Control who can create agent blueprints in Microsoft Entra
Starting in November 2026, Microsoft Entra default users can create agent blueprints unless an admin turns it off. How to change the setting in Entra ID and via Microsoft Graph.
Entra ID
Users can now manage their sponsored Entra ID guest accounts in My Account (Preview)
Users who act as sponsors for external B2B guest accounts can now review and manage those guests directly in My Account, including extending or ending their sponsorship. This capability is currently in public preview.
Permission update for the AI Administrator role in Entra ID
Microsoft added a new privileged permission to the AI Administrator role in Entra ID. Users with the role can now grant admin consent to delegated permissions for applications and agents.
Microsoft accidentally created a new “All Company” group in Entra ID
Microsoft accidentally created a new “All Company” Microsoft 365 group in some tenants during a July incident. Administrators should check whether their tenant now has two such groups for Viva Engage.
Microsoft Entra: Migrating GitHub Actions Federated Credentials to Immutable Subjects
Microsoft recently recommended migrating GitHub Actions federated credentials to an immutable subject format in Microsoft Entra app registrations. This closes a subtle security gap where recycled repo or org names could let someone else’s token match your trust configuration. In this post, I walk through what the migration actually involves. I also tested the newer Flexible Federated Identity Credentials (FFIC), currently in preview.
New admin role in Microsoft Entra: Entra SOC Identity Responder
Microsoft has introduced a new admin role: Entra SOC Identity Responder. The role lets SOC analysts disable accounts, revoke sessions, and reset passwords for rapid incident containment without broader Entra admin access.
New admin role in Microsoft Entra: Entra Customer Lockbox Approver
Microsoft is preparing a new Entra admin role. The Entra Customer Lockbox Approver role provides a least privileged option for approving Customer Lockbox requests in Azure.
Passkey changes in Microsoft Entra registration campaigns
Passkeys (FIDO2) are being added as a supported targeted authentication method in Microsoft Entra registration campaigns. In addition, tenants in the Microsoft-managed state that meet specific criteria will see additional configuration changes.
Microsoft-managed default app consent policy will block 8 additional permissions
Microsoft is updating the Microsoft-managed default user consent policy for Microsoft Graph as part of the Secure Future Initiative, requiring admin consent for an expanded set of delegated permissions accessing Exchange data.
New admin role in Microsoft Entra: AI Reader
A new AI Reader role in Microsoft Entra provides broad read-only access to Copilot and Agent 365 settings, usage reports, service health, and Entra ID objects.