Entra changes
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 757d139 · +149 −1 lines · also on GitHub
11
---
22
title: Microsoft Entra releases and announcements
33
description: Learn what is new with Microsoft Entra, such as the latest release notes, known issues, bug fixes, deprecated functionality, and upcoming changes.
4
+manager: dougeby
45
featureFlags:
56
- clicktale
67
ms.assetid: 06a149f7-4aa1-4fb9-a8ec-ac2633b031fb
78
ms.topic: reference
8
−ms.date: 06/17/2026
9
+ms.date: 06/26/2026
910
ms.reviewer: dhanyahk
1011
ms.custom: it-pro, has-azure-ad-ps-ref, sfi-ga-nochange
1112
ms.collection: M365-identity-device-management
13
+ai-usage: ai-assisted
1214
#Customer Intent: As an IT admin, I want to review the latest Microsoft Entra releases and announcements so that I can stay current with product updates.
1315
---
1416
⋯ 2 unchanged lines
1719
This article provides information about the latest releases and change announcements across the Microsoft Entra family of products over the last six months (updated monthly). If you're looking for information that's older than six months, see: [Archive for What's new in Microsoft Entra](whats-new-archive.md).
1820
1921
> Get notified about when to revisit this page for updates by copying and pasting this URL: `https://learn.microsoft.com/api/search/rss?search=%22Release+notes+-+Azure+Active+Directory%22&locale=en-us` into your  feed reader.
22
+
23
+## June 2026
24
+
25
+### General Availability - External users can be directly assigned to Access Packages
26
+
27
+**Type:** New feature
28
+**Service category:** Entitlement Management
29
+**Product capability:** Identity Governance
30
+
31
+This feature allows Entitlement Management admins to directly assign external users who are not in the directory to an access package using the user's email. Users are invited into the tenant as Guest users and are governed (as long as Entra ID Governance is configured).
32
+
33
+---
34
+
35
+### General availability - Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows
36
+
37
+**Type:** Changed feature
38
+**Service category:** Authentications (Logins)
39
+**Product capability:** User Authentication
40
+
41
+General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to attempt decryption with both primary and secondary Kerberos keys, improving resiliency during key rollover operations and reducing authentication disruption during rotation events. For more information, see: [Rotate the Kerberos server key for Microsoft Entra Kerberos](../identity/authentication/kerberos-server-key-rotation.md).
42
+
43
+---
44
+
45
+### General Availability - BYOD support for Windows client using Entra registration
46
+
47
+**Type:** New feature
48
+**Service category:** BYOD
49
+**Product capability:** Network Access
50
+
51
+We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable **users and partners** to access corporate resources from their own devices. Administrators can assign the **Private Application** traffic profile to users with internal accounts, including **internal guest users**. This removes the previous requirement for Windows devices to be domain-joined. For more information, see: [Bring Your Own Device](../global-secure-access/concept-bring-your-own-device.md).
52
+
53
+---
54
+
55
+### Generally available - Jailbreak/Root Detection in Authenticator App
56
+
57
+**Type:** New feature
58
+**Service category:** Microsoft Authenticator App
59
+**Product capability:** Identity Security & Protection
60
+
61
+Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or school accounts in Authenticator app. Users must move to compliant devices to continue using work or school accounts in Authenticator. This capability is secure by default and does not require any admin configuration or control.
62
+
63
+---
64
+
65
+### Public Preview - Extended Conditional Access protections for Agent's user accounts
66
+
67
+**Type:** New feature
68
+**Service category:** Conditional Access
69
+**Product capability:** Identity Security & Protection
70
+
71
+Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can:
72
+
73
+- **Target agent's user accounts with greater precision** by including or excluding individual agents or dynamically grouping agents using **Custom Security Attributes**.
74
+- **Protect against risky agent activity** by applying Conditional Access policies based on **Agent Risk**.
75
+- **Require compliant devices** for agents running on managed endpoints, including **Windows 365 for Agents**, ensuring agents can only operate from devices that meet your organization's compliance requirements.
76
+- **Apply device platforms, filter for devices and compliant network conditions** to agents running on endpoints, enabling policies based on device state and trusted network locations.
77
+
78
+These capabilities extend Zero Trust protections to agent's user accounts while leveraging the familiar Conditional Access policy experience. For more information see: [Target agent identities in Conditional Access policies](../identity/conditional-access/howto-target-agent-identities.md).
