Entra changes
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 945dab8 · +156 −1 lines · also on GitHub
⋯ 5 unchanged lines
66
- clicktale
77
ms.assetid: 06a149f7-4aa1-4fb9-a8ec-ac2633b031fb
88
ms.topic: reference
9
−ms.date: 06/17/2026
9
+ms.date: 06/26/2026
1010
ms.reviewer: dhanyahk
1111
ms.custom: it-pro, has-azure-ad-ps-ref, sfi-ga-nochange
1212
ms.collection: M365-identity-device-management
13
+ai-usage: ai-assisted
1314
#Customer Intent: As an IT admin, I want to review the latest Microsoft Entra releases and announcements so that I can stay current with product updates.
1415
---
1516
⋯ 2 unchanged lines
1819
This article provides information about the latest releases and change announcements across the Microsoft Entra family of products over the last six months (updated monthly). If you're looking for information that's older than six months, see: [Archive for What's new in Microsoft Entra](whats-new-archive.md).
1920
2021
> Get notified about when to revisit this page for updates by copying and pasting this URL: `https://learn.microsoft.com/api/search/rss?search=%22Release+notes+-+Azure+Active+Directory%22&locale=en-us` into your  feed reader.
22
+
23
+## June 2026
24
+
25
+### General Availability - External users can be directly assigned to Access Packages
26
+
27
+**Type:** New feature
28
+**Service category:** Entitlement Management
29
+**Product capability:** Identity Governance
30
+
31
+This feature allows Entitlement Management admins to directly assign external users who are not in the directory to an access package using the user's email. Users are invited into the tenant as Guest users and are governed (as long as Entra ID Governance is configured).
32
+
33
+---
34
+
35
+### General availability - Microsoft Entra Kerberos key rotation improved reliability for incoming trust referral flows
36
+
37
+**Type:** Changed feature
38
+**Service category:** Authentications (Logins)
39
+**Product capability:** User Authentication
40
+
41
+General availability of Microsoft Entra Kerberos key rotation improved reliability particularly for environments using incoming trust referral flows. Previously, authentication failures could occur during Kerberos key rotation if referral tickets were encrypted with a secondary key. The update enhances validation logic to attempt decryption with both primary and secondary Kerberos keys, improving resiliency during key rollover operations and reducing authentication disruption during rotation events.
42
+
43
+---
44
+
45
+### General Availability - BYOD support for Windows client using Entra registration
46
+
47
+**Type:** New feature
48
+**Service category:** BYOD
49
+**Product capability:** Network Access
50
+
51
+We are excited to announce Bring Your Own Device (BYOD) support for Windows client using Entra-registered devices is now generally available. You can now enable **users and partners** to access corporate resources from their own devices. Administrators can assign the **Private Application** traffic profile to users with internal accounts, including **internal guest users**. This removes the previous requirement for Windows devices to be domain-joined.
52
+
53
+---
54
+
55
+### Generally available - Jailbreak/Root Detection in Authenticator App
56
+
57
+**Type:** New feature
58
+**Service category:** Microsoft Authenticator App
59
+**Product capability:** Identity Security & Protection
60
+
61
+Microsoft Authenticator introduced jailbreak/root detection for Microsoft work or school accounts in the Authenticator app. Users with rooted/jailbroken devices will be blocked from adding/using work or school accounts in Authenticator app. Users must move to compliant devices to continue using work or school accounts in Authenticator. This capability is secure by default and does not require any admin configuration or control.
62
+
63
+---
64
+
65
+### Public Preview - Extended Conditional Access protections for Agent's user accounts
66
+
67
+**Type:** New feature
68
+**Service category:** Conditional Access
69
+**Product capability:** Identity Security & Protection
70
+
71
+Conditional Access now provides broader controls to secure AI agents that have a user account. Administrators can:
72
+
73
+- **Target agent's user accounts with greater precision** by including or excluding individual agents or dynamically grouping agents using **Custom Security Attributes**.
74
+- **Protect against risky agent activity** by applying Conditional Access policies based on **Agent Risk**.
75
+- **Require compliant devices** for agents running on managed endpoints, including **Windows 365 for Agents**, ensuring agents can only operate from devices that meet your organization's compliance requirements.
76
+- **Apply device platforms, filter for devices and compliant network conditions** to agents running on endpoints, enabling policies based on device state and trusted network locations.
77
+
78
+These capabilities extend Zero Trust protections to agent's user accounts while leveraging the familiar Conditional Access policy experience.
79
+
80
+---
81
+
82
+### Private Preview - PIM Only Mode for Azure
83
+
84
+**Type:** New feature
85
+**Service category:** Privileged Identity Management
86
+**Product capability:** Privileged Identity Management
87
+
88
+**PIM only mode** is a security control that enforces **all Azure RBAC role assignment management to be performed through Microsoft Entra Privileged Identity Management (PIM)** or an approved set of applications. Any role assignment that is created or updated outside of PIM is **blocked** and **flagged as non-compliant**.
89
+
90
+The control is implemented via **Azure Policy** and can be applied at **subscription** or **management group** scope.
