Entra ID What's New: Linux Broker 2.0.2, Cloud Sync AD Provisioning, GSA Auto-Update

Microsoft Entra ID’s final week of August 2026 brought a batch of updates that may not have the drama of a CVSS 10.0 vulnerability, but matter enormously for day-to-day identity operations. The common theme: Microsoft continues to tighten the integration between Entra ID and the operating systems, on-premises directories, and self-service portals that end users actually touch.

Five changes stand out for IT administrators this week — from a Linux broker architecture shift that requires device re-enrollment, to a Cloud Sync preview that finally lets you push users from the cloud back to on-premises AD, to a Global Secure Access auto-update mechanism that eliminates manual client packaging.

Here’s what changed, why it matters, and what to do about it.

1. Linux SSO Broker 2.0.2: Entra Join Replaces Device Registration

Status: Current GA (version 3.0.x on stable channel) Action required: Yes — existing devices must be re-joined

Microsoft Single Sign-On for Linux took a significant architectural step with version 2.0.2, switching from device registration to device join for establishing trust with Entra ID. This isn’t just terminology — it changes the scope of the trust relationship and what the device can do.

What Changed

Previous versions of the Microsoft Identity Broker for Linux used device registration, which created a trust scoped to an individual user profile. Version 2.0.2 and later uses Entra join, which creates trust with the entire device — the same model used by Windows and macOS.

This matters for two reasons:

1. Platform SSO readiness: Entra join is a prerequisite for future platform SSO support on Linux. Registration was a dead end; join is the foundation for what comes next.
2. Security scope: Device-level trust means Conditional Access policies evaluating device compliance, device filters, and device-based controls apply more consistently across all platforms.

What Administrators Must Do

The upgrade is not automatic for existing devices. Here’s the process:

1. Enable the right setting: In the Entra admin center, navigate to Devices > Device settings. Ensure “Users may join devices to Microsoft Entra ID” is enabled for your target users. The previous “Users may register their devices with Microsoft Entra” setting is no longer sufficient for Linux devices on broker 2.0.2+.

2. Clean up existing broker state: On each affected Linux device, run:

   sudo dsreg --cleanup
   

   This removes all local registration data and key material.

3. Reinstall the broker: Update the package:

   # Ubuntu
   sudo apt update && sudo apt upgrade microsoft-identity-broker
   # RHEL
   sudo dnf update microsoft-identity-broker
   

4. Re-join and re-enroll: Users must sign in again to establish the new Entra join trust and re-enroll in Intune.

Supported Distributions

*Ubuntu 22.04 LTS support ending August 2026 — identify affected devices in Intune by filtering All Devices > Linux and adding the OS version column.

Why This Matters

Linux desktops in enterprise environments are often the last to get identity parity. This change brings Linux closer to Windows and macOS in how Entra ID trusts the device, but it requires active intervention. Organizations with Linux fleets should plan the re-join process now rather than waiting for authentication failures after an automatic broker upgrade.

2. Cloud Sync Provisioning to On-Premises AD: User Provisioning Enters Preview

Status: Group provisioning GA; User provisioning Public Preview Action required: Evaluate for cloud-to-on-premises identity scenarios

Microsoft Entra Cloud Sync has been expanding its capabilities throughout 2026 — device sync, AD group enforcement, and now the reverse direction: provisioning users from Entra ID to on-premises Active Directory Domain Services.

What’s Available

How It Works

Cloud Sync’s Entra-to-AD provisioning uses the same lightweight provisioning agent and cloud-based orchestration service as AD-to-Entra sync, but in reverse. The configuration flow in the Entra admin center (Entra ID > Entra Connect > Cloud Sync) guides you through five sections:

1. Scoping filters — choose all security groups, selected groups, or specific users
2. Attribute mapping — map Entra attributes to AD DS attributes
3. Test — validate with on-demand provisioning for a single user or group
4. Default properties — review and adjust default settings
5. Enable — turn on the configuration and start synchronizing

Prerequisites

• Hybrid Identity Administrator role minimum
• Entra provisioning agent installed on-premises
• AD DS schema with msDS-ExternalDirectoryObjectId attribute (Windows Server 2016+)
• For group members: users must have AD accounts with matching onPremisesObjectIdentifier

Limitations to Know

• Group members provisioned to AD must have AD accounts (including eligible cloud-managed users)
• Synchronized users still require onPremisesObjectIdentifier matching their objectGUID in target AD
• On-demand group testing limited to five members
• Null values are not sent by default (opt-in required for attribute clearing)

Why This Matters

This is a significant step for organizations moving toward cloud-first identity management. Previously, if you wanted to manage users in Entra ID and have them appear in on-premises AD, your options were limited. With Cloud Sync’s bidirectional capability, Entra ID can now serve as the authoritative identity source while still populating AD for legacy applications, on-premises file servers, or Kerberos-based systems that require AD accounts.

