entra Privileged Identity Management, organizations can bring that context directly into activation workflows.

We’re excited to announce the preview of custom extensions for Microsoft Entra Privileged Identity Management (PIM), a powerful new capability that lets you integrate your organization’s business logic directly into PIM role activation workflows.

The challenge

Many organizations need governance controls that go beyond what PIM offers natively. While PIM already supports MFA, justification, and approval workflows, organizations also often want to:

Validate ticket numbers against an ITSM system
Enforce HR-based access rules, such as employment status
Integrate compliance or audit workflows before granting activation
Apply dynamic approval logic based on the specific context of a request

Until now, these validations required manual processes outside of PIM, which can create gaps in enforcement and auditability.

Introducing PIM custom extensions

With custom extensions, PIM can now call your REST API during role activation. Your API evaluates the request against your business rules and returns a decision that PIM enforces automatically.

How it works:

A user requests role activation in PIM.
PIM sends a structured request payload to your custom extension API, including details like principalId, roleDefinitionId, justification, ticketInfo, and scheduleInfo.
Your API applies your business logic and validates the ticket, checks HR status, or runs compliance checks.
Your API returns a decision—Approved, AutoApproved, or Denied—along with a reason.
PIM enforces the decision and logs the interaction for audit.

Supported scope

In this preview, custom extensions support:

PIM for Groups
PIM for Microsoft Entra roles
PIM for Azure resources

The extension is invoked synchronously during the activation workflow (pre-approval stage), enabling real-time decisioning.

Audit and traceability

Every extension interaction is fully auditable. Each response includes an evaluationId, evaluationOutcome, and reason, giving you end-to-end traceability for compliance reviews and security investigations.

Get started

Setting up PIM custom extensions involves five steps:

Create a new custom extension API — a REST API (HTTP POST) that implements your business logic.
Secure the API with Microsoft Entra ID — register an app and implement token validation.
Onboard the extension in PIM — use Microsoft Graph API to create the custom extension object.
Link the extension to role settings — enable Require pre-approval custom extension in PIM role settings.
Activate and validate — test the end-to-end flow by activating a role.

Example scenarios

Scenario	Extension logic
Ticket validation	Verify that the ticket ID is valid and assigned to the requester
HR compliance gate	Confirm that the requester meets the required criteria
Auto-approval for on-call	Auto-approve activation for users who are currently on call
Deny after hours	Deny activation outside approved maintenance windows

What's next

Microsoft Entra ID Governance helps you protect, monitor, and audit access to critical assets while ensuring employee productivity. It gives you the ability to ensure the right people have the right access to the right resources with the right controls—preventing identity attacks, enforcing least privilege access, and unifying access control across your environment.

We’re continuing to enhance custom extensions, and your feedback during this preview will shape the future of extensible governance in Microsoft Entra. We recommend enabling PIM custom extensions end-to-end and sharing your feedback here.

-Kaitlin Murphy

Senior Director, Product Marketing

Kaitlin Murphy | LinkedIn

Additional resources

Learn more about Microsoft Entra

Protect sensitive data in motion across SaaS and AI apps with Microsoft Purview and Microsoft Entra

SuleTatar — Wed, 01 Jul 2026 16:32:24 GMT

Once, securing data meant protecting them within the confines of endpoints and managed apps. It lived inside boundaries you controlled. Today, those boundaries have disappeared—and with them, the old playbook for data security.

Data security must keep up with how data moves in the AI-era

Organizational data now travels constantly between trusted endpoints and unmanaged web apps, SaaS apps, and most critically, generative AI tools over the network. Employees type and paste sensitive information into prompts, upload work-related files to external services or personal cloud storage, and interact with systems that sit entirely outside the traditional enterprise perimeter. AI has expanded the risk surface for potential enterprise data loss.

Traditional data loss prevention (DLP) approaches lack real-time visibility and enforcement, often flagging incidents after data has already left the organization. In other cases, vendors rely heavily on physical network appliances that are complex and expensive to deploy, or compute-intensive resources that can add latency. In the era of AI, that model breaks down quickly.

Enabling real-time data protection for how work happens

To address this shift, we’re announcing the extension of data security to the network layer, powered by Microsoft Purview and Microsoft Entra, now in public preview.

This integration brings together data context and identity-aware enforcement to help protect sensitive data in transit, in real-time:

Detect how sensitive data is shared to shadow AI tools, unmanaged SaaS apps, and personal cloud repositories.
Help block or limit data exposure in real-time based on identity, user activity, and data context.
Unify investigation workflows by correlating identity, data, and insider risk signals across Microsoft Purview, Microsoft Entra, and Microsoft Defender.

By combining Microsoft Purview data classification, DLP policies, and insider risk detection with identity-aware enforcement at the network layer through Microsoft Entra, organizations can dynamically apply protections based on:

The sensitivity of the data
Who the user is
How that user has interacted with sensitive data over time

Together, these capabilities help protect data in motion across browser sessions, SaaS usage, and AI interactions (including prompts and responses), all at the speed and scale that today’s work demands. The result is a more complete, consistent approach to data protection that follows the data instead of relying on fixed, at-rest controls.

What this changes in practice

With network-level visibility and enforcement, security teams can finally understand how sensitive data is moving across unmanaged SaaS and AI apps, not just within Microsoft applications or endpoint devices.

Prevent employees from sharing proprietary or sensitive organizational data to potentially risky locations such as consumer AI apps.

That includes scenarios that have historically been difficult to see and protect, including:

Text that’s inputted directly into unmanaged apps and email services, such as prompts and responses
Files that are uploaded to personal cloud storage repositories
Files and text that could be scanned and processed by unsanctioned plugins or add-ins
Files and text that are shared outside of a managed browser session

See the full demo here.

Most importantly, protection preempts data leakage. Instead of relying on downstream detection, organizations can detect and block sensitive data in transit before it’s exposed. Because enforcement is tied to identity and user context, policies can adapt based on risk without introducing unnecessary friction for end users.

Underneath, this is powered by a unified policy model, where the classification and protection policies defined in Microsoft Purview for the rest of your data estate are also enforced consistently at the network layer through Microsoft Entra. This reduces the need to juggle multiple point solutions to secure data holistically across your environment.

A shift to real-time data protection

This shift reflects a broader transformation in how data and network security teams must operate.

Traditional approaches rely on static boundaries and after-the-fact controls. That model breaks down when data is continuously exchanged across SaaS apps and AI systems.

Data protection now needs to operate in real-time and in the flow of user activity.

Network data security – now available in Microsoft 365 E7* – plays a critical role in enabling this shift by extending enforcement beyond endpoints and applications to the network itself, helping protect data wherever it moves.

Learn more

As organizations adopt AI at scale, securing data and access during AI and agent use becomes mission-critical.

Join our three-part webinar series, Securing Data and Access in the Era of AI, to see how Microsoft Entra and Microsoft Microsoft Purview help protect data, govern access, and reduce risk across your AI journey.

Register for the webinar series: Securing data and access in the era of AI with Microsoft Entra and Microsoft Purview

See it in action.

Sule Tatar, Senior Product Marketing Manager, SCI Identity

-Vivian Ma, Senior Product Marketing Manager, Microsoft Purview Data Security

Vivian Ma | LinkedIn

*Network data security capabilities are also available to customers with both a Purview ME5 (or equivalent) and Entra Internet Access (or equivalent) license.

Learn more about Microsoft Microsoft Purview

Dynamically secure your data with an integrated approach across your multi-structured data estate, devices, and generative AI apps and agents.

Learn more about Microsoft Entra

Microsoft Entra Backup and Recovery is now generally available

CindyCrane — Tue, 30 Jun 2026 18:27:57 GMT

Microsoft Entra Backup and Recovery is now generally available. Microsoft Entra customers licensed for Entra ID P1 or P2 now can restore supported critical identity data after accidental changes or malicious updates, rolling out to all workforce tenants this week.

Identity resilience and disaster recovery are top challenges for IT teams. Microsoft Entra Backup and Recovery helps address both by automatically backing up core directory objects daily. Supported objects include users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, and authentication and authorization policy, helping administrators return their environment to a previously known‑good state.

