Don’t miss our Microsoft Ignite announcements. Tune in or join us in person for AI is changing access: See how Microsoft Entra helps you stay ahead on November 18, 2026, at 10:15 AM Pacific for secure access news and demos from our latest product roadmap.
Access is never a one-time decision. Employees change roles, devices fall out of compliance, AI agents get created and forgotten, and guests outlast the projects they joined for. But it’s not just identities that change: risks shift in real time and attacks never let up. Customers tell us the hardest part is keeping access secure as users, devices, agents, and guests change over time while threats evolve by the minute.
This month’s releases help you stay ahead of both: lifecycle policies for agent and guest identities, drift detection and group discovery for governed access, continuous access evaluation that responds to device and user risk signals within minutes, and phishing-resistant sign-in from the very first MFA method.
Here’s everything new in Microsoft Entra from October 2026, organized around the outcomes you’re trying to achieve:
Outcome: Keep my organization trusted and resilient
Detect drift in access package entitlements | Public Preview
Access package drift reports help you spot where real-world access diverges from policy intent. Flag over‑granted permissions or missing assignments and restore alignment with a click. Reports refresh daily and require Microsoft Entra ID Governance or Microsoft Entra Suite.
Learn more →
Discover and govern application groups | Public Preview
Account discovery now extends to groups. Find groups created directly within connected apps and bring them under governance. Classify them as local, unassigned, or assigned to streamline administration.
Learn more →
Outcome: Give users and agents secure access without friction
Apply a cloud firewall for Global Secure Access clients | Public Preview
Cloud firewall in Microsoft Entra Internet Access now covers Global Secure Access client traffic, allowing granular control over outbound network connections through rule‑based security profiles.
Learn more →
Support home network users reaching private access resources | Public Preview
Home network support ensures users can reach resources (printers, routers, displays) on their local network without disconnecting from Global Secure Access. The Prefer Local Network feature routes overlapping traffic directly to home devices.
Learn more →
Automate guest lifecycle policies for stronger security posture | Public Preview
Define guest policies based on sponsor attestation, recent activity, or redemption state. Automatically disable or delete guests who no longer meet requirements, reducing stale external access.
Learn more →
Register a passkey or passwordless sign-in as the first MFA method | General Availability
Users can now start with phishing-resistant authentication from day one—registering a passkey or passwordless option as their first MFA method. Rollout continues through February 2027.
Learn more →
Use Windows Hello for Business and macOS Platform SSO as standalone MFA factors | General Availability
These device-bound credentials now qualify as standalone MFA factors across step-up prompts, Authentication Strength, and sign-in frequency checks—no additional passkey required. Rollout begins early November 2026.
Learn more →
Improve backup and restore for Microsoft Authenticator on Android | General Availability
New guidance simplifies secure backup of passkeys. Requires Google One backup and screen lock; applies only to personal profiles. Rollout begins January 2027.
Learn more →
Inform Continuous Access Evaluation (CAE) with device and risk signals | General Availability
Universal CAE now evaluates both user and device risk. When a device is disabled or found noncompliant—or if high user risk is detected—the Global Secure Access client triggers reauthentication within two minutes.
Learn more →
Add custom HTTP headers in Microsoft Entra Internet Access | General Availability
Custom headers enable granular SaaS access control, enforcing tenant restrictions across services like GitHub and Slack at the network layer. TLS inspection remains required for HTTPS destinations.
Learn more →
Outcome: Reduce the cost and complexity of access management
Choose your own telephony provider for SMS and voice authentication | General Availability
Organizations can now select supported providers (Soprano, Telesign, Infobip) for SMS and voice delivery while Entra continues managing authentication logic. Setup before February 1, 2027, when Microsoft-provided delivery retires.
Learn more →
Sync devices to Entra ID for hybrid join | General Availability
Entra Cloud Sync can now synchronize AD computer objects to Entra ID, enabling hybrid join. Admins simply enable device sync within Cloud Sync configuration.
Learn more →
Outcome: Adopt AI safely at enterprise scale
Automate lifecycle management of agent identities | Public Preview
Policy-based guardrails help ensure agent identities don’t outlive their purpose. Configure reconfirmation intervals, sponsor requirements, and inactivity monitoring. A default inactivity policy (available to all tenants, no license required) notifies owners after 60 days of inactivity and disables the identity if no new activity occurs.
Learn more →
Tell Us What You Think
We began organizing this series around customer outcomes last month. Is that making it easier to connect what we’re shipping to the challenges you’re working through? I’d welcome your feedback in the comments.
Onwards,
Yina Arenas
Corporate Vice President and Chief Product Officer, Microsoft Identity and Network Access
Follow me on LinkedIn
Catch Microsoft Entra at Ignite, November 17-20, 2026, in San Francisco and online. See the Entra session schedule and RSVP today.
Learn More About Microsoft Entra
Secure access for people and agents to AI, applications, and resources with comprehensive identity and network access solutions.