Microsoft Entra ID Mid-July 2026: SSO Admin Controls, Connect Sync Passkeys, MCP Authorization, and Directory Encryption

The Microsoft Entra ID updates keep coming thick and fast this July. While the blockbuster passkey-as-default announcement from last week is still reverberating across IT departments worldwide, Microsoft has quietly shipped several more updates between July 14-18 that deserve attention. From SSO prompt management on Windows to MCP authorization patterns and directory-level encryption controls, here’s your comprehensive breakdown.

1. Admin Control for SSO Prompts on Windows

Announced: July 14, 2026 Source: Microsoft Learn

The Problem This Solves

In the European Economic Area (EEA), Microsoft changed Windows sign-in behavior so that users are no longer automatically signed into other Microsoft apps and services after signing into Windows. Instead, Windows now prompts users with a consent dialog: “Continue to sign in?” — asking whether they want to use their Windows credentials to access additional apps and services.

This was a regulatory compliance move, giving users choice over how their Windows account is used. But for managed enterprise environments where IT already controls sign-in policies and trust relationships, this prompt creates unnecessary friction and support tickets.

The Solution

Starting with the July 2026 monthly security update (KB5101650) for Windows 11 version 24H2 and 25H2, IT administrators can now deploy a registry policy to automatically accept SSO permissions on eligible managed Windows devices:

Registry Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD Value: AutoAcceptSsoPermission (DWORD) = 1

Deployment Options

This policy can be deployed through:

• Group Policy (GPO) — traditional AD-based deployment
• Microsoft Intune or similar MDM tools
• Microsoft Configuration Manager
• Any management tool that supports registry policy deployment

Important Scope Limitations

• ✅ Applies to: Windows managed enterprise devices with Microsoft Entra ID accounts
• ❌ Personal accounts (MSA): No admin control available — prompts remain
• ❌ Unmanaged devices: No admin control available — prompts remain
• Supported OS: Windows 11 version 24H2 and 25H2 only (with KB5101650)

What IT Admins Should Do

1. Verify your devices are running Windows 11 24H2 or 25H2 with the July 2026 security update applied
2. Deploy the registry policy through your preferred management tool
3. Validate SSO behavior across your managed device fleet
4. Monitor for any unexpected prompts after deployment

This is a straightforward but welcome change for IT admins managing enterprise Windows fleets, especially those operating in or serving users in the EEA.

2. Entra Connect Sync v2.6.84.0: Passkeys Come to the Setup Wizard

Announced: July 7-14, 2026 Source: Microsoft Learn

Microsoft Entra Connect Sync may be on the path to eventual deprecation in favor of Cloud Sync, but it’s still receiving meaningful updates. Version 2.6.84.0 (replacing the pulled 2.6.79.0) brings several significant security and capability improvements.

Headline Feature: Passkey Authentication in Setup Wizard (Preview)

Administrators can now sign in using passkeys and FIDO2 security keys through Windows Web Account Manager (WAM) when configuring Microsoft Entra Connect. This is a preview feature that requires enabling via registry:

# Enable passwordless authentication
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure AD Connect" -Name "EnablePasswordlessAuth" -Value 1 -PropertyType DWORD -Force

After enabling, when running the installer, select Sign-in options → Face, fingerprint, PIN or security key and complete the prompt with your registered passkey or security key.

This aligns with Microsoft’s broader push to eliminate passwords from administrative workflows — if you’re configuring identity synchronization, you shouldn’t need a password to do it.

Other Notable Changes in v2.6.84.0

France Sovereign Cloud Support:

• Pass-through Authentication, Seamless SSO, password writeback, and Health Agent monitoring now supported in the France sovereign cloud environment

Security Hardening:

• No more silent fallback to the legacy directory synchronization account when Application-Based Authentication fails — the wizard now stops with a clear error
• No automatic switching of existing servers from legacy dir sync account to Application-Based Authentication during background sync
• PowerShell cmdlets (Set-ADSyncAADCompanyFeature, Set-ADSyncAADPasswordSyncState) now require explicit -AADUsername for interactive admin authentication
• Improved TPM-backed certificate handling — tests signing capability upfront and handles TPM signature verification correctly

Removed PHS Self-Healing:

• Password Hash Sync no longer automatically re-enables its cloud feature flag in the background. If PHS is disabled, an admin must explicitly re-enable it. This prevents silent configuration drift.