Microsoft Entra Backup and Recovery is a built-in backup and recovery solution that lets you recover critical Microsoft Entra directory objects to a previously known good state after accidental changes or security compromises. The overview dashboard highlights alerts, recent backups, difference reports, and protected actions.

Get started today with the built-in backup and recovery solution in Microsoft Entra | Microsoft Learn

What's changed since public preview?

Based on feedback from the Backup and Recovery public preview, we’ve increased the retention period for supported directory objects from 5 days to 7 days to provide extended protection.

Identity admins now have more flexibility when viewing available snapshots, generating difference reports to understand what changed, and running recovery jobs to restore objects to a prior state. These capabilities help teams quickly assess what changed and take action to return to a known good state.

But recovery is not just about restoring objects. It’s about being prepared to return your tenant to a known‑good state under pressure. Entra Backup and Recovery fits into a broader tenant recoverability strategy so you can reduce disruption, respond to common recovery scenarios, and recover with confidence.

Why recoverability matters

Accidental deletion, misconfiguration, and malicious changes can disrupt sign‑in, block access to business‑critical applications, and quickly impact downstream operations.

Backup and Recovery provides an important foundation for restoring supported objects, but tenant recoverability requires a broader approach. Recoverability is the ability to restore tenant configuration and identity objects to a known‑good state after unintended or malicious changes, using clear processes and supported recovery paths.

This means recovery readiness is not a single solution. It is a combination of capabilities, processes, and preparation across your organization.

Layers of Recovery: Best Practices

Organizations that recover quickly combine built‑in capabilities like Backup and Recovery with additional layers of preparation and control.

Key elements of a strong tenant recoverability strategy include:

Built‑in recovery for supported objects: Use Microsoft Entra Backup and Recovery to restore supported objects and configuration changes within the retention window.
Maintaining a known‑good configuration state: Regularly capture tenant configuration using tools such as Tenant Configuration Management APIs and Microsoft Graph exports to support recovery beyond built‑in capabilities.
Operational readiness: Define recovery processes, retain audit and sign‑in logs, and establish recovery objectives so that recovery actions can be executed under pressure.
Reducing blast radius: Apply least‑privilege access, Privileged Identity Management, and protected actions to limit the scope of potential incidents and simplify recovery.

Together, these layers help organizations move from reactive fixes to a structured recovery strategy.

"Overall, we like the functionality offered by Microsoft Entra Backup and Recovery. The API support looks solid as well."

– A large European automobile manufacturer

Scenario: Conflicting identity changes disrupt access

To illustrate how organizations can use Backup and Recovery, let’s walk through a potential scenario using a fictitious company called “Contoso”.

Here's the situation:

The IT team at Contoso relies on Microsoft Entra Conditional Access policies and Privileged Identity Management to protect access to business-critical applications. Policies are tightly controlled, and administrative access is granted just in time.

But during a routine day, remote workers suddenly can’t sign in to a critical ordering application. Nothing appears compromised, and the application itself is healthy. The team needs to understand what changed—and restore access quickly.

Step 1: Identify and restore application access.

An administrator runs a Microsoft Entra Backup and Recovery difference report against a recent snapshot and correlates it with Entra audit logs to identify recent changes. The report shows a Conditional Access policy was modified by a known administrator. The update accidentally blocked the remote worker group from accessing the ordering application. Using Backup and Recovery, the administrator restores the policy to a previous state. Access is quickly re‑enabled.

Step 2: Investigate beyond the initial fix.

With access restored, the team continues investigating to understand how an unintended policy change reached production. They review Microsoft Entra Tenant Governance monitoring signals to identify any related configuration changes.

Step 3: Detect configuration drift.

Tenant Governance signals reveal drift in role governance configuration during the same timeframe: a change to role eligibility settings broadened who could administer the Conditional Access policy. This change does not align with the approved configuration baseline.

Step 4: Confirm conflicting changes.

Correlating audit logs with the drift findings, the team reconstructs the sequence. To resolve an urgent, unrelated issue, an administrator had temporarily modified role-eligibility settings — unintentionally allowing a second administrator to edit the Conditional Access policy and block the remote worker group. Two well-intended changes, made independently, combined to cause the outage.

Step 5: Restore governance baseline and prevent recurrence.

The team initiates an established workflow to restore role governance configuration to the approved baseline. Because Contoso routinely practices scenarios like this during Business Continuity and Disaster Recovery (BCDR) drills, the team is able to coordinate rapidly. They restore both application access and governance controls, reducing the likelihood of similar issues in the future.

Recover with confidence: Get started today

Microsoft Entra Backup and Recovery provides a built‑in foundation for restoring supported identity data that organizations can adopt as part of a layered recoverability approach that combines built‑in capabilities with preparation, governance, and operational discipline.

Microsoft Entra Backup and Recovery is built as an API‑first, extensible platform that gives customers the flexibility to design backup and recovery workflows aligned to their operational needs. These same APIs enable independent software vendors (ISVs) to integrate and deliver complementary solutions that extend Entra with their domain expertise.

By aligning Backup and Recovery with a broader identity resilience strategy, organizations can reduce downtime, respond faster to change‑related incidents, and maintain confidence in the integrity of their identity environment.

Ready to strengthen your identity resilience?

Learn how to enable Microsoft Entra Backup and Recovery in your production environment with Microsoft Learn documentation.

- Cindy Crane, Principal Product Manager

Additional resources

Read the new monthly blog series: What’s new in Microsoft Security

Learn more about Microsoft Entra

Secure AI at scale: Join the Microsoft Entra + Purview webinar series

Diana_Vicezar — Thu, 25 Jun 2026 20:17:14 GMT

AI is reshaping how data moves, how access gets granted, and how risk multiplies—faster than most security strategies were built to handle. Sensitive data is flowing through AI prompts, browsers, and agents. Identities are extending to non-human actors. And traditional perimeters are no longer enough.

As organizations scale AI, security teams need a practical way to protect data, govern access, and manage risk before adoption outpaces control.

Securing AI end-to-end requires bringing identity, access, and data protection together—not as separate functions, but as a unified strategy.

To help you put that strategy into practice, we’re launching a new three-part webinar series: Securing Data and Access in the Era of AI. Each session brings together product experts from Microsoft Entra and Microsoft Purview to help you:

Protect sensitive data across networks, apps, and AI interactions
Govern access for users, applications, and AI agents
Reduce risk while enabling innovation at scale

Whether you’re shaping strategy or implementing controls, you’ll leave with practical steps to secure data, govern access, and reduce risk across your AI journey.

Register now and learn how to secure AI end-to-end across access, data, and agents

Secure the age of AI: Redefining trust, data, and access

July 21, 2026, 9:00 AM PDT – Add to calendar

Sinead O’Donovan, VP of Product, Microsoft Entra; Maithili Dandige, GM of Product, Microsoft Purview; Diana Vicezar, Product Marketing Manager, Microsoft Entra

There is no question that AI is transforming the enterprise: changing how data moves, how decisions are made, and how risk takes shape. As agents access, interpret, and act on sensitive data, unmanaged AI use expands and traditional boundaries blur.

Kicking off our series on Securing Data and Access in the Era of AI, Microsoft Entra VP of Product Sinead O’Donovan and Microsoft Purview GM of Product Maithili Dandige explain why legacy security models fall short in the age of AI—and why you need a strategy that brings together identity, access, and data protection. Want to adopt and enable AI innovation with greater control and confidence? Join us to learn how leading organizations are securing access, protecting data, and establishing trust for the next generation of AI-powered work.

Data and identity controls for the browser and network
July 22, 2026, 9:00 AM PDT – Add to calendar

Alexander Pavlovsky, Principal Product Manager, Microsoft Entra; Brendon Lee, Senior Product Manager, Microsoft Purview; Diana Vicezar, Product Marketing Manager, Microsoft Entra

Sensitive data doesn’t stay still. It moves through browsers, SaaS apps, generative AI tools, and prompts—often beyond the visibility of traditional controls. In this session, see how Microsoft Entra and Microsoft Purview bring real-time visibility and control to sensitive data in motion across the network. You’ll learn how integrated data security and secure access controls can help reduce leakage risk, support responsible AI adoption, and enable modern work without slowing the business down.

