JanBakker.tech

New routing option in Global Secure Access Private Access: Performance.

Mon, 09 Nov 2026 00:00:00 +0100

Microsoft Entra Global Secure Access has a new routing option for Private Access connector groups: Performance. It is currently in preview.

What Performance routing does#

When a connector group has multiple connectors, the group selects which connector handles each request. Performance routing automatically directs user traffic to the connector with the lowest network latency, measured by round-trip time (RTT).

How to secure passkey registration in Entra ID

Tue, 03 Nov 2026 00:00:00 +0100

MC1450133 will have a big impact on Entra ID. I got several responses when I posted about it on LinkedIn. This change has two sides:

It will massively improve the passkey registration flow, especially for new joiners and recovery scenarios, resulting in more users with phishing-resistant credentials.
It will remove a security boundary, so attackers can (and will) abuse it.

What will happen?#

Microsoft Entra will allow users to register passkeys or passwordless sign-in as their first multifactor authentication method, removing the prior requirement to set up alternate MFA methods first. The phased rollout begins in November 2026, aiming to simplify strong authentication adoption and reduce registration friction.

How to set up SMS or voice with your own telecom provider in Microsoft Entra

Tue, 03 Nov 2026 00:00:00 +0100

Bring your own SMS and voice provider to Microsoft Entra ID: setting up Soprano#

Microsoft is retiring Microsoft-provided SMS and voice authentication. If you still have users who genuinely need telephony, whether for regulatory reasons, shared devices, or field staff without smartphones, there is now one supported path: Choose Your Own Telephony Provider (CYOT), generally available since October 30, 2026.

Allow password change after secure sign-in

Fri, 30 Oct 2026 09:00:00 +0100

The use case#

Passwordless sign-in doesn’t remove every need for a password. Some users primarily sign in without a password but still need one for legacy applications. Microsoft Entra can let these users change their cloud password after a secure sign-in, without knowing or entering their current password.

A new workaround for authentication strength Conditional Access policy loops: Microsoft Authenticator Credential Registration service principal

Thu, 29 Oct 2026 10:00:00 +0200

Microsoft has added a new workaround for a specific Conditional Access loop that can stop users from registering a passkey in Microsoft Authenticator.

The loop can happen when a policy targets All resources and requires users to authenticate with a passkey in Authenticator. The policy then requires a passkey when a user is trying to add that same passkey. They can’t satisfy the requirement until registration is complete, which causes a loop or lockout.

Optimizations for passkey registration experience you might have missed

Tue, 27 Oct 2026 00:00:00 +0000

In my earlier post about the passkey onboarding experience, I discussed MC1440968. That update has now rolled out, and the registration wizard includes a useful improvement: end users can see which AAGUIDs are allowed to register.

The wizard now shows allowed AAGUIDs#

When you enforce specific passkey types, the wizard can show users the corresponding allowed AAGUIDs. This includes configurations for:

Prevent users from creating new agent identity blueprints

Fri, 16 Oct 2026 00:00:00 +0000

Starting 4 November 2026, every user without an Entra role can create agent identity blueprints in your tenant, unless you turn it off first.

Microsoft announced this on 13 October in MC1506733 - Action may be required: Review who can create agents in Microsoft Entra. Rollout starts in early November and should finish by late November 2026.

Cloud Sync provisioning agent fails to start with a gMSA

Mon, 12 Oct 2026 00:00:00 +0000

This is a knowledge base item. I hope it will help you someday.

The issue#

When installing an additional Microsoft Entra Cloud Sync provisioning agent, the agent service (AADConnectProvisioningAgent) would not start. I ran into two different errors, depending on the gMSA option I picked in the installer.

From WordPress to Hugo on Cloudflare

Sat, 03 Oct 2026 12:57:08 +0000

janbakker.tech is now running on Cloudflare, and that was long overdue. When I started my blog in 2021, I picked what I knew at that time, and what most of the other community members did: WordPress. That worked fine for all that time, with no big issues. Yet, it became slow and expensive, so I wanted to move it away.

Where to store your Microsoft 365 passkey?

