Microsoft has documented hard deletion protection for Entra ID directory objects, adding a seven-day safeguard against permanent removal after an object is soft-deleted. The feature can protect selected users, groups, applications and service principals, but administrators should choose carefully: once enabled on an object, protection cannot be turned off.

Source

Microsoft is testing a Windows Hello update that lets Windows 11 users enter a PIN while face or fingerprint recognition is still running. Experimental build 26340.9882 also introduces sign-in logs for IT administrators. The changes are rolling out gradually, and Microsoft has not announced a general release date.

Source

Microsoft Entra ID is rolling out a preview that lets users change their password without entering the current one, after signing in with an approved strong method. The option appears in My Sign-Ins and can avoid a self-service password reset or help-desk call. The feature is off by default, and rollout is expected to reach all tenants by the end of November 2026.

Source

Microsoft Entra ID’s memberOf operator, which builds dynamic groups from members of other groups, retires worldwide on November 3, 2026. Any affected configurations left in place will stop processing updates and remain frozen, potentially leaving access and licenses out of date.

Source

Microsoft Execution Containers (MXC) sandbox AI agents, limiting which files and network resources they can access; process-container support spans Windows 11, macOS, and Linux. Microsoft is also expanding Project Perception with agent-specific identities, task-scoped permissions, and controls that can tighten access or stop an agent as its risk changes. The goal is to govern agents as distinct actors—not simply trust the user accounts they operate under.

Source

Microsoft says organizations should treat attackers probing OneDrive URLs for usernames as a low-risk threat, not a sign that accounts have been breached. The probes can reveal user principal names (UPNs), which attackers might later use for phishing, credential stuffing, or social engineering. Microsoft recommends strong identity protections to limit that downstream risk.

Source

Only 13% of organizations believe they have adequate AI-agent governance, according to Gartner data cited by IBM. Microsoft’s guidance gives identity teams a practical starting point: strengthen authentication, remove standing privileges, and apply consistent access policies so agent identities receive least-privilege protections.

Source

Microsoft reports two intrusions that turned Teams help-desk impersonation and user-approved Quick Assist sessions into attacks on Active Directory Certificate Services (AD CS), which issues certificates used for authentication. One attacker abused an ESC1 template and continued using a privileged account excluded from automated containment to steal data. In a separate ESC8 attack, isolating the affected workstation stopped further observed activity.

Source

Azure customers facing compute shortages may need to change regions or accept different hardware—but Microsoft’s Future Capacity Reservations still don’t guarantee resources will be available when deployment begins. Microsoft also detailed Copilot Studio agent accounts and new controls for its Sovereign Cloud, giving IT teams more identity and governance work to plan for.

Source

Microsoft Entra’s AI-driven identity protection is designed to spot suspicious sign-ins and help organizations respond to identity attacks. Microsoft says its controls can cut investigation time by up to 90 percent by automating risk detection, investigation, and remediation.

Source

Microsoft has put Entra ID Conditional Access policy plans in public preview, giving administrators a way to organize related access rules around shared conditions and exclusions. The plans can reduce duplicated settings, but they run alongside existing policies rather than replacing them.

Source

Microsoft Authenticator, which handles sign-in approvals and verification codes, will get clearer backup and restore guidance on Android in mid-January 2027. The update builds on Microsoft’s move to shift Android backups to Google One and adds help for using passkeys to sign in across devices.

Source

On April 1, 2027, SharePoint Online and OneDrive will stop returning pre-authenticated URLs from Microsoft Graph, the REST API for Microsoft 365 data, for common file operations. Today those links carry a short-lived SharePoint credential in the tempauth query string, so a follow-up download or upload works without a token in an Authorization header. After the change, apps must send a Microsoft Entra ID access token in that header instead. Many flows then need two tokens: one for Graph and one for your SharePoint tenant host. A tenant setting can route some apps to Graph URLs so they stay on the Graph token only.

Source

Dell is extending PowerProtect and its storage portfolio to help organizations recover identity systems, protect AI workloads, and prepare for quantum-era threats. New capabilities include trusted restores for Active Directory, Entra ID, and Okta, plus quantum-safe encryption for PowerStore Fibre Channel traffic. Some features are available now; others are scheduled through December 2026.

Source

HashiCorp Vault manages credentials for applications and services; IBM is extending it to AI agents with verified identities and short-lived credentials. Agent Identity records each agent’s owner, status, and permissions, while Vault can deny unauthorized access and terminate the session. IBM is also expanding watsonx Orchestrate to find and contain agents built on other platforms.

Source

Microsoft Authenticator, which handles sign-ins on Android, has been patched against CVE-2026-80097, a high-severity flaw that could expose work-account tokens. A malicious app with no Android permissions could exploit the issue, but the attack required the user to complete an authentication flow.

Source

Microsoft Entra ID, Microsoft’s cloud identity service, lets organizations brand their sign-in pages. As of October 26, 2026, custom CSS layout and positioning options are retired to reduce phishing risks. The change affects organizations that used custom CSS before July 21; their branding remains, but Microsoft’s default layout now controls its placement.

Source