Unlock AI agents without sacrificing security

July 23, 2026, 9:00 AM PDT – Add to calendar

Jeevan Bisht, Principal PM Manager, Microsoft Entra; Safeena Begum Lepakshi, Principal PM Manager, Microsoft Purview; Diana Vicezar, Product Marketing Manager, Microsoft Entra

AI agents are reaching into mailboxes, files, line-of-business apps, and the open web on behalf of your users—and the business wants more of them, faster. To scale agents safely, your security teams need to be able to verify each agent, govern what it can access, and enforce clear boundaries across every interaction.

Learn how Microsoft Entra helps you discover shadow AI agents, govern agent permissions, keep BYOD and endpoint-based agents in scope, and apply Conditional Access to AI prompts and responses. Then see how Microsoft Purview provides visibility into agent activity, strengthens runtime data protection, helps detect agentic risk, and supports auditability across local agents developed on GitHub Copilot CLI, Claude Code, OpenAI Codex, and OpenClaw. Walk away with practical ways to unlock AI agents while keeping access and data protection aligned with your enterprise security needs.

Ready to take the next step?
Visit the session pages to save the dates for the Securing Data and Access in the Era of AI series. Select Attend to secure your place and receive reminders.

—Diana Vicezar, Product Marketing Manager

Learn more about Microsoft Entra

AI is accelerating cyberattacks—here’s how to stay ahead

Sandeep Deo — Wed, 17 Jun 2026 16:37:33 GMT

In March, we wrote that identity security has become the new pressure point for modern cyberattacks. Since then, AI has only increased that pressure.

AI helps cyberattackers move faster across the attack chain: personalizing social engineering at scale, automating reconnaissance, analyzing leaked credentials, identifying privileged users, probing exposed systems, and adapting tactics in real time. Attacks that once depended on manual effort can now unfold with greater speed, scale, and autonomy.

Yet even as methods evolve, identity remains one of the most common entry points. Every account, admin, workload, application, non-human identity, and AI agent can become a path to sensitive data and critical systems if not properly secured. Attackers do not need to break every defense; they only need to compromise or misuse the right identity with the right access at the right moment.

When attacks are accelerated by AI, speed and accuracy in detection and response are critical. Identity security can no longer operate in silos. Even a minor delay between when a threat is detected and action is taken can be the difference between suspicious activity becoming a contained incident or a business-impacting breach. This shift is reshaping how organizations think about security. The imperative is becoming clear: identity and security teams need comprehensive visibility and integrated solutions that streamline how they prevent, detect, and respond to identity threats.

Securing the future of identity at the speed of AI

One of the biggest security challenges organizations face today is fragmentation, and identity security is no exception. IAM and SOC teams often work across separate tools, separate workflows, and separate operational models. But identity attacks don’t respect those organizational boundaries.

Modern identity attacks span infrastructure, access control, and detection. At Microsoft, we understand this, and we are continuing to expand how Microsoft Entra and Microsoft Defender work together to provide more unified identity security experiences.

Actionable intelligence, everywhere

At RSA earlier this year, we unveiled our unified identity risk score, a new way to turn broader attack-chain insight into real-time access decisions. This score analyzes and correlates relevant signals across related accounts, sessions, workloads, and applications to surface a single, comprehensive evaluation of an identity’s true risk level and enable more dynamic response directly within authentication flows as part of risk-based Conditional Access policies.

View of a risky user within Entra ID Protection with new identity risk score and attack timeline.

Identity admins also gain a stronger operational experience through the new Microsoft Entra ID Protection experience. Rather than forcing identity teams to piece together risk signals across disconnected views, the updated experience brings deeper visibility into risky users, sign-ins, workloads, and associated detections in one place. The new identity risk score adds another layer of context by surfacing insights across related accounts and activity, including signals from Microsoft environments and connected identity activity beyond them. This helps admins understand whether a risky user, agent, workload, or sign-in is an isolated event or part of a broader pattern spanning sessions, applications, and associated accounts.

New user dashboard in Entra ID Protection which provides deeper visibility for identity admins into risky users, sign-ins, and associated detections.New risky user details view provides more information about a user's risk and the attack timeline within Entra ID Protection.

That richer context gives identity teams a more complete view of how risk is developing across the identity estate. Admins can better understand how risk is calculated, which related accounts or workloads contributed to the score, what detections are driving concern, and why a given identity requires attention. By connecting Microsoft and cross-environment signals into a single evaluation, the risk score helps identity admins prioritize the identities that matter most, make more informed access decisions, and explain the rationale behind remediation actions with greater confidence.

For security operations teams, this new score helps prioritize and triage investigations faster by focusing analysts on the identities that pose the greatest risk. But knowing what to fix is only half the challenge. In many organizations, security operations teams lack the needed permissions to take action; instead, they can only wait for separate IAM workflows to resolve the issue. That delay creates friction during moments when response speed matters most. Some solutions address this by giving SOC teams, or the security application itself, broad standing permissions across the identity environment. That may solve the permissions issue, but it also expands the blast radius if the application or identity is misused or compromised.

Microsoft takes a different approach because our solution natively spans identity infrastructure, the identity control plane, and ITDR. Customers get streamlined workflows across the full identity security lifecycle, and with a new identity-focused RBAC role, coming soon in public preview, security operations teams can access the core identity response actions they need without broad administrative permissions. This allows organizations to preserve least privilege access while reducing operational friction between IAM and SOC teams. Combined with the native privileged identity management in Microsoft Entra, organizations can also create just-in-time access policies for these response roles, further reducing standing privilege while still enabling responders to elevate quickly during incidents and investigations.

Together, unified risk, the new Microsoft Entra ID Protection experience, and least-privilege response roles give identity and security teams the shared context and governed action paths they need to move from insight to response faster.

Shifting left with proactive prevention

Shifting identity protection left means addressing risk earlier, before it becomes an active threat or incident. By continuously strengthening posture and adapting access controls as conditions change, organizations can reduce exposure, improve resilience, and stay ahead of emerging risks.

The Conditional Access Optimization Agent continues to evolve to help organizations keep pace with a rapidly changing threat landscape. Instead of manually auditing policies or reacting after gaps are exposed, the agent continuously analyzes identity signals, usage patterns, and emerging threats to recommend the right policy changes at the right time. New recommendations, like the “Block risky user agent” policy, are designed to address emerging attack vectors such as agent-based abuse and automated access attempts. These optimizations give organizations a more adaptive way to enforce Zero Trust, where access decisions continuously adjust based on risk and context rather than relying on one-time configuration.

And as part of our continued effort to help customers close the loop and move beyond reactive responses, we are soon bringing more threat detections and insights from Defender that are automatically fed directly into the Conditional Access Optimization recommendations in Microsoft Entra. Administrators receive clear, explainable, and reviewable recommendations that outline why the change is important, who is impacted, and what action to take, empowering a more proactive and preventative approach to mitigating future attacks.

Accelerating response

In AI-accelerated attacks, response speed matters just as much as visibility. Manual investigation and response will always be necessary, but in today’s AI-accelerated threat landscape, defenders need automation that helps level the playing field. That’s why we were so excited to extend the Security Alert Triage Agent to identity scenarios and pair it with automatic attack disruption and new predictive shielding capabilities. Together, these capabilities create an end-to-end automation loop that helps defenders triage identity threats, disrupt active attacks, drive response, and continuously harden posture before the next incident.

At Microsoft Security, we are building toward that future by embedding this kind of adaptive, AI-driven enforcement directly into identity security. That means accelerating detection across the attack chain, speeding up investigation and response through AI, and ensuring every authentication and access decision reflects real-time risk. It also means bringing IAM and security operations closer together, so identity signals, policy enforcement, and incident response work as one continuous system rather than separate workflows.

The future of identity security

In the AI era, identity is not just a control point. It is the system that connects prevention, detection, and response into a single, adaptive defense system. And Microsoft is building and operating that system as both the identity provider and policy enforcement layer, with real-time risk signals that can immediately influence access decisions. The organizations that defend identity fastest will be the organizations that defend everything else better.

