Entra ID What's New: B2B Passkeys, Defender XDR Identity, Cloud Sync Reverse

Microsoft Entra ID closed out August 2026 with a final batch of updates that span the full identity stack — from external collaboration security to hybrid provisioning to security operations. While the earlier August releases focused on tenant governance and lifecycle workflow enhancements, this final wave targets the seams between products where identity work actually happens.

The standout theme: Microsoft is closing gaps that made mixed-environment identity management harder than it needed to be. B2B guests finally get passkey support. Defender XDR finally unifies identity response across directories. Cloud Sync finally pushes users back to AD. And Lifecycle Workflows finally supports year-long automation triggers.

Here’s what changed, why it matters, and what to do about it.

1. Passkey Registration and Sign-in for B2B Guest Users

Status: Enabled by default, rollout October 2026 – February 2027 Action required: Review authentication methods policy for guest scope

B2B collaboration just got a significant security upgrade. Microsoft Entra ID now supports passkey registration and sign-in for B2B guest users, allowing them to meet resource tenant MFA requirements with phishing-resistant credentials.

Why This Matters

Until now, passkey registration was explicitly not supported for internal or external guest users in the resource tenant. This created a gap: organizations enforcing phishing-resistant MFA for their own users couldn’t extend the same standard to external collaborators. Guests had to rely on weaker methods — SMS, voice, or TOTP — which are increasingly under attack.

With this change, B2B users can register a resource-tenant passkey through three channels:

• The resource tenant’s My Security Info page
• Proof-up prompts during sign-in
• Passkey registration campaigns, if configured

Rollout Timeline

The feature is enabled by default. No admin action is required to turn it on, but administrators should:

1. Review the authentication methods policy — confirm which user groups (including guests) are in scope for passkeys (FIDO2)
2. Update B2B governance documentation — inform partner organizations they can register resource-tenant passkeys
3. Monitor sign-in logs — track passkey adoption by guests and ensure Conditional Access policies recognize passkeys as strong MFA

This change dovetails with the September 1 passkeys-by-default rollout and the February 2027 SMS/voice retirement. Guests are now firmly in scope for the phishing-resistant authentication transition.

2. Defender XDR Unified Identity Response and Timeline

Status: MC1461704 and MC1461705 — Rollout begins mid-October 2026 Action required: Audit identity connectors, update IR runbooks

Two new Microsoft Defender XDR capabilities transform how security teams respond to identity incidents. Together, they eliminate the product-seam problem that has plagued identity-incident response across mixed environments.

Unified Response Actions (MC1461704)

Security teams can now apply supported response actions to all associated accounts for an identity — or a subset — from a single workflow. Supported actions include:

• Disable / enable account
• Revoke session
• Mark as compromised
• Force password change

Supported identity systems and apps:

This moves incident response from per-system actions (sign into Entra to disable the Entra account, sign into Okta to disable the Okta account, sign into Salesforce to disable the Salesforce account) to identity-centric orchestration. For a compromised user with accounts across three directories and two SaaS apps, containment goes from a 15-minute multi-portal scramble to a single action.

Unified Identity Timeline (MC1461705)

The Identity page in Defender XDR now consolidates identity-related events — sign-ins, alerts, risky activities, and response actions — into a single chronological view across all connected identity sources.

Instead of jumping between Entra ID sign-in logs, AD event logs, and Okta audit trails, analysts get a correlated timeline that shows what happened, when, and across which systems. This is the investigation companion to the unified response actions: see the full picture, then act on it.

What Administrators Should Do

1. Audit Defender XDR identity connectors — ensure AD, Entra ID, Okta, and major SaaS apps are integrated and up to date
2. Verify identity mapping quality — UPNs, emails, and IDs must be accurate for linked account correlation to work
3. Update incident response runbooks — define when analysts should use unified response vs. per-system tooling
4. Train SOC teams — show them the unified workflow, supported actions per connector, and the identity timeline

3. Cloud Sync: Entra ID to AD User Provisioning (Preview)

Status: Group provisioning GA; User provisioning Public Preview Action required: Evaluate for cloud-first identity scenarios

Microsoft Entra Cloud Sync can now provision users from Entra ID to on-premises Active Directory — the reverse of the traditional AD-to-Entra flow. This is a capability hybrid identity teams have been requesting for years.

What’s Available

Why This Matters

Until now, if you wanted to manage users in Entra ID and have them appear in on-premises AD, your options were limited. Entra Connect Sync could push AD objects to the cloud, but not the other way around. Organizations adopting cloud-first identity management had to maintain custom scripts or third-party tools to populate AD for legacy applications, on-premises file servers, or Kerberos-based systems.