Fri, 25 Sep 2026 16:00:51 +0000

Microsoft 365 (Entra ID) has supported passkeys for a long time now. From auto-registered passkeys like Windows Hello to synced passkeys.

I’ve created this tool to quickly see the current capabilities, to use for conversations with colleagues or customers. I try to keep the page current as features will be added or change. I will also expand the subpages with relevant context, risk considerations, dependencies, limitations, user experience, and caveats.

Entra ID telephony providers for SMS and voice MFA: first look

Fri, 25 Sep 2026 06:58:46 +0000

What was announced#

Microsoft has published the first documentation for Choose Your Own Telephony Provider in Entra ID, together with an FAQ that might answer some of your questions. It is the answer to one question many of us have been asking: what happens to users who really need SMS or voice MFA once Microsoft stops delivering those messages itself?

Finally a smooth(er) passkey onboarding experience in Microsoft 365!

Mon, 14 Sep 2026 15:35:23 +0000

Microsoft is doing a lot to enhance the onboarding of passkeys. The three major changes behind this are:

MC1450133 - Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

MC1440968 - Microsoft Entra ID: Optimizations for passkey registration experience

How to create a Microsoft 365 device-bound passkey on macOS

Sat, 22 Aug 2026 06:36:58 +0000

I did a discovery today, and I want to share it, because I did not know this was an option. Up until now, I always thought that device-bound passkeys where limited to Windows Hello for Business, FIDO2 security keys, and the Microsoft Authenticator App.

How to add granular amr claims to your SAML apps in Entra ID

Fri, 24 Jul 2026 08:18:03 +0000

In my last post, I covered how Entra ID now automatically sends the amr and acr claims for Salesforce, so its phishing-resistant MFA check finally has something to check. That part is automatic, no config needed.

Every other SAML app doesn’t get that automatically. Per Microsoft’s own optional claims reference, the app administrator still has to add the optional amr claim, with the include_granular_amr additional property, before authnmethodsreferences shows up in the assertion at all.

Lock or sign-out when Yubikey is removed from the device

Tue, 21 Jul 2026 13:53:20 +0000

I didn’t know there was already a solution for this, and maybe you are looking for it too. I learned about this from the Blue Security Podcast.

Meet: YubiKey Locker | Yubico

With YubiKey Locker, implement a protocol-agnostic security key removal policy that seamlessly integrates across various operating systems. This is important in meeting existing smart card customer security requirements (e.g. policies for smart card removal behavior), but also enables the forward-looking customer to bridge to modern protocols like FIDO2 passkeys, while staying compliant with their existing security policies. Moreover, the capability developed by Sciber enhances overall security posture for all organizations by locking the workstation or logging off the user when a YubiKey is not present, so it’s a great capability not only for those sunsetting legacy methods or form factors.

Writing Maester tests using AI - From idea to Pull Request

Tue, 21 Jul 2026 09:37:48 +0000

I love Maester. No doubt about that. I’ve made several contributions to this open-source project before, but it took me a lot of effort to learn how the underlying structure worked as a non-developer, and this challenge can be hard for a lot of Entra or Microsoft 365 admins out there.

Admin control for SSO prompts in Windows; finally, an off switch!

Thu, 16 Jul 2026 07:15:29 +0000

If you’ve been paying attention to the EEA sign-in changes over the past while, you’ll know Microsoft started prompting users before reusing their Windows credentials to sign in to other Microsoft apps and services. Good for user choice, less great if you’re an admin who just spent years getting SSO working and now watches it ask permission every time.

Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - A guide to stay calm

Tue, 14 Jul 2026 16:01:19 +0000

I don’t have all the answers, but I promise to keep this post updated with all the details I find.

Microsoft dropped a bomb by announcing it will stop funding phone-based MFA, such as SMS and voice, and that passkeys will become the new standard.

KB - employeeLeaveDateTime show empty (null)

Mon, 06 Jul 2026 09:41:25 +0000

This is a knowledge base item. I hope it will help you someday.

The issue#

When syncing the employeeLeaveDateTime attribute to Entra ID, the value shows null.

In this example, I use Graph Explorer to check the value.

