Microsoft published its October 2026 Microsoft Entra update on 12 October 2026, adding device and user-risk signals to Universal Continuous Access Evaluation in Global Secure Access and making its Cloud Sync migration tool generally available. The changes affect identity, network access and provisioning teams that run hybrid identity, ServiceNow access requests, SAP SuccessFactors provisioning or B2B guest access.
Microsoft has also changed the format of the monthly Entra update. The company now groups releases by customer outcome rather than by product architecture, with identity and network access framed around resilience, user and agent access, operational complexity and enterprise AI adoption.
Adaptive access in Global Secure Access
Universal Continuous Access Evaluation in Global Secure Access is now in public preview with additional signals. It can use user-risk and device-revocation signals when adapting access, including cases where a device is deleted, disabled or becomes noncompliant. This gives administrators another policy response point when device state changes after sign-in.
Global Secure Access also adds B2B guest access in public preview. Guest users can connect while signed in to their home organisation's Microsoft Entra ID account, and the client detects partner tenants where the user is a guest. The user can switch to the customer tenant context, after which private traffic is routed through the customer's Global Secure Access service.
User and entitlement workflows
The improved Windows device registration experience is generally available. When users access resources through supported native applications protected by Microsoft Entra Conditional Access policies that require token protection, they can complete device registration during sign-in instead of using a separate workflow.
ServiceNow access request workflows are also generally available. Users can request access packages and view request history in ServiceNow, while designated approvers can approve or deny requests there. Access packages, policies and approver assignments remain managed in Microsoft Entra ID Entitlement Management.
Hybrid identity and provisioning
The guided migration tool from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync is generally available for eligible organisations. It brings readiness assessment, provisioning agent setup, Cloud Sync configuration, controlled activation and post-activation validation into one workflow.
Microsoft Entra now supports Workload Identity-based authentication for SAP SuccessFactors provisioning, and Microsoft lists this as generally available. The change replaces long-lived usernames and passwords with Entra-managed credentials and short-lived, standards-based access tokens. Customers can upgrade existing provisioning jobs in place without recreating or restarting them.
The SAP SuccessFactors change matters because SAP plans to deprecate basic authentication for its APIs in November 2026. The option supports inbound provisioning to Active Directory and Microsoft Entra ID, as well as writeback scenarios.
Null-value provisioning is in public preview. Microsoft Entra provisioning can now clear an existing target attribute when the corresponding source attribute is null or empty. The capability is available for API-driven inbound provisioning, Workday inbound user provisioning and SAP SuccessFactors inbound user provisioning to Microsoft Entra ID and on-premises Active Directory.
Custom call-outs with Azure Logic Apps during user provisioning are generally available for create events. Microsoft gives unique employee aliases as an example of an advanced attribute transformation. The support applies to HR inbound, SaaS outbound and cross-tenant synchronisation provisioning flows in Microsoft Entra.
Governance and TLS inspection
Microsoft Entra ID Governance can now discover groups and group memberships in connected applications, with the feature in public preview. Administrators can identify local or orphaned groups without a matching Microsoft Entra object. They can also find groups and users without a corresponding application assignment in Microsoft Entra ID.
Global Secure Access adds Microsoft-managed certificates for Transport Layer Security inspection in public preview. Previously, customers had to provision and manage their own certificates and trust chains for TLS inspection. Under the new option, Microsoft provisions the inspection certificate, so customers do not need to operate their own certificate authority or public key infrastructure for this use.
Agent identity direction
The October update links the Entra work to Microsoft's broader Secure AI position. Microsoft says organisations need visibility and control over AI agents, including what agents exist, what they can access and how protections change as context and risk change.
Microsoft says it will share more at Microsoft Ignite from 17 to 20 November 2026, including the role of Microsoft Entra and Agent 365. The October post does not list pricing changes for these Entra updates.
Device-based CAE signals, ServiceNow approvals, SAP provisioning credentials and the governance of agent access are the kinds of control points that ECS's Security topic treats alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions give attendees room to compare policy design, migration sequencing and operational experience from tenants with similar identity constraints. Bring the Entra scenarios that are difficult to settle from documentation alone, particularly where access, device state and AI agents meet.
Photo: Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons, cropped
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.