Microsoft Entra ID August 15 2026: SMS First-Factor Retired for Free Tenants, Workload Identity Federation Tutorials, and Agent ID Guidance Updates

The week of August 10-15, 2026, brings a coherent story across Microsoft Entra ID: authentication hardening for both humans and machines, external identity maturity, and significant Agent ID guidance updates. Microsoft retired SMS first-factor sign-in for Entra ID Free tenants on August 11. New Workload Identity Federation tutorials for Google Cloud and SPIFFE/SPIRE push secretless architectures forward. Agent ID guidance shifted from app registrations to identity blueprints. And Dynamics 365 Commerce gains on-behalf-of ordering for Entra External ID. Here’s everything you need to know.

1. SMS First-Factor Sign-In Retired for Entra ID Free Tenants (MC1448374)

On August 11, 2026, Microsoft officially retired SMS as a first-factor sign-in method for Microsoft Entra ID Free tenants. This means users in Free tenants who relied on receiving a one-time SMS code as their primary authentication method can no longer sign in that way.

Why Microsoft Did This

The stated reason is fraud risk. SMS-based authentication is vulnerable to:

• SIM swapping attacks where attackers take over a phone number and intercept codes
• Phishing campaigns that trick users into entering codes on fake sign-in pages
• Social engineering where attackers convince users to share codes

These weaknesses make SMS one of the least secure authentication methods available today.

What’s Affected and What’s Not

• Affected: SMS as a first-factor (primary) sign-in method in Entra ID Free tenants
• Not affected: SMS as a multifactor (second-factor) authentication method — this continues to work
• Not affected: Paid Entra ID tiers (though the broader SMS/voice retirement timeline applies to everyone)

The Broader Timeline

This retirement is an early milestone in Microsoft’s authentication modernization journey:

A temporary opt-out API is available via Graph Beta (set optOutSettings.passkeyDynamicMigration to true) between September 1, 2026 and February 1, 2027, but this only delays the auto-enablement — the February 2027 retirement has no opt-out.

What Admins Should Do

1. Identify affected users in Entra ID Free tenants who use SMS as their primary sign-in
2. Enable alternative authentication methods — Microsoft Authenticator app, passkeys, FIDO2 security keys
3. Update authentication policies to reflect the removal of SMS first-factor
4. Plan for the September 1 passkey rollout even if your tenant isn’t affected by the Free-tier retirement

Microsoft published the entra-sms-voice-usage-analyzer PowerShell script on GitHub to help inventory users still on SMS or voice authentication.

2. Dynamics 365 Commerce On-Behalf-Of Ordering for Entra External ID (MC1453678)

Microsoft announced on-behalf-of ordering support for Microsoft Entra External ID in Dynamics 365 Commerce, with general availability scheduled for September 11, 2026.

What This Enables

This feature allows authorized staff — call-center agents, store associates, B2B account managers — to place orders on behalf of an external identity (customer or partner) represented in Entra External ID. The commerce workflow respects the external identity’s profile, preferences, loyalty program, and entitlements even when a staff member initiates the transaction.

Practical Scenarios

• Customer service agents placing orders for customers who call in, with the order tied to the correct customer account and loyalty benefits
• B2B account managers ordering on behalf of client organizations under negotiated terms and contracts
• Delegated ordering in partner ecosystems where identity relationships and consent are managed centrally in Entra

Why It Matters

This signals that Microsoft’s External ID is maturing from a pure authentication mechanism into a foundational construct for core business operations. External identities (customers, partners) are now deeply integrated into commerce workflows — not just as login credentials but as first-class entities that carry context, preferences, and entitlements through business processes.

3. New Workload Identity Federation Tutorials: Google Cloud and SPIFFE/SPIRE

Microsoft published two new first-party tutorials for Entra Workload Identity Federation this week, lowering the barrier for multi-cloud and multi-runtime secretless architectures.

Google Cloud Tutorial

The new Google Cloud tutorial shows how to:

1. Configure a Microsoft Entra application to trust a Google-issued service-account token
2. Exchange that token for a Microsoft Entra access token
3. Access Azure resources (Key Vault, Storage, etc.) without storing application secrets

The workload running in Google Cloud requests its own ID token from the Google metadata server, then uses token exchange (RFC 8693) to obtain an Entra access token. No long-lived secrets are stored in code or configuration.

SPIFFE/SPIRE Tutorial

The new SPIFFE/SPIRE tutorial demonstrates:

1. How a Kubernetes workload can obtain a SPIFFE JWT-SVID from its SPIRE control plane
2. Exchange the JWT-SVID for a Microsoft Entra access token
3. Access Azure resources without stored secrets

SPIFFE (Secure Production Identity Framework for Everyone) provides a vendor-neutral identity layer that works across Kubernetes clusters, cloud providers, and on-premises environments.

The Bigger Picture

These tutorials reinforce a parallel authentication modernization story for machines: just as Microsoft is moving humans away from SMS toward passkeys, they’re moving workloads away from static secrets toward federated, short-lived tokens. The same Zero Trust principles — verify explicitly, use least privilege, assume breach — apply equally to service accounts, CI/CD pipelines, and AI agents.