-Sandeep Deo and Yaron Paryanty

Additional resources

Learn more about Microsoft Entra

Tools for Azure AD B2C migration now available

NamitaSingh — Mon, 15 Jun 2026 18:39:00 GMT

If you rely on Azure AD B2C for customer identity, you’re likely starting to evaluate what comes next. With Azure AD B2C no longer receiving new features and several features recently added to Microsoft Entra External ID, planning your migration is easier and can help you with this important next step in your identity strategy.

Below you’ll find tooling, guidance, and a partner ecosystem resource to help you migrate with confidence. This post walks through what’s available and how to get started.

What’s new: Platform updates and migration tooling

Microsoft has invested significantly in Microsoft Entra External ID to help Azure AD B2C customers migrate with confidence and ease. Over the past three months, several new features have reached general availability.

Azure AD B2C Migration tooling: Just-in-Time (JIT) migration, High-Scale Compatibility (HSC) mode, and the published Migration Guidance document and architecture blueprint.

Native authentication GA features in Entra External ID: Email and SMS one-time passcode (OTP) MFA, social identity providers via browser-delegated (web-view) flows, single sign-on (SSO) from native apps to web views, and refresh token transfer to Apple Watch.

Web and federated in Entra External ID: Sign-in and sign-up with alias, Microsoft Entra ID federation with External ID (public preview), and self-service password reset (SSPR) with phone SMS OTP.

For a complete list of recent platform updates, see the What’s new in Microsoft Entra blog.

Where Azure AD B2C stands today

Azure AD B2C has reached a significant milestone in its lifecycle. It has served as a reliable foundation for customer identity, and that doesn’t change for existing customers. What has changed is where Microsoft is investing going forward. Two facts define what that means for existing customers:

May 2025 — End of sale: New Azure AD B2C tenants can no longer be purchased. Existing tenants remain supported.
No new features: All platform innovation is now exclusive to Microsoft Entra External ID. Azure AD B2C will not receive new capabilities going forward.

Your existing Azure AD B2C environment continues to function. Starting your migration early helps you stay in control of sequencing, validation, and user experience. For questions about planning, contact support.

What is Microsoft Entra External ID?

Microsoft Entra External ID is a purpose-built, next-generation customer identity platform. It is not a rebrand of Azure AD B2C. It is a new foundation designed to simplify implementation, improve extensibility, and align with the broader Microsoft Entra ecosystem. Key platform improvements include the following.

Modern extensibility model — Custom authentication extensions replace complex custom policy XML, helping reduce implementation complexity.

Microsoft Entra ecosystem integration — Full alignment with Microsoft Entra ID, Conditional Access, Identity Governance, and Microsoft’s broader security stack.

Continuous platform innovation — Native Authentication SDKs, advanced branding controls, fraud protection, and passwordless-first flows are built exclusively into External ID.

Improved observability — Enhanced monitoring, diagnostics, and audit capabilities for identity and security teams.

Migration tooling

Two primary migration paths are available, and both are now generally available.

	Just-in-Time (JIT) Migration	High-Scale Compatibility (HSC) Mode
Status	Generally available	Generally available
Best for	Most customers seeking a clean cutover with minimal user disruption	High-scale environments (5M+ users) or complex architectural constraints
How it works	Migrates users progressively as they sign in — no bulk password reset required	Moves application traffic to External ID first
Key benefit	Full External ID feature parity from day one with minimal user impact	Supports parallel operation of B2C and External ID during transition, reducing cutover risk
Documentation	JIT Migration Documentation	HSC Mode Documentation

Choosing between JIT and HSC is less about technical capability and more about migration priorities. JIT prioritizes user experience and simplicity, while HSC prioritizes scale and operational continuity.

Alongside these tools, Microsoft has published a comprehensive migration guide and architecture blueprint covering end-to-end migration scenarios, credential migration approaches, and application sequencing guidance.

Partner ecosystem

For organizations with complex environments, migration is not just a technical exercise. It involves coordinating identity flows, applications, and user experiences across systems.

Microsoft has established a global ecosystem of qualified migration partners across EMEA, the Americas, LATAM, ANZ, and the Middle East.

Partner support includes:

Mapping custom policies to External ID equivalents
Designing credential migration strategies
Sequencing application cutovers
Running staged validation and testing
Supporting production deployment

Qualified partners meet criteria such as proven Azure AD B2C experience, active engagement with External ID, and participation in Microsoft migration readiness programs.

Examples include EY, Avanade, Edgile, Slalom, Plan B, WhoIAM, and Grit.

You can explore the full partner directory in the Migration partner directory.

Next steps: How to get started

The organizations that navigate migration most successfully are the ones that start planning early. Beginning now gives you greater control over sequencing, application transitions, and user experience changes before they become urgent. Migration challenges rarely come from the tooling itself; they come from coordination across systems, teams, and timelines.

A structured approach can help accelerate progress:

Assess

Inventory Applications, user populations, and custom policies
Understand dependencies and integrations
Inventory applications, user populations, and custom policies
Understand dependencies and integrations

Decide

Review migration guidance
Choose between JIT and HSC based on your priorities

Execute

Run a proof of concept in a non-production environment
Validate identity flows and user experience
Engage a qualified partner if needed
Align with your Microsoft account team

Migrating from Azure AD B2C to Microsoft Entra External ID is an opportunity to modernize your customer identity platform while reducing operational complexity. With the right planning, tooling, and support available today, you can move forward with confidence while maintaining a seamless experience for your users.

For additional support, contact support.

-Namita Singh - Senior Product Manager, Microsoft Entra External ID

-Pawan Nrisimha - Principal Manager of Product, Microsoft Entra External ID

-Isaac Christian - Product Marketing Manager, Microsoft Entra

Additional resources

Learn more about Microsoft Entra

Microsoft Entra ID security updates: What organizations need to do now

Swaroop Krishnamurthy — Wed, 17 Jun 2026 16:38:05 GMT

Microsoft Entra ID continues to strengthen identity security by modernizing how authentication and access policies are enforced. As part of this effort, Microsoft is retiring legacy capabilities and closing gaps that attackers could exploit. These updates focus on three key areas: replacing Custom controls with External MFA, enforcing Conditional Access consistently during credential registration, and requiring explicitly registered authentication methods for self-service password reset (SSPR). Together, these changes help ensure that your security policies are applied uniformly and backed by strong, user-verified signals.

Key points

Custom controls are being deprecated in favor of External MFA. Existing configurations keep working during the transition, but you should begin migration planning now. Custom controls retire September 30, 2026, and reach end of life in May 2027.
Conditional Access will be enforced consistently during credential registration. Starting July 6, 2026, policies targeting the Register security information action will also apply to Windows Hello for Business provisioning and macOS Platform Single Sign-on registration. Test policies in report-only mode before then.
SSPR will require explicitly registered authentication methods. A registration campaign begins July 6, 2026, and from September 7, 2026, SSPR will accept only registered methods — directory-sourced phone numbers and email addresses that were never formally registered will no longer be accepted.

Deprecation of Custom controls

What’s changing?

Microsoft Entra ID is deprecating Custom controls in favor of External MFA, a more integrated, standards-based capability for incorporating third-party MFA providers directly into Conditional Access. External MFA delivers deeper policy integration, a more seamless user experience, and greater flexibility than the legacy Custom controls model. While existing Custom controls configurations will continue to function during the transition period, organizations should begin planning their migration to External MFA.

When will you see this change?

Custom controls will be retired on September 30, 2026, and the service will reach end of life in May 2027.

Who will be affected by this change?

This update affects organizations currently using Custom controls to integrate third-party MFA providers with Conditional Access.

How will this affect your organization?

Organizations relying on Custom controls will need to transition to External MFA to maintain support and continue using third-party MFA solutions within Microsoft Entra ID. Moving to External MFA also enables more consistent Conditional Access enforcement and improved integration with Microsoft Entra security capabilities.

What do you need to do to prepare?

Organizations should:

Review existing Custom controls integrations
Evaluate External MFA migration requirements
Test Conditional Access policies and user experiences before migration
Begin migration planning ahead of the retirement date
Read more in the External MFA General Availability announcement and migration guidance.