The tutorial for provisioning groups to AD DS and the configuration guide for Entra-to-AD provisioning provide step-by-step instructions.

3. Global Secure Access Auto-Upgrade via Windows Update

Status: Starting November 2026 Action required: Update detection rules; decide on opt-out

If you manage Global Secure Access (GSA) client deployments across Windows endpoints, November 2026 brings a welcome change: the GSA client will automatically upgrade through Windows Update.

What Changed

GSA client version 2.32.294 is the current release for Windows (x64 and ARM). Key additions:

• “Prefer local network” feature for optimized routing
• Faster tunnel creation
• Bug fixes and improvements

But the bigger news is the delivery mechanism change. Starting in November 2026, eligible Windows clients will automatically receive GSA upgrades through Windows Update — eliminating the need for administrators to manually download, package, and deploy each new version.

Minimum Versions for Auto-Update

What Administrators Should Do

1. Update detection rules: If you use Intune or other endpoint management tools, update detection rules to check for version greater than or equal to the minimum versions above. This ensures auto-updated clients are recognized as compliant.

2. Decide on opt-out: If your organization needs to control GSA client updates manually, use the opt-out parameter during installation:

   GlobalSecureAccessInstaller.exe /quiet /norestart EnableWindowsUpdates=0
   

3. Note connector exclusion: This auto-update applies only to the GSA client. Entra Private Network Connector installations do not auto-update — administrators must still manually download and update connectors from the Entra admin center.

4. Self-Service Identity Management Moves to cloud.microsoft

Status: Worldwide rollout late November 2026 Action required: Update network policies

Microsoft Entra’s self-service identity management domain is consolidating under the cloud.microsoft namespace. The migration from myaccount.microsoft.com to myaccount.cloud.microsoft is planned for worldwide rollout in late November 2026.

What Administrators Need to Do

• Allow *.cloud.microsoft in network policies — firewalls, proxies, and conditional access network policies should be updated before the November rollout
• Users need no action — an automatic redirect from the old URL is planned
• No authentication changes — sign-in behavior remains the same

This is part of Microsoft’s broader consolidation of services under the cloud.microsoft domain, following similar moves by other Microsoft 365 services.

5. Enhanced sAMAccountName Sourcing for Hybrid Users

Status: Available (domain-level setting) Action required: Evaluate if your organization needs explicit sAMAccountName control

New documentation clarifies how administrators can control sAMAccountName generation for hybrid users by sourcing from the onPremisesSamAccountName attribute.

How It Works

• Default behavior (current): sAMAccountName is generated from mailNickname for all hybrid users
• Enhanced behavior (opt-in): sAMAccountName is sourced from onPremisesSamAccountName, giving administrators explicit control
• Domain-level setting: Enabled per domain, not per user
• Migration impact: When enabled, existing hybrid users are updated during the next synchronization cycle
• Cloud-only users: Continue using mailNickname-based generation (no change)

Why This Matters

Organizations with specific naming conventions or legacy applications that depend on particular sAMAccountName formats now have a mechanism to ensure consistency when managing hybrid identities through Entra ID. Previously, the automatic generation could produce sAMAccountName values that didn’t match on-premises expectations.

Additional Documentation Updates

Several smaller documentation updates were noted this week:

• Arc sign-in guidance clarified: Enabling Arc sign-in joins a machine to Entra ID — intended for machines NOT planned to join another domain (on-premises AD or Entra Domain Services). Confirm domain-join plans before enabling.
• Consent policy application IDs revised: Updated application IDs for Apple Mail, Spark Email, eM Client, Android-Samsung, Android-Mail, and Thunderbird. Administrators managing granular consent policies should update configurations.
• Conditional Access What If tool: Sample UserId in documentation examples updated. No product behavior change.

Key Dates to Watch

• September 1, 2026: Passkeys become default in Entra ID; auto-enablement begins for SMS/voice users
• October 5, 2026: SSPR registration campaign begins
• October 26, 2026: Custom CSS positioning properties retired globally in Entra ID branding
• November 3, 2026: MemberOf rule operator retired in dynamic groups, AUs, and entitlement management
• November 9, 2026: SSPR enforcement — only explicitly registered methods accepted
• November 2026: GSA client auto-upgrade via Windows Update begins
• Late November 2026: myaccount.cloud.microsoft worldwide rollout
• February 1, 2027: Microsoft-hosted SMS/voice authentication fully retired (no opt-out)

Follow Kevin on X at https://x.com/kkaminsk for daily Microsoft Entra updates and analysis.