What's new in Microsoft Entra: September 2026

Microsoft announces new generally available and preview capabilities for tenant governance, access reviews, lifecycle workflows, passwordless Teams device identities, Cloud Sync, Domain Services and secure AI access.

What changed

Generally available additions include Tenant Governance, user-centric Access Reviews, workflow cloning and passwordless Resource Accounts for shared Teams devices. Public previews add sAMAccountName synchronization, cloud-to-AD DS provisioning and an MCP Firewall for AI-agent traffic.

Technical details

Tenant Governance and user-centric Access Reviews are generally available
Lifecycle Workflows can be cloned in the Entra admin center
Resource Accounts add passwordless device-bound credentials for shared Teams devices
Cloud Sync can provision cloud identities and groups to on-premises AD DS
Global Secure Access adds an MCP Firewall for AI-agent traffic

Why it matters

Identity teams gain centralized tenant controls and new lifecycle automation, while the announced role, permission and MemberOf changes require configuration reviews before their deadlines.

Known limitations

sAMAccountName synchronization for Domain Services is in Public Preview
Cloud-to-AD DS provisioning through Cloud Sync is in Public Preview
MemberOf-based configurations must be replaced by November 3, 2026

Now check

Review shadow tenants and define Tenant Governance baselines
Pilot user-centric Access Reviews and cloned Lifecycle Workflows
Inventory MemberOf rules and replace them before November 3, 2026
Validate applications that use User.ReadBasic.All and assign only the required replacement permissions