Microsoft Entra November 2026 Update Brings New MFA, Security, and AI Agent Features

Microsoft has announced several new features for Microsoft Entra in November 2026, focusing on identity security, multifactor authentication (MFA), access management, and AI agent governance.

The update includes both generally available features and public previews, giving IT administrators more options to manage identities, permissions, and authentication across their organizations.

Microsoft Entra gets new identity security and access management features

According to Microsoft’s November 2026 announcement, several new identity and access management features are entering public preview.

Access package drift detection introduces daily reports that help administrators identify excessive or missing permissions. Microsoft is also adding application group discovery and governance, allowing organizations to classify groups as local, unassigned, or assigned.

Other improvements include cloud firewall support for Global Secure Access clients and better access to private resources for employees working from home.

Microsoft is also introducing automated guest lifecycle policies to help organizations manage external users and reduce unnecessary access.

Microsoft improves MFA and continuous access evaluation

Several authentication improvements are now generally available, including the ability to register passkeys and other passwordless sign-in methods as the first MFA method.

This follows Microsoft’s continued push to move Entra ID users away from SMS authentication toward passkeys.

Windows Hello for Business and macOS Platform SSO can now function as standalone MFA factors, while Microsoft Authenticator receives improved backup and restore capabilities on Android.

Continuous Access Evaluation (CAE) now incorporates device and risk signals, helping organizations respond to changes in security conditions.

Microsoft Entra Internet Access also gains support for custom HTTP headers, giving administrators additional options for managing network access.

Microsoft adds new telephony and hybrid identity options

Microsoft is giving organizations more control over SMS and voice authentication by allowing administrators to choose their own telephony providers.

Organizations should complete the transition by February 1, 2027, when Microsoft plans to retire its existing telephony provider.

Meanwhile, Microsoft Entra Cloud Sync can now synchronize Active Directory computer objects with Entra ID, helping organizations manage hybrid device joining.

AI agent identity governance enters public preview

Microsoft is also expanding Entra’s identity management capabilities to cover AI agents.

A new public preview introduces automated lifecycle management for AI agent identities, allowing organizations to manage their identities and access throughout their lifecycle.

The feature aims to give administrators better oversight of AI agents as businesses increasingly use them alongside traditional user accounts and applications.

The November update continues Microsoft’s efforts to strengthen identity security and simplify administration across hybrid and cloud environments.

In a separate security-related change, Microsoft is removing custom CSS layout options from Entra ID to help prevent phishing attacks.