Control who can create agent blueprints in Microsoft Entra
Starting in November 2026, Microsoft Entra default users can create agent blueprints unless an admin turns it off. How to change the setting in Entra ID and via Microsoft Graph.
Microsoft Entra
Users can now manage their sponsored Entra ID guest accounts in My Account (Preview)
Users who act as sponsors for external B2B guest accounts can now review and manage those guests directly in My Account, including extending or ending their sponsorship. This capability is currently in public preview.
Microsoft Entra admin role changes for access to App Governance in the Defender admin portal
Microsoft is aligning access to App Governance in Defender with Defender XDR Unified RBAC. Some Microsoft Entra admin roles will gain or lose permissions in October 2026.
Permission update for the AI Administrator role in Entra ID
Microsoft added a new privileged permission to the AI Administrator role in Entra ID. Users with the role can now grant admin consent to delegated permissions for applications and agents.
Restricting the new Copilot desktop app with Entra ID Tenant Restrictions
Learn how to restrict the new Copilot desktop app to allowed organizations using Entra ID tenant restrictions, blocking personal Microsoft accounts and unauthorized tenants on managed Windows clients.
Microsoft accidentally created a new “All Company” group in Entra ID
Microsoft accidentally created a new “All Company” Microsoft 365 group in some tenants during a July incident. Administrators should check whether their tenant now has two such groups for Viva Engage.
Microsoft Entra: Migrating GitHub Actions Federated Credentials to Immutable Subjects
Microsoft recently recommended migrating GitHub Actions federated credentials to an immutable subject format in Microsoft Entra app registrations. This closes a subtle security gap where recycled repo or org names could let someone else’s token match your trust configuration. In this post, I walk through what the migration actually involves. I also tested the newer Flexible Federated Identity Credentials (FFIC), currently in preview.
The Microsoft 365 Admin Agent is now a Microsoft-managed agent
The Microsoft 365 Admin Agent is now generally available as a Microsoft-managed agent, giving all administrators with an Entra built-in role AI-powered access across the admin center and Copilot Chat. If you don’t need this agent, block it.
New admin role in Microsoft Entra: Entra SOC Identity Responder
Microsoft has introduced a new admin role: Entra SOC Identity Responder. The role lets SOC analysts disable accounts, revoke sessions, and reset passwords for rapid incident containment without broader Entra admin access.
New admin role in Microsoft Entra: Entra Customer Lockbox Approver
Microsoft is preparing a new Entra admin role. The Entra Customer Lockbox Approver role provides a least privileged option for approving Customer Lockbox requests in Azure.