79
+
80
+---
81
+
82
+### General Availability - Domainless SAML IdP federation for workforce tenants
83
+
84
+**Type:** New feature
85
+**Service category:** B2B
86
+**Product capability:** B2B/B2C
87
+
88
+Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and preconfigured IdP domains during sign-in or invitation redemption. Learn more at [Add a SAML/WS-Fed identity provider - Microsoft Entra External ID](/entra/external-id/direct-federation#domainless-saml-idp-federation-preview).
89
+
90
+---
91
+
92
+### General Availability - SCIM 2.0 APIs for Microsoft Entra ID in US Gov cloud
93
+
94
+**Type:** New feature
95
+**Service category:** Provisioning
96
+**Product capability:** Identity Lifecycle Management
97
+
98
+SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification. For more information, see: [Enable the SCIM Provisioning API in Microsoft Entra ID](../identity/app-provisioning/enable-scim-api.md).
99
+
100
+---
101
+
102
+### General Availability - Microsoft Entra Backup and Recovery is now available
103
+
104
+**Type:** New feature
105
+**Service category:** Entra Backup and Recovery
106
+**Product capability:** Entra Backup and Recovery
107
+
108
+Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policy, so admins can quickly restore them to a previously known good state.
109
+
110
+At preview, Entra Backup and Recovery automatically takes daily backup of a tenant's supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for 7 days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.
111
+
112
+This gives your organization a reliable, built-in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises. For more information, see: [Microsoft Entra Backup and Recovery overview (Preview)](../backup/overview.md).
113
+
114
+---
115
+
116
+### Upcoming change - Improved restore experience for device-bound Authenticator app passkeys on iOS
117
+
118
+**Type:** Plan for change
119
+**Service category:** Microsoft Authenticator App
120
+**Product capability:** Identity Security & Protection
121
+
122
+No action is required.
123
+
124
+What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required.
125
+
126
+With this update:
127
+
128
+- Users who already have iCloud and iCloud Keychain backup enabled for the Authenticator app—and have device-bound Authenticator passkeys on their old device—will automatically benefit from this improved experience.
129
+- Users restoring their Authenticator app on a new iOS device will experience an updated restore flow.
130
+
131
+This change streamlines the restore experience by directing users to the right recovery path based on access to their old device and helping them understand cross-device passkey authentication, resulting in a smoother transition to a new phone.
132
+
133
+This update applies to iOS devices only. Android support will follow.
134
+
135
+[Learn more](https://support.microsoft.com/account-billing/back-up-account-credentials-in-microsoft-authenticator-bb939936-7a8d-4e88-bc43-49bc1a700a40) about the changes to backup and restore in Authenticator app.
136
+
137
+---
138
+
139
+### Public Preview - New built-in Entra role for SOC identity response in Microsoft Defender
140
+
141
+**Type:** New feature
142
+**Service category:** RBAC
143
+**Product capability:** Identity Security & Protection
144
+
145
+Starting June 8 we're introducing a new built-in role in Microsoft Entra—**SOC Identity Responder**—to further improve how security teams execute identity containment actions initiated from Microsoft Defender using a least-privilege access model.
146
+
147
+Previously, performing these actions required SOC analysts to hold multiple high-privilege Entra roles or depend on identity administrators, creating delays during active investigations.
148
+
149
+With this update, **SOC analysts can be assigned a dedicated role purpose-built for identity response actions**, allowing them to perform key actions—such as disabling users, revoking sessions, and forcing password resets—without being granted broad directory administrative privileges.
150
+
151
+Access to this role supports flexible assignment models, including **role-assignable groups** for managing permissions through group membership and delegated ownership. Optional integration with **Privileged Identity Management (PIM)** enables just-in-time activation and enhanced governance controls.
152
+
153
+These actions continue to be enforced and audited by Microsoft Entra, ensuring consistency with existing RBAC and compliance controls.
154
+
155
+---
156
+
157
+### Public Preview - Prevent unauthorized changes to AD groups with AD group enforcement
158
+
159
+**Type:** New feature
160
+**Service category:** Provisioning
161
+**Product capability:** Entra Cloud Sync
162
+
163
+For customers leveraging group provisioning to AD, this capability ensures that changes to AD groups remain consistent with those managed in Microsoft Entra. With this preview, you can designate specific AD groups so that modifications to those groups can only be made through the Entra provisioning service. Changes made outside of Entra are blocked, helping prevent drift before it occurs and maintaining alignment between Entra ID and AD groups.
164
+
165
+Learn more: [AD group enforcement documentation](https://aka.ms/ADEnforcementDocumentation).
166
+
167
+---
20168
21169
## May 2026
22170
⋯ 1186 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.