Consistent Conditional Access enforcement for credential registration

What’s changing?

Microsoft is strengthening Conditional Access enforcement during credential registration flows to close a long-standing enforcement gap.

Today, policies targeting the Register security information user action are enforced in My Security Info and Microsoft Authenticator, but not during Windows Hello for Business provisioning or macOS Platform Single Sign-on registration. Conditional Access policies will be enforced consistently across these registration experiences. If users do not meet policy requirements, they will be prompted to satisfy those requirements before completing registration. MFA will continue to be required by default for passwordless credential enrollment, with Conditional Access providing an additional layer of control.

When will you see this change?

This update will roll out during the week of July 6, 2026 to all tenants.

Who will be affected by this change?

This change affects organizations using:

Conditional Access policies scoped to registration flows
Windows Hello for Business
macOS Platform Single Sign-on
Passwordless credential enrollment scenarios

How will this affect your organization?

Organizations may see additional prompts or enforcement steps during device setup and credential registration if users do not meet Conditional Access requirements. This change ensures registration flows are governed by the same security controls already applied across other authentication experiences.

What do you need to do to prepare?

Organizations should review existing registration policies and validate that users can meet Conditional Access requirements during onboarding and device setup. Microsoft recommends testing policies in report-only mode before enforcement begins.

SSPR update: Registered authentication methods required

What’s changing?

Microsoft is updating Microsoft Entra self-service password reset (SSPR) so that only explicitly registered authentication methods can be used for verification. Directory-sourced phone numbers or email addresses stored only as user object properties—but never formally registered as authentication methods—will no longer be accepted. This change aligns SSPR with Entra ID’s broader authentication model by requiring verification methods tied to user intent and proof of possession.

When will you see this change?

Beginning July 6, 2026, Microsoft will deploy an SSPR registration campaign that prompts affected administrators and end users to register authentication methods ahead of enforcement. No administrator action is required to enable this campaign.

Starting September 7, 2026, SSPR will accept only authentication methods that users or administrators have explicitly registered.

Who will be affected by this change?

This update affects organizations and users that still rely on unregistered directory-based phone numbers or email addresses for password reset verification.

How will this affect your organization?

Users without registered authentication methods may experience interruptions during password reset or account recovery flows after enforcement begins. Organizations may also see an increase in registration prompts during the transition period.

What do you need to do to prepare?

Organizations should:

Review authentication method registration coverage
Identify users relying on unregistered directory values
Encourage users to register approved authentication methods
Communicate upcoming changes to users and help desk teams

Microsoft will prompt affected users and administrators during the transition period to help organizations prepare before enforcement begins.

Now is the time to review your current configurations, identify where these changes apply in your environment, and begin preparing your users and admins before enforcement milestones arrive. Start by assessing any Custom controls dependencies, validating registration-related Conditional Access policies, and confirming that authentication methods used for SSPR are explicitly registered.

- Swaroop Krishnamurthy, Principal Product Manager

Additional resources

External MFA in Microsoft Entra ID (general availability announcement)

Learn more about Microsoft Entra

Run Global Secure Access with confidence: Introducing the GSA Operations Guide

tdetzner — Fri, 05 Jun 2026 18:04:21 GMT

In working with customers, I’ve seen the same pattern again and again: deployment gets the attention, but day 2 operations are where teams need the most structure. This guide is meant to make that part easier—with practical guidance teams can use right away.

TL;DR: Your day 2 playbook is here

What’s new? A prescriptive Microsoft Entra Global Secure Access operations guide on Microsoft Learn
Why it matters: It brings actionable, alert-first procedures for teams running Global Secure Access after deployment
What’s inside: A role matrix, automated health checks, capability-specific guides, templates, and automation scripts
Start here: Microsoft Entra Global Secure Access operations guide

The day 2 gap

Deploying Global Secure Access (GSA) is only the beginning. Day 2 challenges raise questions like:
Who monitors what? When do checks happen? How do we know everything is healthy?

The deployment guide covers rollout, and the product documentation explains configuration. But until now, there was no single resource that explained how to operate Global Secure Access in production. Customers, FastTrack, and partners built their own runbooks—and rebuilt them for each deployment.

That ends today.

Announcing the Operations Guide

The Microsoft Entra Global Secure Access operations guide is now live on Microsoft Learn.

This post-deployment playbook delivers prescriptive guidance for running Global Secure Access in production at scale. It was created by the Global Secure Access customer experience engineering team with input from Thomas Detzner, Janice Ricketts, Jeff Bley, Luis Flores, Marilee Turscak, Peter Lenzke, Mohammad Zmaili, and Ken Withe.

Who this guide empowers

This guide is for the teams that keep Global Secure Access running every day: IT administrators, network engineers, and platform operations teams that need clear answers to questions like “Who owns what?” and “How do we prevent issues before they happen?”

It also equips security leaders with structured reporting so they can demonstrate value and service health to executives. If you’re responsible for Global Secure Access performance, alerting, or automation, this is your new reference playbook. (And if you haven’t deployed yet, start with the deployment guide.)

What you’ll gain from this guide

Shared practices that work across any environment

Know your roles early: A RACI matrix so responsibilities never overlap

Manage change with confidence: A GSA-tailored change-control framework for smooth updates
Prove success with clarity: Reporting templates for operators, managers, and executives
Adopt continuous improvement: Built-in processes to spot gaps before they become issues

Capability-specific playbooks structured for speed

Every workload (Private Access, Internet Access, Remote Networks, Microsoft Traffic) follows one clear pattern so teams always know what comes next:
✔ Begin with alert-first monitoring steps that catch issues early
✔ Follow daily, weekly, monthly routines for health maintenance
✔ Automate critical workflows with Sentinel, Graph API, and PowerShell scripts
✔ Track and tune KPIs using measured baselines
✔ Diagnose and resolve quickly with symptom-to-fix troubleshooting

Don’t start from zero—use the templates

Daily health check across all GSA capabilities

Ready-made change request forms and notification playbooks
Modular checklists ready for your ITSM process

Why this guide is different

Unlike generic environment monitoring advice, this guide delivers concrete, tested procedures built from field experience. It applies an alert-first approach so teams can act on signals from Microsoft Sentinel and Azure Monitor before dashboards show trouble.

Each alert comes with an action—nothing is left unanswered. Automation is embedded throughout, including role-based access control (RBAC) hygiene checks and failover tests. Because operations demand clarity, the guide also provides measurable thresholds, baseline methods, and recovery steps that reduce noise and reinforce uptime.

Six moves to launch operational maturity

Assign roles using the RACI matrix for full coverage

Configure critical alerts before adding custom workflows
Collect 30 days of baseline data before adjusting thresholds
Automate backups and priority alert notifications early
Schedule routine checks using provided templates
Begin structured reporting starting with weekly operations and monthly management reviews

Why it matters for customers and partners

This framework reduces time to readiness after deployment, documents a defensible Day 2 plan for audits, cuts escalations by linking every alert to a clear action path, and gives FastTrack and partners a baseline for consistency in engagements.

Next up

Soon we will publish the GSA Security Operations Guide for Microsoft Entra Global Secure Access, providing a dedicated security monitoring and detection companion to the operational guides for Private Access, Internet Access, Remote Networks, and Microsoft traffic. It brings together the built-in alerts, log sources, Sentinel detections, and cross-signal investigation patterns that security teams need to identify suspicious activity and unauthorized changes across the GSA environment.

If deployment is still ahead, start with the GSA Deployment Guide.

Your move

Open the full guide
Download templates and run your first daily health check today
Post feedback and ideas to help shape future updates

-Thomas Detzner

Thomas Detzner | LinkedIn

Additional resources

Learn more about Microsoft Entra

Build AI agents for production with secure identities from day one

ArLucaID — Tue, 02 Jun 2026 19:15:00 GMT

Building an AI agent is no longer the hard part. The real challenge begins when that agent must run securely in production and meet identity, access, audit, and security requirements. That’s where many agents get stuck. It’s relatively easy to build a prototype, but much harder to deploy an agent that operates with the security controls required for production. Microsoft Entra Agent ID helps close that gap by giving agents a consistent identity foundation. Together with the Microsoft Agent 365 CLI and SDK, it helps you deploy AI agents that are ready to be managed, governed, and protected within your organization.