The tutorials also complement the broader Entra Agent ID for Dataverse announcement from earlier in August, which uses similar federation patterns for AI agent identities.

4. Agent ID Guidance: Identity Blueprints, Channel Permissions, Dynamic Groups

Microsoft significantly updated Agent ID documentation this week, codifying how non-human identities should be modeled and governed in Entra ID.

Architecture: Identity Blueprints Over App Registrations

The updated architecture guidance now explicitly directs administrators to create agents from an agent identity blueprint and the Microsoft.Graph.AgentIdentity object, rather than through standard application-registration APIs. This is a significant shift in how Microsoft wants organizations to think about AI agent identities.

Key points:

• Agent identities cannot use interactive consent — delegated permissions must be preauthorized through inheritable blueprint permissions
• The token exchange flow requires that Tc (client token) targets the agent identity blueprint, while T1 (resource token) targets the token-exchange resource and is validated against the blueprint and child agent identity
• Supported creation channels, roles, permissions, and .NET usage are documented

Channel Permissions: M365 Communication for Agents

New guidance maps Microsoft 365 communication channels to the permissions agents need:

Administrators can use this channel-by-channel table to configure agent access with least-privilege precision.

Dynamic Groups: Agent User Accounts Covered

Microsoft Entra ID guidance now explicitly explains that agent user accounts are evaluated by user-based dynamic membership rules and can join dynamic user groups. By default, dynamic rules don’t distinguish agent accounts from regular user accounts, but administrators can explicitly include or exclude them — including filtering by agent identity blueprint.

This enables scenarios like:

• Automatically grouping all agents by environment (dev/test/prod) using custom security attributes
• Excluding agent accounts from certain licensing groups
• Creating Conditional Access policies that target agent-only groups

5. Windows Passkey Registration Drops Preview Label

The “Register a Microsoft Entra passkey on Windows” documentation page has dropped the “(preview)” designation from its title and headings. While Microsoft hasn’t issued an official GA announcement for the registration flow itself, this change signals production readiness.

This aligns with the broader passkey acceleration:

• MC1282568: Entra Passkeys on Windows reached GA on July 20, 2026 (Worldwide and GCC)
• MC1450133: Passkeys as first MFA method begins October 2026 (Phase 1: synced passkeys, Entra passkeys on Windows, FIDO2 keys)
• MC1440968: Passkey Registration Optimizations rolling out late August 2026

The registration experience losing its preview label reduces friction for admins who want to promote passkeys as a primary sign-in method but were hesitant to deploy something labeled as experimental.

6. GSA V2 Web Filtering Model Documented

A new Microsoft Learn article documents the Global Secure Access V2 web filtering model, which introduces:

• One policy per security profile (simpler than V1’s multi-policy approach)
• Multiple rules with individual actions per policy
• A default action for unmatched traffic
• URL-based FQDN destinations for more precise targeting

Existing V1 web-content-filtering policies continue to function until organizations choose to migrate. The V2 model reduces policy complexity and provides more granular control over web access decisions.

7. Additional Documentation Updates

Several documentation clarifications were published this week:

• Catalog Access Reviews: Preview labels removed, reviewer terminology broadened beyond managers, 12-hour data-freshness caveat added (changes within 12 hours before a review starts may not appear)
• Identity Protection: “Device disablement” renamed to “Attacker-added device” with documented response (device disabled, token issuance blocked, refresh tokens revoked, sessions revoked)
• Replica-set networking: All virtual networks hosting replica sets must be fully meshed — deployment prerequisite clarified
• Staged Rollout: Additional interactive sign-in scenarios documented for users added to or removed from Staged Rollout, including ID Protection remediation events
• Optional Claims: Granular AMR configuration guidance for SAML apps (must use manifest or Graph, no admin center UI)
• Puzzel provisioning: OAuth2 Client Credentials Grant authentication documented

Key Takeaways

This week’s updates tell a clear story about Microsoft’s identity strategy:

1. Authentication hardening is accelerating. SMS first-factor is now retired for Free tenants, passkeys are losing their preview labels, and the February 2027 SMS/voice retirement looms. Organizations that haven’t started their passkey migration are running out of runway.

2. External identity is becoming a business platform. Dynamics 365 Commerce on-behalf-of ordering shows Entra External ID moving from authentication-only to a foundational construct for commerce operations.

3. Agent ID guidance is maturing. The shift from app registrations to identity blueprints, combined with channel-specific permission mapping and dynamic group support, gives organizations a proper reference architecture for governing AI agent identities at scale.

4. Secretless architectures are getting easier. New Workload Identity Federation tutorials for Google Cloud and SPIFFE/SPIRE lower the barrier for multi-cloud organizations to eliminate stored secrets.

For organizations using Entra ID, the priorities this week are clear: check for SMS first-factor dependency in Free tenants, plan passkey registration campaigns ahead of the October rollout, review Agent ID architecture against the new blueprint guidance, and explore whether Workload Identity Federation can replace stored secrets in your multi-cloud workloads.

Follow Kevin Kaminski on X at https://x.com/kkaminsk for daily Microsoft Entra ID and Azure updates.