Microsoft Entra ID Late July 2026: Passkey Registration Optimizations, Tenant Governance, Kerberos RC4 Final Enforcement, and Entra-Defender Convergence

The final week of July 2026 delivers a diverse set of Microsoft Entra ID updates spanning authentication, multi-tenant management, protocol security, and security operations convergence. From passkey registration improvements to the irreversible end of Kerberos RC4, here’s what identity admins need to know.

MC1440968: Passkey Registration Optimizations

On July 27, Microsoft announced message center notification MC1440968 detailing optimizations to the passkey registration experience in Entra ID. These changes target three registration surfaces: Registration Campaign, Authentication Strengths, and My Sign-Ins.

What’s Changing

The updated registration logic introduces two key improvements:

1. Policy-compliant registration guidance — Users will be guided to register passkey types that comply with administrator-configured passkey profile restrictions. This reduces unsuccessful or non-compliant registration attempts, particularly important for organizations using AAGUID-restricted profiles that limit which passkey providers are allowed.

2. Local device prioritization — When permitted by policy, registration will prioritize a passkey native to the user’s current device. This improves the sign-in experience by ensuring users register device-bound credentials on the device they’re actually using, rather than being directed to a synced passkey from another device.

Why It Matters

Organizations that have invested in passkey profiles — especially device-bound-only, attestation-enforced, or AAGUID-restricted configurations — have likely experienced friction during registration. Users sometimes attempt to register a passkey type that doesn’t match the admin-configured profile, resulting in failed attempts and support tickets. These optimizations close that gap.

Timeline and Action Required

• Rollout: Late August 2026 (Worldwide and GCC)
• User interface changes: None
• Admin action required: None
• Impact: All users registering passkeys through Registration Campaign, Authentication Strengths, or My Sign-Ins

This is a behind-the-scenes improvement that makes the passkey journey smoother without any configuration changes. If you’re currently planning your September passkey migration (ahead of the SMS/voice retirement in February 2027), these optimizations will help reduce registration friction.

Entra Tenant Governance: Centralized Multi-Tenant Management (Preview)

Announced as part of the “What’s New in Microsoft Security: July 2026” blog on July 30, Entra Tenant Governance is now visible in the Entra admin center and available in preview. This capability addresses a long-standing pain point for organizations managing multiple Entra tenants.

What It Does

Tenant Governance establishes governance relationships — directional connections between a governing tenant and one or more governed tenants. This enables:

• Cross-tenant delegated administration — Administrators sign in using accounts from the governing tenant. No need to create and manage local or B2B administrator accounts in every governed tenant.
• Tenant configuration management — Use delegated access to ensure governed tenants meet organizational security and compliance objectives on an ongoing basis.
• Secure tenant creation — New add-on tenants created from an existing tenant automatically receive a governance relationship with a default policy template.

How It Works

Setting up a governance relationship follows a three-step handshake:

1. The future governed tenant sends a governance invitation to the future governing tenant.
2. The future governing tenant sends a governance request with a selected governance policy template.
3. The future governed tenant reviews and accepts the request, establishing the relationship.

Governance Policy Templates

Templates are the building blocks of Tenant Governance. Each template defines:

• Delegated admin roles — Which built-in Entra roles users from the governing tenant hold in the governed tenant. Assigned via groups in the governing tenant.
• Multi-tenant applications — Custom multi-tenant apps that can be created and managed across governed tenants.

Templates are reusable across multiple governance relationships, ensuring consistent access policies. When you create a relationship, Tenant Governance takes a snapshot of the template — updating the template doesn’t automatically update existing relationships. Applying updates requires repeating the request and acceptance process, ensuring the governed tenant always has the opportunity to review permission changes.

How It Differs from Existing Tools

A new Tenant Governance Administrator role (Template ID: 1981f584-96e9-4a6f-95b0-f522373f8fae) has been added to manage all Tenant Governance capabilities.

Why It Matters

For organizations with multiple Entra tenants — whether from acquisitions, subsidiary structures, or test/production separation — Tenant Governance eliminates the operational overhead of maintaining separate admin accounts in each tenant. The three-step handshake ensures both parties consent to the arrangement, and the policy template approach provides consistent, reviewable access controls.

Kerberos RC4 Final Enforcement: The Deadline Has Passed

July 14, 2026 marked the point of no return for Kerberos RC4 deprecation. With the July Patch Tuesday update, Microsoft permanently removed the RC4DefaultDisablementPhase registry key that allowed domain controllers to fall back to audit mode. Enforcement is now the only state.

