Microsoft Entra’s August 2026 release wave continues with a set of documentation and capability updates from August 20-22 that refine and operationalize several previously announced features. While the headline announcements landed earlier in the month — Tenant Governance GA, the August Entra newsletter features, and the CVE-2026-69836 disclosure — these later updates fill in the operational details that identity admins need to actually implement and manage these capabilities.

Here’s what changed, why it matters, and what your organization should do about it.

1. Delegated Passkey Management API for External ID Customer Apps

Published: August 22, 2026 Status: Preview

Microsoft Entra External ID now documents a delegated credential management API that lets customer-facing applications manage the signed-in customer’s own passkeys. This is a significant addition for organizations building customer identity solutions on External ID.

What It Does

Applications can now use delegated access tokens to:

  • List the signed-in customer’s registered passkeys
  • Register new passkeys for the signed-in customer
  • Delete existing passkeys belonging to the signed-in customer

Key Constraints

  • Delegated access only — app-only tokens (client credentials) are not supported. There must be an interactive user session.
  • Service principal must be provisioned manually in the tenant before the app can call the API
  • Preview status — the sample code uses high-privilege administrator provisioning and is explicitly labeled for testing, not production
  • Scope is the signed-in customer only — no admin-level bulk management capability
  • External ID focused — positioned for B2C-like customer identity scenarios, not workforce tenants

Why It Matters

This API extends the passkey management story to customer-facing applications built on Entra External ID. As Microsoft pushes passkeys as the default authentication method across the Entra ecosystem (starting September 1, 2026 for workforce tenants), giving developers a standards-based API to let customers self-manage their passkeys within apps is a natural and necessary extension. The delegated-only constraint is a deliberate security choice — it ensures that passkey operations require user presence and cannot be automated away by daemon apps.

What You Should Do

  • If you’re building on Entra External ID, review the new delegated passkey management documentation
  • Plan how to integrate passkey self-service (list, register, delete) into your customer application flows
  • Note the preview status and manual service principal provisioning requirement
  • Follow the broader Graph authentication methods model for permission scopes

2. Governed Workforce Tenant Creation Prerequisites Documented

Published: August 22, 2026 Status: Documentation update (for GA feature)

Following the general availability of Entra Tenant Governance on August 10, 2026, Microsoft has now documented the specific prerequisites for creating governed workforce tenants.

What’s Required

  • Paid Azure subscription associated with an Enterprise Agreement or pay-as-you-go billing account
  • Free or trial tenants cannot create additional tenants
  • Required tenant-creation permissions and role assignments
  • Default governance-policy prerequisites must be met
  • The governing tenant’s default governance policy template is labeled optional (the tenant-creation service still uses only the template with ID default)

Why It Matters

Tenant Governance GA was a major announcement, but the operational details — specifically the billing requirements — were not immediately clear. This documentation fills that gap. The paid Azure subscription requirement (EA or pay-as-you-go) is a key constraint for adoption planning, particularly for organizations that have been operating on free or trial tenants and want to expand their tenant estate under governance.

What You Should Do

  • Verify your Azure subscription type meets the prerequisites before attempting governed tenant creation
  • Ensure the right roles are assigned (likely Global Administrator or Privileged Role Administrator for initial setup, plus Identity Governance Administrator for ongoing management)
  • Review the default governance policy template configuration in your governing tenant

3. Global Secure Access macOS Client v1.1.26060207

Published: August 21, 2026 Status: Generally available (client update)

The Global Secure Access macOS client received a feature-rich update that brings it closer to parity with the Windows client.

What’s New

  • Home Network traffic control — allows specific handling of traffic when clients are on designated home networks, enabling more granular routing policies
  • Connections page — new UI showing active connections (Private Access, Internet Access) and tunnel health status
  • Agentic detection support — extends GSA’s agent visibility capabilities to the macOS platform, aligning with Microsoft’s broader AI agent security strategy
  • Secure DNS bypass — certain destinations can bypass Secure DNS for compatibility or performance reasons
  • Several bug fixes

Deployment Note

The app package now includes com.microsoft.autoupdate2 for future use cases. If you’re deploying via Intune, update your detection rules to remove com.microsoft.autoupdate2 from them — including it in detection rules can cause conflicts starting with this version.

Why It Matters

The agentic detection support is the standout feature here. As organizations deploy AI agents across their environments, having GSA on macOS able to detect and report on agent activity extends the Zero Trust network security perimeter to Apple endpoints. Combined with the Home Network traffic control and the new Connections page, this update makes the macOS client a much more capable enforcement point for Global Secure Access policies.

What You Should Do

  • Update your Intune deployment scripts to remove com.microsoft.autoupdate2 from detection rules
  • Test the new Connections page with your existing GSA profiles
  • Evaluate Home Network traffic control for your network architecture
  • Review how agentic detection support integrates with your existing agent monitoring strategy

4. Cross-Root-Domain Federated Sign-In Blocking Documented

Published: August 20, 2026 Status: Documentation (for previously announced policy change)

New Entra ID documentation formally explains the federatedTokenValidationPolicy that blocks federated sign-ins when the trusted realm and mapped user account have different root domains.

