SSPR stops accepting unregistered phone numbers and email addresses on 9 November
From 9 November 2026, self-service password reset in Microsoft Entra ID only accepts authentication methods a user has actually registered. Phone numbers and email addresses that only exist as …
Two live demos from Nashville: how far Conditional Access and restricted AUs reach
On September 10 I was on stage at HIP Conf 26 in Nashville, talking about a shared Entra ID tenant for critical infrastructure. What makes that tenant unusual is that the admins sign in as B2B guests …
Entra Connect Sync to Cloud Sync: what the guided migration covers and what stays behind
Since Entra Connect Sync 2.6.91.0 there is a "Transition to Cloud Sync" task in the Connect wizard, and Microsoft is moving tenants over in waves. The tool is deliberately narrow and most enterprise …
Moving ID Protection risk policies to Conditional Access before 1 October
On 1 October 2026 Microsoft retires the user risk and sign-in risk policies configured in the ID Protection blade, and risk-based access then lives in Conditional Access only. The deadline has been …
Passkeys by default: what we're running into
Microsoft is ending its own delivery of SMS and voice authentication in Entra ID. Plenty has been written about it already and the timeline is well known by now, so I'll put that down briefly below …
Azure mandatory MFA Phase 2: which identities break at the Resource Manager layer
Since 1 July 2026, no tenant can push Phase 2 of Azure's mandatory MFA back any further. Every create, update or delete that a user account sends to Azure Resource Manager now needs MFA, whatever …
Register security information now also applies to Windows Hello for Business and Platform SSO
On Monday 6 July Microsoft starts rolling out a change that makes Conditional Access policies targeting the user action Register security information also apply when users provision Windows Hello for …
Conditional Access on All resources: the baseline scopes exemption ends on 15 June
If you have a Conditional Access policy on All resources with even one resource excluded, there is a small class of sign-ins that policy has never evaluated: clients that ask only for OIDC scopes or …
AI against AI (part 2): What is UEBA in Microsoft Sentinel and why you need it
In my previous blog AI against AI, I described how attackers increasingly use artificial intelligence to stay under the radar. Phishing is getting smarter, attacks are becoming more subtle, and abuse …
Agent 365 is GA: what an IAM team has to decide about Entra Agent ID
Since 1 May 2026, Microsoft Agent 365 and Microsoft Entra Agent ID are generally available, and every agent built on the new platform gets its own identity in your tenant. The launch itself is well …