91
+
92
+Many security guardrails — such as **disallowing permanent eligible or permanent active assignments**, **setting expiration on eligible and active assignments**, **requiring Azure MFA on active assignment**, and **requiring justification on active assignment** — are configured in **PIM policies**. Those guardrails only apply when role assignments flow through PIM. If an admin creates a role assignment directly (for example, via the RBAC blade, Azure CLI, ARM, or scripts), the PIM assignment-settings controls are bypassed.
93
+
94
+PIM only mode closes that gap by ensuring:
95
+
96
+- All Azure RBAC role assignments — whether new or modified — must be created through PIM or an explicitly approved application.
97
+- All PIM **assignment-settings** are uniformly applied across the scope.
98
+- Out-of-band assignments are visible as non-compliant resources in Azure Policy.
99
+
100
+---
101
+
102
+### General Availability - Domainless SAML IdP federation for workforce tenants
103
+
104
+**Type:** New feature
105
+**Service category:** B2B
106
+**Product capability:** B2B/B2C
107
+
108
+Domainless SAML federation with a SAML Identity Provider allows external users to authenticate into your apps or workforce resources using their IdP-managed credentials, regardless of their email domain. Domainless federation removes the need for domain matching between the user's email and preconfigured IdP domains during sign-in or invitation redemption. Learn more at [Add a SAML/WS-Fed identity provider - Microsoft Entra External ID](/entra/external-id/direct-federation#domainless-saml-idp-federation-preview).
109
+
110
+---
111
+
112
+### General Availability - SCIM 2.0 APIs for Microsoft Entra ID in US Gov cloud
113
+
114
+**Type:** New feature
115
+**Service category:** Provisioning
116
+**Product capability:** Identity Lifecycle Management
117
+
118
+SCIM 2.0 APIs are now generally available in the US Gov cloud, giving customers, developers, and partners a standards-based option for managing users and groups in Microsoft Entra using the System for Cross-domain Identity Management (SCIM) 2.0 specification.
119
+
120
+---
121
+
122
+### General Availability - Microsoft Entra Backup and Recovery is now available
123
+
124
+**Type:** New feature
125
+**Service category:** Entra Backup and Recovery
126
+**Product capability:** Entra Backup and Recovery
127
+
128
+Microsoft Entra Backup and Recovery is a built-in solution to help restore your tenant after accidental changes or malicious updates. Always on by default, it automatically backs up critical directory objects — including users, groups, applications, service principals, managed identities, Conditional Access policies, named locations, agent IDs, and authentication and authorization policy, so admins can quickly restore them to a previously known good state.
129
+
130
+At preview, Entra Backup and Recovery automatically takes daily backup of a tenant's supported directory objects. If a tenant has Microsoft Entra ID P1 or P2 licenses, one backup is taken each day and retained for 7 days. Admins can view available snapshots, generate difference reports to understand what has changed, and run recovery jobs to restore objects to a prior state.
131
+
132
+This gives your organization a reliable, built-in safety net helping you recover with confidence, minimize downtime, and protect your tenant from accidental changes, misconfigurations, or security compromises.
133
+
134
+---
135
+
136
+### Upcoming change - Improved restore experience for device-bound Authenticator app passkeys on iOS
137
+
138
+**Type:** Plan for change
139
+**Service category:** Microsoft Authenticator App
140
+**Product capability:** Identity Security & Protection
141
+
142
+No action is required.
143
+
144
+What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required.
145
+
146
+With this update:
147
+
148
+- Users who already have iCloud and iCloud Keychain backup enabled for the Authenticator app—and have device-bound Authenticator passkeys on their old device—will automatically benefit from this improved experience.
149
+- Users restoring their Authenticator app on a new iOS device will experience an updated restore flow.
150
+
151
+This change streamlines the restore experience by directing users to the right recovery path based on access to their old device and helping them understand cross-device passkey authentication, resulting in a smoother transition to a new phone.
152
+
153
+This update applies to iOS devices only. Android support will follow.
154
+
155
+[Learn more](https://support.microsoft.com/account-billing/back-up-account-credentials-in-microsoft-authenticator-bb939936-7a8d-4e88-bc43-49bc1a700a40) about the changes to backup and restore in Authenticator app.
156
+
157
+---
158
+
159
+### Public Preview - New built-in Entra role for SOC identity response in Microsoft Defender
160
+
161
+**Type:** New feature
162
+**Service category:** RBAC
163
+**Product capability:** Identity Security & Protection
164
+
165
+We're introducing a new built-in role in Microsoft Entra—**SOC Identity Responder**—to further improve how security teams execute identity containment actions initiated from Microsoft Defender using a least-privilege access model.
166
+
167
+Previously, performing these actions required SOC analysts to hold multiple high-privilege Entra roles or depend on identity administrators, creating delays during active investigations.
168
+
169
+With this update, **SOC analysts can be assigned a dedicated role purpose-built for identity response actions**, allowing them to perform key actions—such as disabling users, revoking sessions, and forcing password resets—without being granted broad directory administrative privileges.
170
+
171
+Access to this role supports flexible assignment models, including **role-assignable groups** for managing permissions through group membership and delegated ownership. Optional integration with **Privileged Identity Management (PIM)** enables just-in-time activation and enhanced governance controls.
172
+
173
+These actions continue to be enforced and audited by Microsoft Entra, ensuring consistency with existing RBAC and compliance controls.
174
+
175
+---
21176
22177
## May 2026
23178
⋯ 1186 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.