What is Microsoft Entra Agent ID?

Microsoft Entra Agent ID, now generally available, is the identity and access platform in Microsoft Entra for AI agents. It introduces a set of identity constructs that match how agents are built and operated. There are three key concepts worth noting when deploying agents in your organization.

Agent blueprint: A blueprint is the reusable identity template for a class of agents. It defines the common configuration, accountability model, credentials, and scopes used when creating agent identities so developers can create them consistently across deployments.

The agent blueprint manifest is a JSON representation of the blueprint, which you can view or edit under developer settings.

Agent identity: Every agent instance gets its own identity in Microsoft Entra. Each identity has its own sign-in history, audit trail, assigned scopes, and targetable principal for Conditional Access. When you need to know what agent #4,712 did at 3:47 a.m. yesterday, the answer is in Microsoft Entra sign-in logs, indexed by the agent identity itself. When you need to retire a single malicious instance without touching the rest of your fleet, there is a kill switch for that agent identity.

The agent identities view in the Microsoft Entra admin center shows you an inventory of the agent identities in your tenant.

Agent sponsors and owners: Every agent needs clear accountability through two distinct roles. Sponsors provide business accountability for the agent’s purpose and lifecycle decisions, such as whether it should retain access or be retired. Owners are responsible for the technical configuration and management of the agent identity.

The overview of the individual agent identity shows the sponsor, blueprint, and granted permissions for the agent.

These concepts matter because they shape how agent onboarding works in practice. Once you understand the blueprint, the agent identity, and the accountability roles around it, the next question is how those pieces are created during deployment.

How an agent gets an agent identity, blueprint, and sponsor

There isn’t one single way to provision an agent identity, and that’s intentional. Microsoft Entra documents the official creation channels through which agent identity blueprints and identities can land in your tenant. Each channel has its own audience and control surface, and every creation event is recorded in Microsoft Entra audit logs with the channel attached. The channels developers use most often are outlined here.

Microsoft product integrations: Agents built in Microsoft Foundry, Copilot Studio, and Security Copilot get a Microsoft Entra Agent ID automatically as part of platform onboarding. Identity is provisioned from a blueprint and connected without any additional developer effort.
Microsoft Agent 365 CLI and SDK: For agents built on any other framework (Microsoft Agent Framework, OpenAI Agents SDK, Anthropic Claude Agent SDK, Google ADK, AWS Bedrock, LangChain, LlamaIndex, CrewAI, Semantic Kernel, GitHub Copilot SDK, and others), the Microsoft Agent 365 CLI provisions the agent’s identity through Microsoft Graph, and the Microsoft Agent 365 SDK connects the running agent to the control plane so observability, governance, and security come with the identity.

This is the recommended channel for cross-platform and non-Microsoft agents because one integration delivers Microsoft Entra Agent ID plus the rest of Microsoft Agent 365 as a single bundle.

Get started

For developers who don’t already have an onboarding pipeline, the fastest way to take an agent from a code repository to a managed, governed, and protected agent in your tenant is to use the AI-guided onboarding experience in the Microsoft Agent 365 CLI and SDK documentation. It walks you through the end-to-end steps: running the Microsoft Agent 365 CLI, wrapping your agent entry point with the Microsoft Agent 365 SDK, and configuring the runtime credentials Microsoft Entra will use to issue tokens.

Learn more about Microsoft Entra Agent ID and how it helps organizations secure access for AI agents
Learn how to make any agent enterprise-ready with the Agent 365 SDK
Explore: Microsoft Agent 365

-Arturo Lucatero, Principal Product Manager

Additional resources

Learn more about Microsoft Entra

What's New in Microsoft Entra: June 2026

Martin_Coetzer — Mon, 01 Jun 2026 22:54:12 GMT

Welcome to the June edition of our monthly newsletter, summarizing the latest news and developments in the exciting, ever-evolving world of Microsoft Entra.

What went into General Availability (GA) since May 2026?

Enable Phish‑Resistant MFA for Linux Desktops with Microsoft Entra - Microsoft Entra extends Phish Resistant Multi-Factor Authentication support to Linux desktops through the Microsoft identity broker, closing a long-standing gap in cross-platform identity. This update brings Linux to parity with Windows and macOS, enabling secure, modern authentication using phishing-resistant credentials. Support is now available for Ubuntu 24.04 and 26.04, as well as RHEL 8, 9, and 10, helping organizations consistently enforce strong authentication across all major desktop platforms.

Enable improved B2C-to-External ID migration with High Scale Compatibility (HSC) mode – HSC mode is a new tenant-level migration option that lets Azure AD B2C customers transition their applications to Microsoft Entra External ID without re-registering users or resetting passwords, by keeping existing B2C credentials in place during coexistence. It's intended for high-scale tenants - generally those with 5 million or more objects - where the standard bulk migration with JIT password sync isn't practical. Tenants below the 5M threshold should continue to use the standard migration path, and even eligible high-scale tenants should carefully evaluate both options before choosing. Customers can run the B2C Policy Analyzer to assess migration readiness, and account teams and partners should engage the EEID migration team to guide eligible Azure Active Directory B2C customers toward the right migration path.

Enable system-preferred authentication for first and second factors - Microsoft Entra ID updates system-preferred authentication to apply to both first-factor and second-factor authentication in Microsoft Managed state. The system evaluates registered credentials for the user and selects the highest-ranked method for each authentication step. This update applies automatically in the Microsoft managed state, ensuring seamless and secure authentication experiences.

Modernize account management with redesigned My Account pages - Microsoft Entra introduces redesigned Devices, Security Info, and Organizations pages in the My Account portal. The Devices page simplifies registered device management and prominently surfaces BitLocker recovery keys, reducing IT helpdesk dependency. The Security Info page in Settings & Privacy centralizes profile information, language, and region settings for easier updates. The Organizations page resolves issues with end users leaving organizations and delivers a streamlined experience. These updates automatically roll out to Microsoft Entra ID customers by the end of June 2026, requiring no administrator action.

Cross-tenant group synchronization in Microsoft Entra - This enables organizations to synchronize security groups and memberships across tenants for centralized management and consistent access control. This simplifies cross-tenant collaboration by allowing groups managed in a source tenant to be used in one or more target tenants for scenarios like shared application access and resource authorization. Beyond collaboration, this enables more seamless cross-tenant administration by allowing organizations to extend governance and access control consistently across tenant boundaries.

Account discovery for connected applications in Microsoft Entra ID Governance - Administrators gain visibility into all accounts within connected applications, including orphan accounts not assigned to the enterprise application in Microsoft Entra. Generate discovery reports directly from the provisioning experience to identify access gaps and simplify application onboarding. This capability requires a Microsoft Entra ID Governance or Microsoft Entra Suite license.

Automate agent identity sponsorship transitions - Microsoft Entra ID Governance ensures agent identities always have a delegated human sponsor accountable for their access and lifecycle. With Lifecycle Workflows, when a sponsor leaves the organization, sponsorship automatically transfers to their manager, maintaining continuity. Lifecycle workflows can also notify cosponsors and managers of impending sponsorship changes, streamlining the process and reducing manual oversight.

Drive Passkey Adoption with Microsoft Entra Registration Campaigns - Microsoft Entra Registration Campaigns now supports Passkeys such as Fast Identity Online (FIDO2), as an authentication method. Administrators can configure registration campaigns to nudge users to register passkeys during sign-in, helping organizations drive passkey adoption. This first rollout experience is optimized for users in a passkey profile without restrictions.

App Deactivation for Microsoft Entra applications - App Deactivation introduces a safe, reversible, and self-service way for app owners and admins to turn off applications that are unused, deprecated, or under investigation - without deleting them or breaking tenant-level governance. Deactivating an app registration provides a reversible way to prevent the application from accessing protected resources without permanently removing it from your tenant. When you deactivate an application, it immediately stops receiving new access tokens, but existing tokens remain valid until they expire. This approach is useful for security investigations, temporary suspension of suspicious applications, or when you need to maintain application configuration data. Unlike permanently deleting an application, deactivation preserves all application metadata, permissions, and configuration settings, making it easy to reactivate the application if needed. The application remains visible in your tenant's enterprise applications list, but users can't sign in and no new tokens are issued.

