Microsoft Expands Entra Governance and Access Controls for AI Agents and Guest Users
Microsoft is adding new governance, authentication, and access-control capabilities to Entra to help organizations manage users, guest accounts, and AI agents more effectively. The updates aim to reduce identity sprawl and security risks, though administrators will need to review policies and configurations before deployment.
Key Takeaways:
- Microsoft has added drift detection reports and new identity governance capabilities to Entra.
- Organizations can now automate lifecycle management for guest users and AI agent identities.
- The update also expands passkey support, Continuous Access Evaluation, cloud firewall controls, and third-party telephony options.
Microsoft’s latest Entra updates address the growing challenge of managing identities, devices, guest users, and AI agents. As organizations expand their use of cloud services and AI-powered workflows, keeping permissions and access controls up to date becomes more difficult, increasing the risk of security gaps, unauthorized access, and compliance issues.
Microsoft expands Identity Governance in Entra
To address these problems, Microsoft introduced several new identity governance and security capabilities for commercial customers. The new drift detection reports feature helps administrators identify when access permissions no longer align with policy requirements, while application group discovery extends governance to groups created directly within connected applications.
Microsoft also added automated lifecycle policies for guest users and AI agent identities, which allow organizations to disable or remove accounts that are no longer needed. These features help reduce the accumulation of stale identities and excessive privileges over time.
Microsoft Entra adds stronger authentication and access controls
Microsoft also expanded secure-access capabilities across the Microsoft Entra platform. Administrators can now apply cloud firewall controls to Global Secure Access client traffic, use custom HTTP headers to enforce SaaS tenant restrictions, and leverage Continuous Access Evaluation (CAE) to react to device-risk and user-risk signals within minutes. Moreover, phishing-resistant authentication has been strengthened through broader support for passkeys, passwordless sign-ins, Windows Hello for Business, and macOS Platform SSO as MFA methods.
To simplify administration and reduce operational complexity, Microsoft introduced support for third-party telephony providers such as Soprano, Telesign, and Infobip for SMS and voice authentication. Microsoft Entra Cloud Sync can also now synchronize on-premises Active Directory computer objects to Entra ID, which enables hybrid device join scenarios.
Faster adoption still requires ongoing oversight
These enhancements improve security, governance, and automation, but they also require organizations to carefully review lifecycle policies, authentication strategies, and network-access configurations. Automated removal of guests or AI agents can reduce security risks, but poorly designed policies could disrupt legitimate access.
Additionally, stronger authentication methods and real-time policy enforcement may improve protection against attacks, but they can introduce additional deployment and user-adoption challenges.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...
