While the official Microsoft Entra “What’s New” page on Microsoft Learn hasn’t been updated with a July 2026 section yet (it still shows June 2026 as the latest), Microsoft has been busy shipping new announcements across Tech Community blog posts, M365 Message Center notifications, Azure Updates, and Microsoft Graph API documentation. This week’s detection run surfaced six new items that identity and security teams should be aware of.

Here’s what’s new, why it matters, and what actions your organization should take.

1. Enhanced Audit Log Properties for Service Principals

Announced: Early July 2026 Status: Generally available Source: Microsoft Learn

Microsoft Entra now captures enhanced metadata in audit logs when service principals are created, making it significantly easier to understand the origin and intent behind each creation event.

What’s New

Three new properties are now logged within the “Add service principal” activity under the ApplicationManagement category:

  • ServicePrincipalProvisioningType — An enum that describes how and why the service principal was created. Values include:

    • defaultMicrosoft — Created by Microsoft as part of a default eligibility or system-managed process
    • subscription — Created because your tenant has an eligible subscription/SKU (commerce-based JIT provisioning)
    • managerApplications — Created by a Microsoft-managed “manager” application with permission to manage other service principals
    • AzureResourceProvider — Created by an Azure resource provider during service onboarding (e.g., Azure Data Explorer)
    • Other — Other provisioning mechanisms, including delegated and app-only flows

  • SubscribedSkus — A JSON array that links a Microsoft service principal created via commerce-based JIT provisioning back to the specific subscriptions and service plans that made it eligible

  • AppOwnerOrganizationId — The home tenant ID of the application registration that owns the service principal

Why This Matters

Service principal creation events have long been a blind spot for security teams. When a new SP appears in a tenant, the critical question is: “Did a human create this, or did a Microsoft service provision it automatically?” Previously, answering that question required cross-referencing Microsoft Graph API calls, checking subscription details, and sometimes digging through activity logs across multiple systems.

With these new properties, security teams can immediately distinguish between Microsoft-driven provisioning (expected platform behavior) and tenant-initiated actions (which may warrant investigation). This is particularly valuable for detecting potential compromise scenarios where an attacker creates a service principal to establish persistence in a tenant.

How to Use It

These properties appear in the Additional details section of “Add service principal” events in the Entra admin center’s audit logs (Monitoring & health > Audit logs). They’re also available through Microsoft Graph API queries and in the Log Analytics AuditLogs table.

Required roles: Security administrator, Security reader, or Reports reader.

2. Stricter Federation Token Validation Policy — August 2026 Enforcement

Announced: July 9, 2026 (MC1303719) Enforcement: Mid-August 2026 Act by: August 11, 2026 Source: M365 Message Center

Microsoft Entra will change the default behavior of federatedTokenValidationPolicy to block federated sign-ins when the internalDomainFederation configuration doesn’t match the user’s UPN domain. This is a security hardening measure that prevents cross-domain federated sign-ins caused by misconfigured or overly permissive federation trust relationships.

What’s Changing

  • Before: Blocking cross-domain federated sign-ins required explicit tenant configuration
  • After: Cross-domain sign-ins are blocked by default starting mid-August 2026
  • Scope: All federated domains with an internalDomainFederation object, particularly those configured before December 2025 (domains added since December 2025 already have this stricter behavior)
  • Error on blocked sign-ins: AADSTS5000820: Sign-in blocked by Federated Token Validation policy. Contact your administrator for details.

Who’s Affected

  • Organizations using federated authentication (AD FS or third-party IdPs)
  • Tenants with federated domains configured before December 2025
  • Only affects environments where cross-domain federated sign-ins are actually occurring

What to Do

  1. Inventory your federated domains using PowerShell:

    Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain | Select-Object Id, AuthenticationType, IsVerified

  2. Check for UPN/federation domain mismatches — compare user UPN suffixes against federated domain names

  3. Review sign-in logs for cross-domain federated sign-ins (Entra admin center > Monitoring & health > Sign-in logs, filter by authentication = federated)

  4. If cross-domain sign-ins are needed (strongly discouraged), create a custom federatedTokenValidationPolicy with rootDomains = none via Microsoft Graph

  5. Communicate to helpdesk — users may see the AADSTS5000820 error starting mid-August if cross-domain federation was occurring

Cloud-only and password hash sync organizations: No action required.

3. Azure Blob Storage SFTP with Microsoft Entra ID — Generally Available

Announced: July 9, 2026 Status: Generally available Source: Azure Updates

Azure Blob Storage SFTP now supports Microsoft Entra ID-based identities for access management, eliminating the need for separate SFTP-specific credentials.