Enable phishing-resistant sign-in with Microsoft Entra passkeys on Windows - Users register device-bound passkeys in the local Windows Hello container and use them for secure sign-in with Windows Hello biometrics or PIN. These passkeys function as FIDO2 credentials and work without requiring the device to be Microsoft Entra joined or registered. This capability is automatically available in tenants where passkey profiles permit Windows Hello as a provider, supporting phishing-resistant authentication for Entra-protected cloud resources. Interactive Windows console sign-in is not supported.

New in Public Preview

Support domain-less SAML Federation on workforce tenants - Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and pre-configured IdP domains during sign-in or invitation redemption.

Sensitivity labels for Entra security groups - Microsoft Entra ID supports applying Microsoft Purview sensitivity labels to Entra cloud security groups in public preview. This enables administrators to use the same labels and policies already used for Microsoft 365 groups to govern security group behaviors such as guest access and other controls. Sensitivity labels are managed in Microsoft Purview and can be applied through the Entra Admin Center, Azure portal, and Microsoft Graph, helping organizations apply consistent governance across identities and access.

Safely remove and restore devices with Device Soft Delete - This enables administrators to move device objects to a recoverable state instead of permanently deleting them. Organizations can restore devices within a defined retention period while preserving critical data like device identity and associated security artifacts. The feature supports Microsoft Entra joined, registered, and hybrid joined devices, reducing risks from accidental deletions and improving device lifecycle management.

Move SAP SuccessFactors Provisioning to Workload Identity-based authentication - Microsoft Entra introduces Workload Identity-based authentication for SAP SuccessFactors provisioning, replacing long-lived usernames and passwords with Entra-managed credentials and short‑lived, standards‑based access tokens. This update allows customers to perform this authentication upgrade in-place on their existing provisioning jobs, without recreating or restarting them. This will switch their Entra or SuccessFactors integrations to a more secure model that is aligned with SAP SuccessFactors' plan to deprecate basic authentication for SAP SuccessFactors' APIs by November 2026. The new option applies to SAP SuccessFactors inbound provisioning to Active Directory and Microsoft Entra ID, as well as writeback scenarios, and improves security by eliminating the need to manually handle credentials and rotate them periodically.

Govern Azure role assignments with access packages - Microsoft Entra enables governance of eligible and active assignments to Azure roles at the Management Group, Subscription, and Resource Group levels through access packages. Role assignments now follow the same request, approval, and lifecycle governance model as apps and groups. This simplifies managing access to Azure resources at scale while supporting least privilege and just-in-time access principles.

Automate user attribute updates in Lifecycle Workflows - Microsoft Entra introduces the User Attribute Updates task in Lifecycle Workflows, enabling automated attribute changes directly within workflows. Administrators can set or clear attribute values including custom attributes with a secure, consistent, and auditable process. This feature reduces manual effort, enhances governance, and scales identity automation with confidence.

Improve privileged identity response for Security Operations Center (SOC) – Microsoft is extending the Entra Security Operator role so SOC analysts can take identity response actions such as disable users, revoke sessions, mark users compromised, force password resets (including cloud-only accounts), and delete individual authentication methods , directly from the Microsoft Defender unified role-based access control (RBAC) experience, without broad Entra admin roles or identity and access management (IAM) escalation during active incidents. Permissions are scoped to non-admin users enabling faster containment, least-privilege boundaries, and auditability.

Announcements

Require registered methods for Self-Service Password Reset - Microsoft Entra Self-Service Password Reset (SSPR) will only accept explicitly registered authentication methods for identity verification starting September 7, 2026. Directory-sourced contact information, such as phone numbers and email addresses stored as user object properties, will no longer be accepted unless registered as authentication methods. This change applies to all users, including administrators, across Public cloud, GCC, GCC High, and DoD. Beginning July 6, 2026, Microsoft will automatically launch a registration campaign prompting affected users to register authentication methods after sign-in. Administrators should ensure users have at least one registered method to meet SSPR policy requirements before enforcement to avoid disruptions.

Enforce conditional Access during credential registration - Starting July 6, 2026, Entra ID Conditional Access policies scoped to the Register security information user action will be evaluated during credential registration for Windows Hello for Business and macOS Platform SSO .This ensures registration policies apply consistently across all registration flows. Users must satisfy policy controls, such as multifactor authentication (MFA), network restrictions, device compliance, or other tenant defined requirement before completing registration. Organizations without Conditional Access policies targeting this user action are unaffected, and MFA remains required by default for all passwordless credential registrations. Enforcement completes by July 13, 2026.

Expand passkey policy size and profiles in authentication methods policy - Microsoft Entra increases the passkey (Fast Identity Online 2, FIDO2) policy size limit to a dedicated 20 KB allocation within the authentication methods policy. Previously, all authentication methods shared a single 20 KB limit. This update ensures passkey policies have their own allocation, simplifying adoption and advanced targeting scenarios. Additionally, the maximum number of passkey profiles per tenant increases from 3 to 10, allowing greater flexibility in managing passkey configurations.

New guidance and information

Global Secure Access Operations Guide - The new GSA Operations Guide is your post-deployment companion for running Global Secure Access reliably at scale. It covers alerting, health checks, change management, metrics, and recovery playbooks, with ready-to-use KQL queries and templates you can adopt on day one. Capability-specific guides are included for Private Access, Internet Access, Remote Networks, and Microsoft Traffic.

Tell us what you think!

If you have feedback on this newsletter, fill out the dedicated Microsoft Form.

Blogs

Check out the latest blog posts on our Microsoft Entra Blog and our Microsoft Entra Identity Developer Blog.

What's new in Microsoft Entra?

Become a certified Microsoft Identity and Access Administrator

Check out the certification and related training for the Microsoft Identity and Access Administrator available for customers and partners.

-Martin Coetzer

Principal Product Manager, Identity and Network Access, Customer Experience Engineering (CXE)

Microsoft Entra Community | LinkedIn

Learn more about Microsoft Entra

Find shadow tenants and reduce risk fast with Microsoft Entra Tenant Governance

CindyCrane — Tue, 26 May 2026 15:00:00 GMT

As organizations grow, so does their tenant footprint. Over time, tenants created for acquisitions, development projects, regional operations, or partner collaboration can fall outside central IT visibility, creating what many security teams now refer to as shadow tenants.

One of the foundational pillars of Microsoft Entra Tenant Governance is discovering related tenants. This capability helps you identify tenants connected to your environment through signals such as B2B collaboration, multitenant applications and shared billing relationships. With that visibility, you can reduce hidden security risks before they become incidents.

Let’s explore what this looks like in practice through the lens of the Related Tenants pillar.

Scenario: Contoso discovers its hidden tenant landscape

Contoso's IT security team knows about their primary production tenant and a handful of dev/test tenants. But after reading about the Midnight Blizzard attack, the CISO wants a complete picture. Are there tenants out there that Contoso doesn't know about?

Step 1: Turn on discovery. A Contoso admin, Alice, opens the Microsoft Entra admin center, navigates to Tenant governance > Related tenants, and enables discovery. It takes a single click—no infrastructure to configure.

Step 2: Discover what’s connected. Within hours, the system surfaces tenants connected to Contoso through cross-tenant signals (B2B collaboration, multitenant app registrations, and shared billing accounts). Alice sees 14 related tenants. The team recognizes nine of them. The other five are a mix of tenants from a 2023 acquisition that were never onboarded, a proof-of-concept tenant a partner team spun up, and two legacy test environments nobody remembered existed.

