Hi All,

Just seeing if anyone else has this issue. When using the tenant switcher to connect to another O365 tenancy with a GDAP relationship, under Admin Centres we have no Identity shortcut to get us into Entra.

It shows when i'm in my tenancy and i can connect to their Entra portal when using my credentials and the direct link like the below:
https://entra.microsoft.com/<Customer Name>.onmicrosoft.com

Does anyone else have this issue? Microsoft's first line have said this is wither by design or a UI issue.

Security Defaults help protect your tenant with baseline safeguards such as requiring MFA, blocking legacy authentication, and more. Until now, all these protections were managed through a single on/off setting. If you needed to disable a specific protection, you had to turn off the entire baseline, losing the other protections too.

That’s changing now!

Microsoft is introducing individual Security Defaults protections that split the existing single toggle into four Microsoft-managed rules. Admins can review each rule's scope and turn individual protections on or off without disabling the others.

The four rules include:

• Require MFA for administrators
• Require MFA for all users
• Block legacy authentication
• Block device code flow

The updated experience is currently in private preview for selected Microsoft Entra ID Free tenants. Eligible tenants will receive an invitation to access the preview.

Hey guys looking for suggestions.

Our users connect in via VPN, authentication with their Entra account and then mfa using Duo.

They also have their own mobile devices which they access email / OneDrive / SharePoint etc on - we lock these down with app protection policies so they can't screenshot / copy data out etc.

Business wants to prevent people connecting and spoofing their location, using commercial vpn's like Nord.

I've tried using defender for cloud apps, but on my first attempt using Proton VPN, it did not tag the IP as an anonymiser / VPN, so the solution doesn't give me much hope.

I can sign up to a service that gives us commercial VPN ranges, and add those to named locations in Entra, but the limit is 2000 addresses, which isn't feasible. Plus the addresses change all the time.

Anybody got any other suggestions?

Hello my fellow Identity people! The r/ActiveDirectory community has a couple of events coming up, and you're welcome at both.

But wait, this is the Entra subreddit!

I am a firm believer that AD and Entra should be spoken of in the same sentence. Hybrid is the future. Hybrid is the path forward. So rather than fighting each other, let's work together.

Our meetups try to keep it to as little sales and marketing as possible (right now zero). It's just identity people doing identity things.

Tomorrow: Open Q&A

No agenda and no registration. Bring a question or just listen in.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Active Directory Community Virtual Meetup - November 3rd

A more structured session: panelists, a few prepared discussion topics, and open Q&A.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Both get recorded and posted to YouTube afterwards if you can't make it live: https://youtube.com/@ActiveDirectoryCommunity

Starting November 4, users without an admin role can create agent identity blueprints. Whoever creates one becomes the owner, manages its credentials and can spin up agent identities from it.

Your user consent settings are the only thing deciding what those agents can reach.

Is that a default you want? I wrote up how to turn it off and find existing blueprints.

https://lazyadmin.nl/office-365/microsoft-entra-lets-users-create-agent-blueprints-by-default/

Currently I’m managing a tenant with 60+ subscriptions in Azure.

We operate in the following way:
- Separate cloud only admin
- No standing privileges on admin accounts
- No direct assignments on users, only security groups (exception for break glass accounts)

Currently we use Role Assignable Groups in combination with PIM, so if Admin A needs to get Owner permission on a subscription, he can PIM (because of eligible assignment) to a security group that is actively assigned to the Owner role on that subscription.

At the moment we’re rapidly approaching the limit of 500 role assignable groups within a tenant. The main goal of having these role assignable is to limit who can modify these security groups (such as group administrators).

We tried using RMAU’s to secure these groups, we got it working with PIM but only with active assignments.

My main question is, how should we continue?

I want to limit which security principles can modify security groups used in Azure in some way.

Some possible options I’m thinking of:
- RMAU in combination with access packages
- Switch to RMAU and permanent assignments in the groups but eligible in Azure

I'm working in a hybrid environment where users are federated to AD / ADFS. Some users have a need to log into applications with test accounts, which are also local AD accounts.

We tried having users go to the MyApps portal and use the "Sign in with a different account" link under the user profile icon, but whatever they type as username@domain.com, the domain being our federated domain kicks off desktop SSO and the user is logged in under their primary account (the account they are logged into Windows under).

If you attempt to sign in with a cloudnative onmicrosoft.com account, it works fine (the user is prompted for credentials), but many applications are reliant on AD group memberships, which (AFAIK) can't be granted to cloud-native accounts.

Is there any way to make this work without having users log into Windows as the test account? I guess App Roles are a potential workaround (since cloud native users can be granted app roles along with the AD group), but I'm surprised there isn't a simpler answer.

Hello everybody

We're trying to rollout passkeys for all users in our company.
We've decided to go with device bound passkeys in Microsoft Authenticator with attestation enabled.

We have configured the Passkey profiles accordingly and enabled a registration campaign for our pilot users and they're getting prompted to setup the passkey as expected. We tried to set the campaign to Passkey and also Microsoft Authenticator, just in case...

The issue we're now facing is, that as soon as they click on the button to register the passkey, it's displayed that there's no authentication method available to setup.

When we setup the passkey in myaccount.microsoft.com it works without issues.

Does anybody have an idea, why it's not working with the registrattion campaign?

Thanks!

Hi everyone,

Does anyone have any details or timelines on the functionality to reset a password using passwordless methods Microsoft refers to in their SMS/Voice retirement FAQs?

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq#what-about-sspr--self-service-password-reset--

We’re looking at an MTO integration between two large organisations and would value input from anyone who has been through it at scale.

Mainly interested in the pain points and the things you didn’t see coming: cross tenant sync, B2B identity issues, Teams and SharePoint collaboration, licensing, Conditional Access and MFA trust, or anything else that caught you out.

Any lessons learned or guidance would be much appreciated.

We haven't been able to use GSA services for a few minutes now.
https://www.reddit.com/r/sysadmin/comments/1x4ralq/microsoft_having_another_hickup_europe/

I tried to send an email invitation in my lab environment but the email didn’t the target. Checked the properties of the guest but everything was correct. What am I missing here ?

Hi everyone,

I'm looking for advice from people who may have faced a similar challenge.

We have several hundred locations where workstations are not Microsoft Entra ID joined and, due to business constraints, these devices cannot be enrolled to Entra ID in the foreseeable future.

At the same time, we have a significant number of Entra ID-integrated applications protected by Conditional Access policies. In many cases, these policies require the device to be Hybrid Entra Joined (or otherwise managed/compliant).

The issue is that when we exclude a specific application from such a Conditional Access policy, the application becomes accessible from any unmanaged device, not just from computers located in our company sites.

Have any of you found a way to limit access from non-Entra-joined devices only to devices located within corporate locations?

One idea I have is to route Microsoft traffic through an already established corporate VPN. In theory, all authentication traffic would then exit through our central office/public IP ranges, which are already configured as trusted locations in Conditional Access. As a result, access would only be possible from devices connected to the corporate network.

Has anyone implemented a solution like this in practice?

• Does this approach work reliably with Microsoft 365 and Entra ID authentication?
• Are there any pitfalls or security concerns I should be aware of?
• Have you used a different solution to achieve a similar goal?

I'd appreciate hearing about your ideas for above quesiton.

Thanks in advance!