Microsoft Entra Updates: Cloud Sync Migration, Universal CAE and Managed TLS Certificates

Neowin says the updates follow three themes. Access decisions now react more to what is happening in the moment. Trust between workloads is easier to establish. Everyday identity work is easier to understand and manage. Microsoft is also still pushing Entra Private Access as a replacement for traditional VPNs, so many of these changes land in Global Secure Access, the umbrella name Microsoft uses for Entra Internet Access and Entra Private Access.

Here's the full list, with the documented details and limits that matter most to admins.

The full list at a glance​

Section summary: Two items are reported as generally available. Two more have no stated status. Everything else is preview, so read every row as "test first."

Universal CAE gets new signals​

Universal Continuous Access Evaluation (CAE) is a Global Secure Access feature. Microsoft's documentation says it revokes and rechecks network access in near real time when Entra ID sees a change to an identity. Unlike traditional CAE, an application doesn't have to support CAE itself. Any app reached through Global Secure Access gets the protection.

Neowin reports that user-risk and device-revocation signals are now in public preview. Microsoft's current Universal CAE page lists high user risk from Entra ID Protection as a user-based trigger. It also lists two device-based triggers, both marked preview:

• The device is deleted or disabled
• The device is found to be non-compliant

Before you plan around any of this, note three details from Microsoft's documentation:

• You need a matching Conditional Access policy. Microsoft says the device compliance and user risk signals are meant to work alongside a corresponding Conditional Access policy. Without one, reauthentication happens silently and nothing acts on the event. Microsoft's examples are requiring a compliant device for all internet resources accessed through Global Secure Access, and requiring risk remediation when user risk is high.
• Only Windows is supported. The known-limitations page says only the Global Secure Access client for Windows, version 1.8.239.0 or later, supports Universal CAE. Clients on other platforms fall back to regular access tokens.
• "Near real time" means roughly ten minutes. Microsoft estimates two to five minutes for the signal to reach the client. The client then prompts the user up to three times, with a two-minute grace period each time, before it disconnects the tunnels.

Ten minutes is a lot better than waiting up to 90 minutes for a token to expire after you disable a departing employee's account. It is still not a kill switch.

Section summary: The new signals help, but only on Windows clients at version 1.8.239.0 or later, and only when paired with the right Conditional Access policies.

Token binding for workloads goes GA​

According to Neowin, Entra tokens now support service-to-service token binding using mutual TLS proof of possession (mTLS PoP). It's generally available for identity workloads running on Trusted Launch or Confidential VMs and VM Scale Sets.

In plain terms, proof of possession ties a token to the client that obtained it. A stolen token is much less useful if the attacker can't also present the bound key.

The scope is narrow, and you shouldn't stretch it. The reporting covers workloads on those specific VM types. It doesn't say every Entra token or every Azure VM now gets binding. We couldn't find Microsoft setup documentation that confirms supported token types or implementation steps, so wait for Microsoft's official guidance before you change any production workloads.

Windows registration, ServiceNow and B2B guests​

Three access changes come with less detail:

• Windows device registration: The registration experience is reportedly smoother when users reach resources protected by Conditional Access. No Windows versions or rollout stage were given. Don't assume device join or other enrollment flows changed.
• ServiceNow: Access request workflows are reportedly simpler. The workflow type and setup path weren't specified.
• B2B guest access through Global Secure Access: This is public preview. Microsoft's known-limitations documentation also says the Global Secure Access client doesn't support concurrent sessions on one machine. That covers RDP servers and multi-session Azure Virtual Desktop. If your partners work from shared VDI hosts, find that out before the pilot.

The Cloud Sync migration piece​

This is the most important item for hybrid shops, and it has the best documentation behind it.

Microsoft's Entra Connect version history lists a new feature in build 2.6.91.0: a guided migration workflow from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync. The workflow includes configuration assessment, provisioning agent setup, staged activation, and validation. This feature is available only in the Azure public cloud. Government cloud tenants can't use this wizard yet.

The timing also fits. The documentation tracker Entra.News Daily logged a Microsoft page titled "Migrate to Microsoft Entra Cloud Sync with the Migration Tool" on 16 September 2026, inside Neowin's four-week window. On 6 October, Microsoft updated its migration guide, which now describes phased migration planning, including Cloud Sync device synchronization for Microsoft Entra hybrid join and prerequisite checks.

Here's why the tooling matters. In April 2026, Microsoft's release notes said the company was beginning the transition from Microsoft Entra Connect Sync to the cloud‑native Microsoft Entra Cloud Sync. Access Insights reports that starting this July, Microsoft is notifying tenants about their move from Entra Connect Sync to Entra Cloud Sync through the Message Center, Entra Connect Health and targeted mails.