The Three-Phase Timeline

What Breaks

Service accounts with the following msDS-SupportedEncryptionTypes configurations will fail Kerberos authentication silently:

• Empty/null attribute (no explicit encryption type set)
• 0x0 (not set)
• 0x4 (RC4 only)
• 0x7 (DES + RC4)

The failure is silent — there’s no error dialog or alert. Users simply can’t access the service, and the first sign is usually a support ticket.

Remediation Steps

For each affected service account:

# Set AES-only encryption (AES128 + AES256 = 0x18 = decimal 24)
Set-ADUser -Identity "svc-myapp" -Replace @{'msDS-SupportedEncryptionTypes'=24}

# CRITICAL: Reset the password to force AES key generation
# Without this step, the account has no AES keys to use
Set-ADAccountPassword -Identity "svc-myapp"

For domain-wide enforcement via GPO on domain controllers:

HKLM\SYSTEM\CurrentControlSet\services\KDC
DefaultDomainSupportedEncTypes = 0x18 (DWORD)

For Java applications, update krb5.ini:

default_tkt_enctypes = aes256-cts aes128-cts
default_tgs_enctypes = aes256-cts aes128-cts
permitted_enctypes = aes256-cts aes128-cts

Why It Matters Now

Unlike the April enforcement phase where admins could roll back using the registry key, July’s update offers no domain-wide escape hatch. The only way to re-enable RC4 for a specific account is to explicitly set msDS-SupportedEncryptionTypes to include the RC4 bit on that individual account — a practice Microsoft strongly discourages. If you haven’t already audited your service accounts, do it today.

Entra-Defender Convergence: SOC Identity Response

The July 30 “What’s New in Microsoft Security” blog also highlighted deeper convergence between Microsoft Entra and Microsoft Defender, building on the SOC Identity Responder role introduced in June 2026.

What’s New

The interconnected Entra and Defender experiences now provide:

• Direct identity containment from Defender — SOC analysts can disable compromised identities directly from the Defender portal using a least-privilege RBAC mode, without needing broad Entra admin roles.
• Shared user experience — Identity and access management teams and SOC teams share the same user experience, eliminating product seams.
• Agentic workflows — Both teams benefit from agentic workflows that span identity and security operations, streamlining incident response.

The SOC Identity Responder Role

The SOC Identity Responder role (introduced June 2026 as Public Preview) is the foundation of this convergence. It provides:

Role Template ID: 58f930cc-fcf4-4152-852c-1d7dbf502139

Permissions:

• microsoft.directory/users/disable
• microsoft.directory/users/enable
• microsoft.directory/users/invalidateAllRefreshTokens
• microsoft.directory/users/password/update

Defender for Identity Integration

Defender for Identity creates an enterprise application in Entra ID automatically. When a user initiates a remediation action from the Defender portal, the request is authorized based on the user’s Entra ID roles and executed by the Defender for Identity application, enforcing RBAC and audit logging throughout.

Why It Matters

During an active security incident, every minute matters. SOC analysts previously had to either hold multiple high-privilege Entra roles or wait for an identity administrator to take containment actions. The SOC Identity Responder role and the Entra-Defender convergence eliminate that bottleneck, enabling faster containment with appropriate least-privilege boundaries.

Project Perception: Agentic Security Operations

Also announced on July 27, Project Perception is Microsoft’s coordinated system of specialized AI agents for security operations. While not exclusively an Entra announcement, identity is a core signal source for these agents.

The Agent Team

• Red team agents — Expose weaknesses through continuous testing
• Blue team agents — Investigate cyberthreats detected across the environment
• Green agents — Harden vulnerabilities found by red and blue agents

These multi-agent autonomous workflows operate in continuous loops to execute end-to-end security workflows. The agents leverage enterprise-wide signals — including Entra ID identity data — to provide comprehensive security coverage.

Why It Matters for Identity Admins

As Microsoft’s agentic security vision unfolds, Entra ID becomes not just an identity provider but a critical signal source for AI-driven security operations. Ensuring your identity data is clean, well-governed, and properly audited will directly impact the effectiveness of these agentic workflows.

Action Items Summary

Looking Ahead

The pace of Entra ID evolution shows no signs of slowing. With passkeys becoming the default authentication method on September 1, the legacy risk policy retirement on October 1, and the SMS/voice retirement on February 1, 2027, the second half of 2026 is packed with identity transformation milestones. The convergence of Entra and Defender, combined with agentic security via Project Perception, signals Microsoft’s broader vision: identity as the foundation for AI-powered security operations.

For ongoing updates, follow the discussion on X at https://x.com/kkaminsk and check the official Microsoft Entra What’s New page.