Microsoft Entra November 2026 Update: Access Drift, Windows Hello MFA and SMS Provider Deadline

One thing to note first: although the headline says November, the post covers features released in October 2026. Microsoft groups them by the outcome customers want rather than by product. Some items are generally available (GA) and others are public previews, and that difference matters for production planning. Here is each item, what it does, and what to check before you turn it on.

The quick inventory​

Governance: finding access that came in through the side door​

Access package drift reports (Public Preview). This is the item governance teams will care about most. Access packages describe who should have access. Drift is any gap between that and who actually has it: someone added straight to a group, or an assignment that never applied. Microsoft says the reports flag both over-granted permissions and missing assignments, and they refresh daily and require Microsoft Entra ID Governance or Microsoft Entra Suite.

Microsoft's entitlement management documentation explains what the report covers. It lists Microsoft Entra groups containing members who lack a corresponding access package assignment, applications with application role assignments that lack a corresponding access package assignment, and active access package assignments where the expected group membership or application assignment is missing.

To use it:

1. In the Microsoft Entra admin center, go to ID Governance > Access Guardian > Reports > Access Drift and check the "Access drift data as of" timestamp.
2. Work through the Groups tab, open a resource to see each user with the access package and the expected role.
3. Fix unauthorized access by assigning the user to an access package. Fix missing access by reprocessing the assignment.

The documentation also lists limits that the announcement leaves out. Drift between entitlement management and third-party applications, Azure roles, or SharePoint sites isn't included. Nested groups are excluded too: the report only shows drift between access package assignments and users directly assigned to the group. If your environment relies on nested groups, a clean report does not mean you have no drift.

The community is already building on it. A pull request to the open-source Maester testing framework adds checks that verify governed, non-role-assignable group membership matches access package assignments. In other words, people are wiring drift into automated tenant testing within weeks of the preview.

Application group discovery (Public Preview). Account discovery now covers groups created directly inside connected apps. Admins can classify each one as local, unassigned or assigned and bring it under governance. Do not confuse the two features: drift reports check governed Entra groups and enterprise apps against policy, while group discovery finds groups that live inside the apps themselves. The announcement does not give licensing or supported connectors for this one.

Summary: Drift reports give governance teams a daily view of where access has departed from policy. Check the scope limits (nested groups, SharePoint, Azure roles, third-party apps) before you trust a green result.

Network access: firewall, home printers and headers​

Three Global Secure Access (GSA) items stand out:

• Cloud firewall for GSA clients (Preview): The Entra Internet Access cloud firewall now covers traffic from the GSA client, with rule-based security profiles for controlling outbound connections. Microsoft gives no client versions or setup steps.
• Prefer Local Network (Preview): This fixes a long-standing remote-work annoyance. Users can reach printers, routers and displays on their home network without disconnecting from Global Secure Access, because overlapping traffic is routed straight to the local devices. If you have ever told an exec to "just turn off the VPN to print," this one is for you.
• Custom HTTP headers (GA): Admins can enforce tenant restrictions at the network layer for SaaS services such as GitHub and Slack. You still need TLS inspection for HTTPS destinations, which brings its own work: certificate deployment, privacy review and breakage testing.

Summary: Internet Access keeps taking over jobs from traditional secure web gateways. Custom headers only work if you have TLS inspection in place.

Authentication: phishing-resistant from day one​

Passkey or passwordless as the first MFA method (GA). New users can register a phishing-resistant method first, instead of starting with SMS or another weaker method and upgrading later. Rollout continues through February 2027, so some tenants will get it before others. The announcement does not list which passwordless methods qualify.

Windows Hello for Business and macOS Platform SSO as standalone MFA (GA). This is the most Windows-relevant item in the post. These device-bound credentials now count as MFA on their own for step-up prompts, Authentication Strength policies and sign-in frequency checks, with no extra passkey needed. Rollout starts in early November 2026. Mixed Windows and Mac fleets should see fewer redundant prompts for users who already signed in with strong credentials.

Authenticator passkey backup on Android (GA, from January 2027). Microsoft is publishing guidance for backing up passkeys. It requires Google One backup and a screen lock, and it applies only to personal profiles. Organizations that deploy Authenticator in Android work profiles should not assume this covers them.

Summary: Microsoft keeps pushing phishing-resistant sign-in as the default. Windows Hello for Business now goes further toward meeting MFA requirements without extra prompts.

Continuous Access Evaluation gets device and user risk​

Universal CAE now considers both user risk and device risk. If a device is disabled or marked noncompliant, or high user risk is detected, the GSA client triggers reauthentication within two minutes. Be careful with that number: the announcement ties it to the GSA client, not to every app, client or network path. Before you promise "two-minute revocation" to an auditor, check which of your traffic actually goes through Global Secure Access.

Cost and complexity: one hard deadline​

Bring your own telephony provider (GA). This is the item to put on your calendar now. Organizations can pick a supported provider (Soprano, Telesign or Infobip) to deliver SMS and voice authentication, while Entra keeps handling the authentication logic. Microsoft-provided delivery retires on February 1, 2027, and Microsoft tells organizations to set up a provider before then. It is the only firm migration deadline in the post.

You can treat this as a push away from SMS and voice altogether. If you still depend on them, you now need a vendor contract, procurement and testing within about three months, with the holidays in between. It may also be the right moment to review how many users still depend on SMS, especially since the passkey-first registration change makes moving them off it easier.

Cloud Sync device synchronization (GA). Entra Cloud Sync can now sync on-premises AD computer objects to Entra ID, which enables hybrid join. Until now, that was a main reason to keep the heavier Connect Sync around. Microsoft says you only need to enable device sync in the Cloud Sync configuration. Read the implementation documentation for prerequisites before you change production sync.

AI agents: identities with an expiry date​

Agent identity lifecycle management (Preview). As organizations add AI agents, they are piling up service identities that nobody remembers creating. Admins can now set reconfirmation intervals, sponsor requirements and inactivity monitoring. All tenants get a default inactivity policy at no license cost: it notifies owners after 60 days of inactivity and disables the identity if no new activity follows. Microsoft does not define what counts as "activity" or say whether disabled agents are eventually deleted. Pilot this before you rely on it, so a quarterly-reporting bot doesn't get switched off by surprise.

Guest lifecycle policies (Preview) follow the same idea for external users. Policies can look at sponsor attestation, recent activity or redemption state, then disable or delete guests who no longer qualify. Start with a small group of guests. Nobody wants to explain why a partner's whole team lost access on a Monday morning.

The bottom line​

This is a vendor roundup, so it describes features rather than testing them. Many items are still previews, and several GA features are on rollouts lasting months. Still, there is real substance here. In order of urgency:

1. Before February 1, 2027: choose and set up an SMS/voice provider, or move users off telephony methods.
2. This month: check how Windows Hello for Business and Platform SSO standalone MFA affects your Authentication Strength and sign-in frequency policies as the rollout arrives.
3. Pilot: drift reports, guest lifecycle policies and agent inactivity policies, keeping in mind the limits on nested groups and other scope.
4. Plan: whether TLS inspection is in place before you rely on custom headers for tenant restrictions.

More is on the way. Microsoft has an Entra session at Ignite (November 17–20 in San Francisco and online) on November 18 at 10:15 a.m. Pacific. Expect that one to be more about agents.