What’s New

  • Users authenticate to Azure Blob Storage SFTP using their Microsoft Entra ID identity
  • Supports both internal and external Entra identities
  • Enables Conditional Access policies for SFTP access (MFA, device compliance, network restrictions)
  • Centralizes access management through Entra ID governance rather than managing local SFTP credentials

Why This Matters

SFTP has traditionally been a credential management headache — each user needs a separate set of credentials, there’s no integration with identity governance, and conditional access policies can’t be applied. By bringing Entra ID authentication to SFTP, Microsoft eliminates credential sprawl and extends identity-based security controls to a protocol that was previously outside the modern identity perimeter.

For organizations with regulated workloads that require SFTP for partner or B2B data exchange, this means SFTP access can now follow the same governance model as all other cloud resource access — with full audit trails, conditional access enforcement, and lifecycle management through Entra ID.

Getting Started

Configure SFTP on your Azure Blob Storage account and assign Entra ID-based permissions through Azure role assignments. Users can then authenticate using their Entra credentials instead of local SFTP passwords.

4. New Entra ID Service Plans for Agent Security

Announced: Early July 2026 Source: M365 Message Center / AdminDroid

Microsoft is introducing two new service plans to support AI agent security capabilities in Microsoft Entra ID:

  • Entra Conditional Access for Agents — Enables Conditional Access policies specifically targeting AI agent identities
  • Entra ID Protection for Agents — Extends Identity Protection risk detection and remediation to AI agent accounts

What’s New

These service plans are included with:

  • Microsoft E7 licenses
  • Microsoft 365 Agent licenses

Organizations that want to use Conditional Access and Identity Protection for AI agents will need to transition to the updated licensing model.

Why This Matters

This announcement represents the commercial framework for Microsoft’s agent security strategy. While the technical capabilities for securing AI agents (Agent ID, Conditional Access for agents, agent risk detection) have been shipping over the past few months, the licensing model is now being formalized.

For organizations deploying AI agents at scale, this means:

  • Conditional Access policies can target agent identities with the same precision as human users
  • Identity Protection can detect and respond to risky agent activity (compromised agent credentials, anomalous API access patterns)
  • The licensing is bundled with the broader agent platform (Microsoft 365 Agent, E7) rather than requiring separate identity security add-ons

What to Do

  1. Check your current licensing — Determine whether your organization has E7 or Microsoft 365 Agent licenses
  2. Plan for agent security — If you’re deploying AI agents, factor in the need for these service plans
  3. Review the Extended Conditional Access for Agent’s user accounts feature (announced in June 2026 as Public Preview) to understand the technical capabilities these plans unlock

5. App Instance Lock Enabled by Default for New Applications

Announced: June-July 2026 (MC1300584) Status: General Availability (rollout completed late June 2026) Source: M365 Message Center, Microsoft Learn

App Instance Lock is now enabled by default for all newly created applications in Microsoft Entra ID. This protects sensitive service principal properties from being modified outside the application’s home tenant.

What’s Protected

The following properties are locked by default:

  • keyCredentials — Certificate-based credentials used for signing tokens
  • passwordCredentials — Password-based credentials used for verification
  • tokenEncryptionKeyId — Token encryption key reference

When locked, any attempt to modify these properties from outside the home tenant returns a 400 Bad Request error, and the modification is not applied.

Why This Matters

App Instance Lock addresses a class of attack known as “app hijacking” — where an administrator in a customer tenant creates credentials on a multi-tenant application’s service principal, then uses those credentials to impersonate the application. This technique has been used in real-world attacks including the famous SolarWinds campaign.

By enabling this lock by default for all new applications, Microsoft ensures that the most common attack path for multi-tenant app compromise is blocked without requiring app developers to opt in. Existing applications are not affected by this change.

What to Do

  1. For new applications: No action needed — the lock is enabled automatically
  2. For existing applications: Consider enabling App Instance Lock manually if not already configured
  3. Review automation/scripts: Ensure provisioning workflows don’t depend on modifying service principal credentials from outside the home tenant
  4. If updates are needed: Admins can disable the lock per-application via the Entra admin center or Microsoft Graph

To enable for existing applications via PowerShell:

Connect-MgGraph -Scopes "Application.ReadWrite.All"
$params = @{
    servicePrincipalLockConfiguration = @{
        isEnabled = $true
        allProperties = $true
    }
}
Update-MgApplication -ApplicationId "<APPLICATION_OBJECT_ID>" -BodyParameter $params

6. Microsoft Graph API July 2026 Identity Updates

Announced: July 8, 2026 Status: Public Preview Source: Microsoft Graph What’s New

The July 2026 Microsoft Graph API updates introduce several new identity and governance capabilities in public preview, enabling more programmable and automated identity management.