Complex environments aren't in the first group. According to Access Insights, the early waves target tenants whose synchronization needs Cloud Sync already covers completely: single forest, standard attribute flows, no exotic rules. If you run a more involved setup, multi-forest, heavy filtering, a large directory, you are explicitly not in the first group. DaKo365 also notes that according to the official migration FAQ, you don't have to migrate as long as the functions you need are not yet supported in Cloud Sync.

Version deadlines are also coming up. Several outlets report that Connect Sync servers had to be on 2.5.79.0 or later by September 30, 2026. Access Insights adds that that minimum build itself leaves support on October 23, 2026. If any sync server is still near that floor, you should upgrade anyway, and the new migration wizard gives you another reason to do it soon.

A practical sequence for hybrid admins:

1. Check every Connect Sync server's version against the 2.5.79.0 floor and the October 23 end of support.
2. Upgrade to a build that includes the guided migration workflow (2.6.91.0 per Microsoft's version history), if you're in the Azure public cloud.
3. Run the configuration assessment. Use it to see what Cloud Sync covers in your environment, not as a promise of feature parity.
4. Watch the Message Center and Connect Health for your assigned transition window.

"Simplified migration" doesn't mean automatic migration. It also doesn't mean Cloud Sync now matches everything Connect Sync does.

Section summary: Of everything in this batch, the migration workflow carries the best primary-source backing. Combined with Microsoft's tenant-by-tenant transition notices, it should move up your hybrid identity to-do list.

The provisioning previews​

Four provisioning and governance items are in public preview:

• Moving SAP SuccessFactors provisioning to workload identity–based authentication
• Clearing null or empty attribute values in Entra provisioning
• Generating unique aliases with custom call-outs
• Discovering and governing application groups and memberships

The reporting gives no prerequisites, licensing, connector lists or a definition of "custom call-outs." HR-driven provisioning teams may find the SuccessFactors change and the null-value clearing especially useful, because stale attributes have caused plenty of messy joiner-mover-leaver tickets. For now, there's no documented procedure to follow.

Microsoft-managed certificates for TLS inspection​

TLS inspection in Entra Internet Access needs a certificate authority that client devices trust. Until now, that usually meant running your own PKI. With the new option, Microsoft creates and operates a root CA for your tenant. Microsoft Learn labels the feature preview. Microsoft says the private key stays in its secure key infrastructure and is never exposed.

The documented prerequisites are a trial license for Entra Internet Access, the Global Secure Access prerequisites, and the Global Secure Access Administrator role. The setup steps:

1. In the Entra admin center, go to Global Secure Access > Secure > TLS inspection policies and open the TLS inspection settings tab.
2. Select Create certificate, then Microsoft-managed, and select Create. No certificate details are needed. The certificate should appear with Type Managed and Status Disabled.
3. From the actions menu (...), choose Download root certificate and save the .cer file. It contains only the public root certificate.
4. Deploy the root certificate through your MDM. Microsoft points to Intune trusted root certificate profiles.
5. On a test device, confirm the certificate is in the Trusted Root Certification Authorities store.
6. Only then select Enable and confirm the status changes to Active. After that, you can create and assign TLS inspection policies.

The order is critical. Microsoft warns that applying a TLS inspection policy before the root certificate is on devices can cause certificate errors for users. The default root CA validity is ten years, and you can set a shorter period through the API.

To rotate the certificate, Microsoft says to create the new one, deploy its root, enable it, validate it, and only then delete the old disabled certificate. Keep the old root on devices until the transition is done.

The AI-agent angle​

Neowin's report ends with Microsoft's view of identity for AI. Autonomous agents act on behalf of the people who create them, so admins need ways to trace and govern what those agents do. Yina Arenas, CVP and Chief Product Officer of Identity and Network Access, said securing AI means connecting identity, access, network, endpoint, data, application and runtime signals, along with the ability to act when risk changes. Microsoft says it will share more next month, which means November 2026. That's a statement of direction, not a shipped control.

What to do with all of this​

My take, based on general industry practice and not on any Microsoft guidance: this is a solid batch with mostly incremental changes. The best near-term wins are the Cloud Sync migration workflow, the GA workload token binding, and the managed TLS certificate for teams that never wanted to run their own CA.

The pattern to watch is that most of the access-control work runs through the Global Secure Access client. If your fleet isn't mostly on current Windows clients, much of this won't apply to you yet.

To check rollout timing and availability for your own tenant, use the What's new hub in the Entra admin center. Microsoft says every Entra admin role can see it, though it's currently limited to public cloud tenants.