Bundled Component Upgrades:

• MSAL: 4.64.1 → 4.83.3
• SQL LocalDB: SQL Server 2019 → SQL Server 2022
• Visual C++ redistributable: 2013 → 2015-2022 (14.42.34438)
• VC++ 2013 redistributable dependency removed

Action Items

If you’re running Entra Connect Sync, plan to upgrade to 2.6.84.0. The security improvements alone — no silent fallbacks, interactive admin auth, TPM handling — justify the update. If you want to try passkey authentication during setup, enable the registry key before running the wizard.

3. MCP Enterprise-Managed Authorization with Entra ID and App Service

Announced: July 16, 2026 Source: Microsoft Tech Community

The Model Context Protocol (MCP) has become the standard connectivity layer for AI agents, and Microsoft is making sure Entra ID is front and center in how organizations govern agent access to tools and services.

What is Enterprise-Managed Authorization (EMA)?

EMA is a stable MCP extension (since June 18, 2026) that fundamentally changes how AI agents and their users get authorized to use MCP servers. Instead of the traditional per-server OAuth consent flow — where each new MCP server requires a browser redirect and user click — EMA makes the organization’s identity provider the policy decision point.

Here’s how the flow works:

1. SSO Authentication: The MCP client authenticates the user through the enterprise IdP via OpenID Connect or SAML
2. ID-JAG Issuance: The IdP issues an Identity Assertion JWT Authorization Grant (ID-JAG) — a short-lived, audience-bound JWT that validates the user’s identity and organizational policy
3. Token Exchange: The client presents the ID-JAG to the MCP server’s authorization server (using RFC 7523 JWT bearer grant) and receives a resource-specific access token
4. No consent screen needed — the IdP already evaluated policy

How Entra ID and App Service Fit

Microsoft’s guidance shows how to build a strongly governed MCP endpoint today using Azure App Service:

• App Service Authentication sits in front of the application and validates Microsoft Entra access tokens before a request reaches your Python process
• The App Service can serve as the MCP resource server
• For the full EMA flow, the enterprise IdP must be able to issue ID-JAGs (via RFC 8693 token exchange)
• Microsoft provides a complete Python reference implementation with a local ID-JAG lab on GitHub

Current State of Support

Why This Matters for Entra ID Admins

Even though Entra ID’s native ID-JAG issuance isn’t generally available yet, this announcement is significant because:

1. It defines the architecture: Microsoft is showing how Entra ID + App Service can serve as the authorization boundary for MCP servers today
2. It aligns with Entra Agent ID: Agent identities get first-class governance with the same policy frameworks
3. The MCP 2026-07-28 spec is coming: This specification formalizes stateless protocol changes and the EMA extension — organizations should start planning now
4. Security teams get centralized control: Grant and revoke access to MCP servers from one place, with audit trails

For organizations building AI agent infrastructure, this is required reading.

4. Configurable Encryption-at-Rest for Directory Data

Announced: ~July 10-15, 2026 Source: Third-party analysis referencing official Microsoft announcements

Microsoft has rolled out what may be the most significant security enhancement to Entra ID’s directory store in years: configurable encryption-at-rest for directory objects with per-attribute granularity and customer-managed key support.

What’s New

Per-Attribute Encryption Controls: Administrators can now selectively apply enhanced encryption protection to high-risk directory attributes — such as phone numbers, MFA secrets, or custom extension fields — using new Encryption Policy objects exposed through Microsoft Graph API:

PATCH https://graph.microsoft.com/v1.0/directory/encryptionPolicies/{policyId}
{
  "attributes": [
    "extensionAttribute1",
    "mobilePhone",
    "authMethods"
  ],
  "encryptionType": "AES256",
  "scope": "User"
}

This is not blanket encryption — it’s targeted, allowing compliance teams to protect sensitive data without breaking legacy integrations or adding latency to non-critical attribute reads.

Customer-Managed Keys (CMK): Entra ID now supports customer-managed keys for encryption-at-rest, using Azure Key Vault-backed keys. This closes a longstanding gap for regulated industries that previously couldn’t meet sovereign data requirements with Microsoft-managed keys alone.

Portal Experience: The admin portal surfaces Attribute Encryption under Identity Governance > Protection Policies, with audit logs tracking each policy change. API responses now include an encryptionStatus property per attribute for programmatic compliance verification.