Why Windows is the hardest passkey surface in 2026 and what Entra admins should expect

Mon, 06 Jul 2026 07:47:51 +0000

Written by: Corbado

If you have rolled out passkeys to a mixed device fleet, you might have probably noticed the following pattern. Some users log in smoothly and barely create a ticket (e.g. iPhone users), while others, like Windows users, do. Behind runs the same identity provider, same policy, same relying party but the user experience with passkeys can be very different depending on the user’s setup.

Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA

Fri, 26 Jun 2026 14:12:37 +0000

If you’ve been following the Salesforce phishing-resistant MFA (PRMFA) requirement story, you know the clock has been ticking. Salesforce has been pushing organizations to enforce phishing-resistant MFA for Salesforce administrators. The tricky part? Until now, Microsoft Entra ID has not always sent enough information in the SAML assertion for Salesforce to verify how the user authenticated, only that they authenticated.

Domainless SAML federation in Microsoft Entra External ID

Tue, 19 May 2026 06:42:09 +0000

If you’ve ever set up direct federation with a SAML Identity Provider in Microsoft Entra External ID, you’ll know the pain. You configure everything correctly, invite a guest user, and then they hit a cryptic error at sign-in:

AADSTS5000819: SAML Assertion is invalid. Email address claim is missing or does not match domain from an external realm.

Use Device Code Flow to register a passkey in Microsoft Authenticator App

Wed, 13 May 2026 15:43:32 +0000

The other day, I was doing some research in my lab, and had to register a new passkey a couple of times. At some point, I stumbled upon the device code flow in the Microsoft Authenticator app. I was aware of this flow, but I suddenly realized how easy it is to create a new passkey on a rogue/remote device, using social engineering. One more reason to block it!

Entra ID Governance - View approver information for pending requests

Mon, 04 May 2026 14:26:11 +0000

A new feature in Entra ID Governance was introduced and enabled by default.

When users request an access package and approval is needed, they can now see the name and email of the approver.

Configurable token lifetimes in Entra ID

Mon, 04 May 2026 14:01:00 +0000

Today, a quick post about setting up token lifetime policies in Entra ID. In some use cases, organizations require a short access token for highly privileged apps or resources. That said, this is probably NOT needed for the typical apps we all use day-to-day.

Your service principals probably don't need secrets

Mon, 20 Apr 2026 11:59:25 +0000

Application policies in Entra have been around for a while now to manage the use of secrets, but I don’t see many folks using them. It’s probably because secrets are still widely used, and an unlimited lifetime for secrets results in less yelling from developers. Everyone’s happy.

Yet, attackers love secrets and use them all the time. In obvious places, like app registrations, but also on service principals, where you don’t expect them. You cannot see or add them in the UX, but they can be added via the Graph API.

Block or limit multi-tenant and consumer applications in Entra ID

Wed, 15 Apr 2026 10:02:16 +0000

Two new policies have been added to the recently introduced Application Policies in Entra ID!

Admins can now restrict or block multi-tenant applications, and applications that support consumer sign-in (personal Microsoft accounts)

KB - Entra Private Access Session persistence

Wed, 08 Apr 2026 13:21:31 +0000

This is a knowledge base item. I hope it will help you someday.

**Update:**This setting can also be set from the Entra admin center now.

It can be set under the Network access properties of the Enterprise Application.

Conditional Access Optimization Agent knowledge base

Sun, 15 Mar 2026 06:57:10 +0000

Y’all know this song by the Beatles, right?

What would you think if I sang out of tune?
Would you stand up and walk out on me?
Lend me your ears, and I’ll sing you a song
And I’ll try not to sing out of key

Oh, I get by with a little help from my friends
Mmm, I get high with a little help from my friends
Ooh, I’m gonna try with a little help from my friends

How to get better with Graph API - Part one

Fri, 06 Mar 2026 19:28:30 +0000

As you might know, Graph API is an important part of Microsoft 365. Everything (or most) of the things you see in the Entra admin center or Microsoft Admin portal is pulled from the Graph API. Every button you click pulls data from or pushes data to the Graph API.