What It Does

  • Blocks federated sign-ins when internalDomainFederation does not match the user’s UPN domain
  • Prevents unintended cross-domain trust exploitation
  • Documents related Microsoft Graph beta APIs (subject to change, unsupported for production applications)
  • Affects federated domains configured before December 2025

Why It Matters

This is the documentation formalization of the policy change announced in MC1303719 (July 9, 2026). The policy itself went live in mid-August 2026, and this documentation gives administrators the technical details needed to understand, troubleshoot, and configure compliance. The cross-root-domain blocking is a security hardening measure — it prevents scenarios where a federation configured for one root domain could be used to process sign-ins for accounts in a different root domain within the same tenant.

What You Should Do

  • If you have federated domains configured before December 2025, verify that your internalDomainFederation configurations align with user UPN domains
  • Review the Graph beta APIs for federation configuration management (GET/POST/PATCH on /domains/{id}/federationConfiguration)
  • Update your identity troubleshooting documentation to reference this blocking behavior

5. Inbound Provisioning Null-Value Clearing (Preview)

Published: August 20, 2026 Status: Public Preview

New Entra ID provisioning guidance documents the ability to clear an existing target attribute when the source value is null or empty — a capability that addresses a long-standing provisioning pain point.

How It Works

  1. Opt-in — must enable “Flow null values” on both the source and target attribute mappings
  2. When the source system sends a record where a mapped attribute is null or empty, provisioning clears the existing value on the target attribute
  3. Without this opt-in, the existing target value remains unchanged even if the source is null

Key Limitations

  • Single-valued attributes only — multi-valued attributes are not supported
  • Specified inbound scenarios only — available for API-driven inbound provisioning apps
  • Not supported for non-API inbound scenarios, some gallery apps, or SCIM connectors

Why It Matters

Attribute drift between source and target systems has been a persistent problem in identity provisioning. When an HR system clears an employee’s department or title (sets it to null), that change previously wouldn’t propagate to Entra ID — the old value would persist. This preview capability closes that gap, ensuring that null values in the source system are respected and reflected in the target, maintaining data consistency across connected systems.

What You Should Do

  • If you use API-driven inbound provisioning, evaluate whether enabling “Flow null values” improves your data consistency
  • Test in a non-production environment first — clearing attributes can affect dynamic group membership, licensing, and access policies
  • Identify which attribute mappings would benefit most from null-value clearing

6. Apple Token Protection Reaches GA

Published: August 20, 2026 Status: Generally available (iOS/iPadOS and macOS); Preview (macOS web apps accessing Azure Resource Manager)

The Entra ID Token Protection reference now lists token protection for iOS/iPadOS and macOS as generally available, completing the cross-platform story.

What’s GA vs Preview

  • GA: Token Protection for iOS/iPadOS (standard app scenarios) and macOS (standard app scenarios)
  • Preview continues: Web apps accessing Azure Resource Manager on macOS remain in preview
  • Already GA: Windows Token Protection

Why It Matters

Token Protection is a key defense against token theft and replay attacks. With Apple platforms reaching GA, organizations can now enforce token protection policies across their entire fleet — Windows, iOS, iPadOS, and macOS — with only a narrow preview scope remaining for macOS web app scenarios. This is particularly important for organizations with mixed-device environments where iOS and macOS are common among executives and creative professionals.

What You Should Do

  • Review your Conditional Access policies and consider enforcing Token Protection where Apple platforms are in scope
  • Verify that your device compliance and app management policies account for the GA status of Apple Token Protection
  • For macOS-specific web app scenarios accessing Azure Resource Manager, continue treating those as preview

7. Mover Workflow Access-Removal Timing Clarified

Published: August 20, 2026 Status: Documentation update

ID Governance task guidance now explicitly covers the “Remove all access package assignments for user” task for mover workflows, not just leaver workflows.

What Changed

  • The task now applies to both leaver and mover lifecycle workflow templates
  • For mover templates, scheduled removal defaults to 15 days after the mover event is triggered
  • Administrators can customize the timing or choose immediate removal

Why It Matters

Mover scenarios — where an employee changes roles within the organization — are often more complex than leaver scenarios. The person needs some of their old access removed, but not all of it, and the timing matters. A 15-day default gives organizations a reasonable window to transition access while the employee settles into their new role. Making this configurable acknowledges that different organizations (and different role transitions) need different timelines.

What You Should Do

  • Review your mover lifecycle workflow templates and verify the access-removal timing
  • Determine whether the 15-day default works for your organization or if you need custom timing
  • Update your identity governance documentation to reflect that mover workflows now have documented access-removal behavior

Summary: The Refinement Phase

These seven updates represent Microsoft’s continued refinement of the Entra platform after the major announcements earlier in August. The pattern is clear:

  1. Operationalizing GA features — Tenant Governance prerequisites, mover workflow timing
  2. Extending the passkey ecosystem — delegated management APIs for External ID
  3. Closing cross-platform gaps — GSA macOS feature parity, Apple Token Protection GA
  4. Hardening federation security — cross-root-domain blocking documentation
  5. Fixing provisioning precision — null-value clearing preview

For identity administrators, the action items are mostly about review and configuration rather than urgent deployment. The exceptions are the Intune detection rule update for GSA macOS (immediate) and the federation configuration review (if you have pre-December 2025 federated domains).

Stay current with the Entra platform by following the Microsoft Entra Blog on Tech Community and the What’s New in Microsoft Entra page on Microsoft Learn.

Big Hat Group Inc. is a Microsoft partner specializing in AI and cloud identity solutions. Follow the latest Entra ID updates and analysis at bighatgroup.com or follow Kevin on X at x.com/kkaminsk.