Limitations to Be Aware Of

• Object support: Attribute encryption is only available for user and group objects — service principals, devices, and app registrations are not yet eligible
• Licensing: Customer-managed keys require Entra ID P2 licensing
• Audit retention: Encryption policy change audit logs are retained for 90 days by default (configure longer retention if needed for compliance)

Coming in Q4 2026 (Public Preview)

Microsoft has announced two upcoming preview features:

• Granular Key Rotation: Rotate encryption keys per attribute or user group, minimizing blast radius in case of compromise
• Conditional Encryption: Policy-driven encryption based on Identity Protection risk signals — apply stronger encryption for users flagged as high-risk

Assessment

If these capabilities are confirmed against primary Microsoft documentation, this represents a major advancement for organizations in regulated industries (healthcare, finance, government) that need granular control over how identity data is encrypted at rest. The per-attribute approach is particularly smart — it avoids the performance impact of blanket encryption while still protecting the most sensitive fields.

5. Microsoft Graph API July 2026 Updates

Announced: July 16, 2026 Source: Microsoft Learn - What’s new in Microsoft Graph

The July Graph API updates bring a mix of v1.0 promotions and new preview capabilities that expand what developers can do with Entra ID programmatically.

New in v1.0 (Production Ready)

BYOD Upload APIs for Access Reviews: The Bring Your Own Data (BYOD) Upload APIs have been promoted from beta to v1.0, enabling upload of external access data for access reviews. This includes the customDataProvidedResourceUploadSession base resource and related types — allowing organizations to feed external access data into Entra ID Governance for review.

fileStorageContainer Permission Batch Upsert: The limit for permission operations on a file storage container has increased from 10 to 40 permission objects per single request — a meaningful improvement for SharePoint and Teams provisioning workflows.

sponsorOf Relationship on User Resource: A new sponsorOf relationship on the user resource type represents the directory objects that a user sponsors — directly supporting the Entra Agent ID sponsorship lifecycle model.

New in Preview

Programmatic FIDO2 Passkey Registration: Developers can now programmatically register passkeys using the creationOptions function to get WebAuthn credential creation options, then complete registration by posting the new publicKeyCredential property to the fido2AuthenticationMethod resource. This enables custom registration flows outside the standard Security info portal.

Web Push Endpoints for Change Notifications: Microsoft Graph subscriptions now support browser-native Web Push delivery via new properties: vapidPublicKey, webPushEncryptionP256dhPublicKey, and webPushEncryptionSecret. Browser-based applications can receive change notifications through the W3C Push API channel without operating a public webhook — a significant simplification for client-side developers.

Windows 365 for Agents Organization Management: New cloudPC: organizationAction and cloudPC: retrieveOrganizationActionDetail methods support activating or deactivating an organization for Windows 365 for Agents.

Lifecycle Workflows Enhancements:

• cancelProcessing method to cancel in-progress or queued workflow runs
• Workflow preview operations for validation without affecting production users
• Automatic quarantining with configurable thresholds (quarantineConfiguration property)

Access Package Suggestions: New accessPackageSuggestion resource type with filterByCurrentUser function provides personalized access package suggestions based on related people insights and assignment history.

PIM-Based Role Assignments in Access Packages: The type property on accessPackageResourceRole indicates whether an Azure resource role is active or eligible, enabling PIM-based role assignments within access packages.

Verified ID Custom Claim Validation: New onVerifiedIdClaimValidationCustomExtension and onVerifiedIdClaimValidationListener resource types support custom logic for claim validation from Verified ID credential presentations during authentication flows.

Defender Integration: New alert: moveAlerts and incident: mergeIncidents actions support moving alerts and merging incidents in Microsoft Defender.

Entra Connect Sync: New allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled property on onPremisesDirectorySynchronizationFeature resource.

What to Prioritize

For most organizations, here’s what I’d prioritize from this batch:

1. Deploy the SSO admin control registry policy if you have managed Windows devices in the EEA — this is low-effort, high-impact
2. Plan your Entra Connect Sync upgrade to v2.6.84.0 — the security hardening alone is worth it
3. Evaluate MCP EMA patterns if you’re building AI agent infrastructure — the architecture is becoming clear and planning ahead will save rework
4. Watch for official documentation on directory encryption-at-rest — if confirmed, start planning which attributes warrant enhanced protection
5. Explore programmatic passkey registration if you want custom enrollment flows — the Graph API now supports it

The pace of Entra ID innovation continues to accelerate. The passkey-as-default announcement from last week was the headline, but these updates collectively represent a significant maturation of the platform — from SSO management and identity sync security to AI agent governance and directory-level encryption controls.

For ongoing Entra ID updates, follow @kkaminsk on X and check back here regularly. Big Hat Group Inc. provides Microsoft consulting services with a focus on AI and identity technologies.