Step 3: Assess and act. For each discovered tenant, Contoso can see the relationship type and the signals behind it. The security team flags unknown tenants for review and immediately runs a quarantine workflow for one unsanctioned tenant that has high-risk multitenant app permissions:

Confirm exposure. Validate which app permissions were granted, whether admin consent exists, and which users or workloads are affected.
Block user sign-in paths. In cross-tenant access settings, add the suspect tenant and block inbound and outbound user sign-in so collaboration with that tenant is stopped without disrupting trusted tenants.
Contain application access. Find enterprise applications whose “appOwnerOrganizationId” matches the suspect tenant, then revoke granted permissions or delete the corresponding service principals to cut off app-based access.
Harden with tenant restrictions. Apply a tenant restrictions v2 policy through Global Secure Access and universal tenant restrictions so managed users can’t authenticate unsanctioned tenants.
Validate and decide. Verify blocking in sign-in and audit logs, run a short scream test for business impact, then either onboard the tenant into governance relationships and policy baselines or keep it isolated until retirement.

Microsoft Entra Tenant Governance related tenants.

Microsoft Entra Tenant Governance discovery signals.

This isn’t a one-time scan. Related tenants are a continuously updated inventory; as new tenants appear in Contoso’s identity landscape, they surface automatically. No more blind spots waiting to be exploited.

Following the guidance in Discover your Microsoft cloud footprint, organizations can further expand their visibility by using additional telemetry sources including:

Azure subscription billing data
Authentication logs (Microsoft Entra sign-ins)
Microsoft 365 activity
Audit logs

These sources help organizations inventory all Microsoft tenants where users have signed in or resources are provisioned, identify cross-tenant relationships through app consent and Global Secure Access network traffic, and surface potential risks from tenants with elevated permissions or suspicious patterns.

For tenants that are discovered but not yet trusted, organizations can take immediate action using existing tenant quarantine capabilities to isolate potentially risky tenants and restrict their interactions until they've been assessed.

Important: Using the new add-on tenant creation flow is a crucial part of establishing a secure tenant landscape. To ensure organizations are using the most secure methods possible to create add-on tenants, the legacy workforce tenant creation flow will be retired August 15, 2026.

Get started

Threat actors continue to innovate, but so do we. By making tenant discovery a foundational part of your identity strategy, you can close gaps before adversaries find them.

To get started, enable related tenants discovery in the Microsoft Entra admin center or through the tenant governance API. Your feedback is instrumental in shaping these tools. We invite you to try the public preview and share your experience.

Stay secure, stay informed, and stay ahead.

-Cindy Crane, Principal Product Manager

Additional resources

Learn more about Microsoft Entra

Platform SSO during automated device enrollment is now generally available for macOS

Justin-Ploegert — Mon, 18 May 2026 15:00:00 GMT

Getting new devices into users’ hands quickly while maintaining strong identity and compliance has always required a careful balance. IT admins need streamlined deployment workflows, while end users expect a frictionless experience from the very first sign-in.

Today, we’re excited to announce that Platform SSO (PSSO) during Automated Device Enrollment (ADE) on macOS is now generally available. This capability simplifies onboarding by enabling device registration and Platform SSO setup to occur automatically during enrollment, eliminating extra steps for both IT administrators and end users.

Streamline setup for IT admins

Automated Device Enrollment already provides a powerful way to provision macOS devices with the right configuration, policies, and applications from the start. With Platform SSO now integrated directly into this flow, IT admins can:

Ensure Platform SSO is enabled as part of enrollment — no post-setup steps required.
Standardize device identity and access configuration from day one.
Reduce deployment complexity by avoiding separate workflows for completing SSO setup.
Improve compliance posture immediately with identity-backed device trust.

By incorporating PSSO into ADE, organizations can treat identity configuration as a core part of provisioning—not as an afterthought.

Reduce friction for end users

Previously, users enrolling macOS devices might encounter an additional step after setup to complete Platform SSO registration, typically requiring them to respond to a prompt or click a “Finish” action.

With this new capability, that extra step is removed:

No additional prompts to complete Platform SSO
No need for users to manually finish enrollment steps
Immediate access to single sign-on experiences after setup

The result is a smoother, more intuitive onboarding experience where users can begin working right away without interruption.

Understand how it works

With the EnableRegistrationDuringSetup capability, Platform SSO registration is performed as part of the Automated Device Enrollment process. This ensures that:

The device is properly registered with Microsoft Entra ID during setup.
Platform SSO is activated automatically.
The user’s identity is fully integrated into the device experience from first sign-in.

Because this happens within the managed enrollment flow, it aligns naturally with existing MDM configurations and provisioning policies.

See why it matters

For organizations adopting modern identity and device management, reducing friction during onboarding is critical—not just for productivity, but for security consistency at scale.

With Platform SSO during ADE:

IT admins gain a predictable, simplified setup experience.
Users avoid confusing or redundant steps during onboarding.
Organizations achieve faster time-to-productivity with stronger identity integration.

This is especially impactful in environments where devices are deployed at scale, such as enterprise rollouts, education, or frontline scenarios.

Get started

Ready to simplify macOS onboarding? Configure Platform SSO during Automated Device Enrollment in Microsoft Intune to reduce setup friction and strengthen identity from day one.

To enable Platform SSO during Automated Device Enrollment, follow the MDM configuration steps below:

Configure Automated Device Enrollment for macOS in your MDM solution.
Ensure Platform SSO is configured for your organization.
Enable the EnableRegistrationDuringSetup setting as part of your deployment profile.

Once enabled, new devices will automatically complete Platform SSO setup during enrollment—with no additional user action required.

- Justin Ploegert

Additional resources

Learn more about Microsoft Entra

Microsoft Identity Manager 2016 SP3 now available: Enhanced stability for hybrid identity

benmann — Thu, 14 May 2026 17:30:53 GMT

Many organizations continue to depend on Microsoft Identity Manager (MIM) 2016 for scenarios that are not easily replicated elsewhere, such as:

Synchronization across multiple directories and forests:

Complex attribute flows and identity correlation logic
Management of custom objects and extended schemas
Deep integration with on-premises applications

Microsoft Identity Manager (MIM) 2016 Service Pack 3 (SP3) is now generally available. SP3 focuses on stability and supportability and updates compatibility with current platform components such as SQL Server, SharePoint, and Exchange. It also adds a new deployment option for the Synchronization Service: Azure SQL Database, with authentication through system-assigned and user-assigned managed identities to help reduce operational risk in hybrid identity environments.

In this release

Run MIM on current platform components

Updated compatibility for newer platform releases, including SQL Server 2022 and Exchange Server Subscription Edition (SE).
New Synchronization Service database option: Azure SQL Database with authentication via system-assigned and user-assigned managed identities.

Modernize the MIM Service and Portal experience

Deploy the MIM Portal on SharePoint Subscription Edition (SE).
Support for System Center Service Manager Data Warehouse (DW) 2022 for reporting and audit integration.
Active Directory Federation Services (AD FS) single sign-on (SSO) support for claims-based authentication, enabling users to sign in through AD FS instead of Windows integrated authentication.

Download and upgrade information

Based on your licensing, you can download the installer packages here: Microsoft Identity Manager licensing and downloads | Microsoft Learn
SP3 introduces a new upgrade process. Please follow the documented steps carefully: Upgrade Microsoft Identity Manager 2016 from SP2 to SP3 | Microsoft Learn
Operational recommendation: Validate SP3 in a non-production environment first, then roll it out to your production environment.

Support lifecycle

MIM 2016 SP2 will remain supported for 12 months (through May 2027), in line with the service pack support lifecycle policy. Customers should plan to upgrade from SP2 to SP3 within that window. For details, see: Fixed Lifecycle Policy | Microsoft Learn

MIM 2016 remains supported through January 9, 2029, under Microsoft’s Fixed Lifecycle Policy. While MIM continues to support critical identity scenarios, Microsoft is actively investing in Microsoft Entra as the long-term platform for identity governance and lifecycle management. We recognize that some MIM use cases require a phased or hybrid approach, and we are working closely with customers to support these transitions.

Questions about upgrading to SP3 or planning your longer-term identity strategy? Contact your Microsoft account team or support contact to review your environment, timelines, and transition path.

Ben Mann, Group Product Manager
Microsoft Entra

Africa Development Center (ADC)

Additional resources

About MIM 2016 - Microsoft Identity Manager | Microsoft Learn
Migrate from MIM to Entra ID - Migrating to Microsoft Entra ID from Microsoft Identity Manager | Microsoft Learn

Learn more about Microsoft Entra