With Cloud Sync’s bidirectional capability, Entra ID can now serve as the authoritative identity source while still populating AD where it’s needed. The configuration flow in the Entra admin center (Entra ID > Entra Connect > Cloud Sync) guides administrators through scoping filters, attribute mapping, on-demand testing, and enablement.

Prerequisites

• Hybrid Identity Administrator role minimum
• Entra provisioning agent installed on-premises
• AD DS schema with msDS-ExternalDirectoryObjectId attribute (Windows Server 2016+)
• For group members: users must have AD accounts with matching onPremisesObjectIdentifier

Companion Feature: Preserve Group OU and Name When Converting SoA

A related preview capability preserves a group’s organizational unit and name when switching its Source of Authority between AD and Entra ID. This matters because on-premises applications often depend on group names and OU paths for GPOs, legacy ACLs, and LDAP queries. Previously, SoA conversion could disrupt these references.

4. Lifecycle Workflows V2 Time-Based Triggers with 365-Day Offsets

Status: Documentation updated, available Action required: Review existing workflows for annual process opportunities

Lifecycle Workflows just got significantly more capable for long-term automation. The V2 time-based attribute trigger now supports 365-day event offsets, increased from the previous 180-day limit.

What Changed

• Event offset: Up to 365 days before or after a supported date attribute (hire date, contract end date, license expiry)
• Comparison options: Exactly, Less than or equal to, Between (with offsets from 0 to 365 days)
• Requirements: Both the workflow and schedule must be enabled
• V2 behavior: No three-day catch-up window (unlike V1)
• Admin center note: Preview admin center may show two choices representing the same trigger during transition

Why This Matters

Previously, workflows requiring annual triggers — contract renewal reminders, yearly access certifications, long-term license lifecycle — needed external schedulers or custom scripts. With 365-day offsets, these can be configured natively in Lifecycle Workflows.

Use cases now possible:

• Annual account certification for contractors
• Year-based role assignment expiration and renewal
• Long-term license and account lifecycle schedules
• Contract end-date workflows with months of lead time

5. Inbound Provisioning: Flow Null Values to Clear Target Attributes

Status: Public Preview Action required: Evaluate attribute mappings for null handling

A deceptively simple but long-requested capability: inbound provisioning flows can now clear target attributes when the source value is null or empty.

The Problem This Solves

Previously, if a source system (HR, SAP, Workday) removed an attribute value — say, a department code or phone number — the provisioning engine would simply skip the attribute. The old value would persist in Entra ID or AD, creating data drift between systems. Over time, identity stores accumulated stale attributes that no longer reflected reality.

How It Works

• Administrators enable “Flow null values” on both the source and target attribute mappings
• When the source value is null or empty, the provisioning engine actively clears the corresponding target attribute
• Supports only single-valued attributes in specified inbound provisioning scenarios
• Must be enabled per mapping, not globally

Why This Matters

This matters for privacy and compliance. Stale department codes, outdated phone numbers, and orphaned custom attributes are more than cosmetic — they can drive incorrect access decisions, break dynamic group membership, and create audit findings. With null-value flow, removing data upstream now has a direct, predictable impact on identity stores.

Additional Updates

GSA macOS Client August 21 Release

Global Secure Access macOS client v1.1.26060207 adds Home Network traffic controls, a Connections page, agentic detection support, and Secure DNS bypass. The Connections page improves supportability by giving users and admins visibility into current routing behavior. Home Network traffic controls allow more granular handling of traffic from remote/hybrid workers.

New Documentation: Govern Access to On-Premises Apps from Entra ID

A new tutorial documents how to govern access to on-premises applications from Microsoft Entra ID, bridging cloud identity governance with legacy application access management. This is part of Microsoft’s ongoing effort to make Entra ID the control plane for all access, not just cloud-only resources.

Entra Domain Services Enhanced Security Account Manager (Preview)

Public preview of enhanced security account manager support in Entra Domain Services, improving how managed domain service accounts are handled.

Key Dates to Watch

• September 1, 2026: Passkeys become default in Entra ID; auto-enablement begins for SMS/voice users
• October 5, 2026: SSPR registration campaign begins
• October 2026: B2B guest passkey rollout begins; Windows Hello for Business and macOS Platform SSO recognized as standalone MFA factors
• October 26, 2026: Custom CSS positioning properties retired globally in Entra ID branding
• November 3, 2026: MemberOf rule operator retired in dynamic groups, AUs, and entitlement management
• November 9, 2026: SSPR enforcement — only explicitly registered methods accepted
• November 2026: GSA client auto-upgrade via Windows Update begins
• Late November 2026: myaccount.cloud.microsoft worldwide rollout
• Mid-October 2026: Defender XDR unified response actions and timeline rollout begins
• February 1, 2027: Microsoft-hosted SMS/voice authentication fully retired (no opt-out)

Follow Kevin on X at https://x.com/kkaminsk for daily Microsoft Entra updates and analysis.