Entra Chat Feb 2026

Sat down wih two legends: Merill Fernando and Daniel Bradley to talk about what's new in Entra ID.

We break down:

1️⃣ Passkey Profiles Are Becoming the Default
→ Starting March 2026:
→ Passkey profiles will be auto-enabled
→ Tenants that haven’t configured profiles will be migrated
→ Registration campaigns will shift from Authenticator-first to passkey-first

2️⃣ Source of Authority Conversion Is Finally GA
For years, admins used messy delete-and-restore hacks to convert synced users to cloud-only.
→ Now it’s officially supported.
→ You can convert individual users from on-premises authority to cloud-managed — without breaking hybrid entirely.
Why this matters:
Easier M&A transitions
Full access to Entra ID Governance features
Cleaner lifecycle management
Reduced dependency on legacy infrastructure

3️⃣ App Registration Deactivation (A Quietly Powerful Feature)
→ Microsoft added the ability to deactivate app registrations.
→ Instead of deleting an app (and losing configuration), you can now:
→ Immediately stop token issuance
→ Preserve metadata and permissions
→ Investigate safely
→ For incident response scenarios — especially in multi-tenant or MSP environments — this is a big step forward.

4️⃣ Conditional Access Behavior Changes
→ There’s also a change impacting tenants with Conditional Access policies targeting “All resources” but excluding certain apps.
→ Previously, certain minimal-scope apps could bypass enforcement under specific conditions.
→ That loophole is closing.

5️⃣ Sync Security Hardening (Hard Match Protection)
→ Microsoft is adding additional validation to protect against malicious hard matching scenarios in hybrid environments.
→ This reduces the risk of identity takeover via manipulated on-prem objects.
It’s automatic — but important to understand if you manage hybrid identity or MSP transitions.

Watch the full episode for the deep technical breakdown and real-world implications.