Programmatic FIDO2 Passkey Registration

New APIs allow programmatic registration of FIDO2 passkeys:

  • Use the creationOptions function to generate WebAuthn credential creation options
  • Complete registration by posting the publicKeyCredential property to the fido2AuthenticationMethod resource

Why it matters: Enables bulk/automated passkey provisioning for organizations onboarding large numbers of users to phishing-resistant authentication, rather than requiring each user to register manually.

Access Package Suggestions

New accessPackageSuggestion resource type and related methods:

  • Discover suggested access packages based on related people insights and assignment history
  • filterByCurrentUser function for personalized suggestions
  • New endUserSettings resource for configuring suggestion behavior and approver detail visibility

Why it matters: Brings intelligent recommendations to Entitlement Management, helping users discover access packages they may need based on what similar users have — reducing both over-provisioning and access gaps.

Lifecycle Workflows Enhancements

  • cancelProcessing method to cancel in-progress or queued workflow runs
  • Automatic quarantining when workflows process more users than expected, with configurable thresholds via quarantineConfiguration property on lifecycleManagementSettings
  • clearQuarantine to clear quarantine state
  • Preview operations to validate tasks without affecting production users

Why it matters: Improves reliability and safety of automated lifecycle workflows. Quarantine behavior prevents runaway workflows from affecting more users than intended, while the cancel capability gives admins an emergency brake. Preview mode enables testing without risk.

Access Package Subject Management

  • Get and Update methods on accessPackageSubject for managing external directory user subject lifecycle
  • approverInformationVisibility property on accessPackageApprovalStage to control whether approver info is visible to requestors
  • type property on accessPackageResourceRole to indicate whether Azure resource roles are active or eligible (enabling PIM-based role assignments in access packages)

Why it matters: Provides finer-grained control over access package governance — from managing external user lifecycle to controlling information visibility in approval workflows to supporting PIM-based just-in-time access through access packages.

The Bigger Picture: Identity Security Maturation in 2026

These six announcements, while individually significant, collectively tell a story about the maturation of identity security in 2026:

  1. Visibility is improving — Enhanced audit log properties for service principals close a critical gap in understanding what’s happening in your tenant. You can now answer “who created this service principal and why?” without needing forensic investigation.

  2. Security defaults are getting stronger — App Instance Lock by default and stricter federation token validation both represent Microsoft raising the security floor without requiring explicit opt-in. The trend is clear: secure-by-default is becoming the standard, not the option.

  3. AI agent security is being formalized — New service plans for agent Conditional Access and Identity Protection show that Microsoft is building the commercial and technical framework for governing AI agents with the same rigor as human identities.

  4. Automation is expanding — The Graph API updates (programmatic passkey registration, workflow cancel/quarantine, access package suggestions) show Microsoft investing in the programmability of identity governance — making it easier to manage identities at scale through code rather than manual processes.

  5. Traditional protocols are joining the modern identity era — Entra ID-based authentication for SFTP brings a legacy protocol into the Conditional Access and identity governance fold, eliminating a long-standing gap.

What You Should Do Now

  1. Review your service principal audit logs — Filter for “Add service principal” events in the last 30 days and use the new ServicePrincipalProvisioningType property to identify any unexpected tenant-initiated creations.

  2. Audit your federation configuration — If you use AD FS or third-party IdPs, verify that UPN domains match federation domains before the August 2026 enforcement. Cross-domain sign-ins will break.

  3. Enable App Instance Lock on existing multi-tenant apps — Even though this is only default for new apps, existing multi-tenant applications should have this enabled proactively.

  4. Evaluate your agent security licensing — If AI agents are in your roadmap (and they should be), determine whether you need the new Entra Conditional Access for Agents and Entra ID Protection for Agents service plans.

  5. Explore the Graph API preview features — If you manage identity at scale through automation, the programmatic FIDO2 registration and Lifecycle Workflows quarantine APIs are worth testing in a dev tenant.

  6. Check if you’re using SFTP on Azure Blob Storage — If so, evaluate migrating from local credentials to Entra ID-based authentication for improved governance and security.

Kevin Kaminski is the owner of Big Hat Group Inc., a Microsoft partner focused on AI and cloud technologies. Follow him at https://x.com/kkaminsk for more Microsoft Entra insights.