Microsoft ships changes to Entra ID every month, but July 2026 brings a cluster of updates that IT and security teams should not ignore. Several of these are enforcement deadlines rather than optional features, meaning tenants that do not prepare in advance risk broken sign-in flows or locked-out users. Here is a rundown of what changed and what to do about it.
Conditional Access Enforcement for Security Info Registration
Starting July 6, 2026, Conditional Access policies scoped to the “Register security information” user action are being enforced during credential registration, with full enforcement completing by July 13, 2026. Users registering MFA methods, security keys, or other credentials must now satisfy applicable policy controls first, such as multifactor authentication, network location restrictions, or device compliance. Tenants relying on registration being exempt from Conditional Access should review their policies now to avoid locking new hires or contractors out of the registration flow.
Self-Service Password Reset Now Requires Registered Methods
Microsoft Entra Self-Service Password Reset (SSPR) will only accept authentication methods that a user has explicitly registered for identity verification, starting September 7, 2026. A registration campaign begins July 6, 2026, nudging users toward completing setup before enforcement. Admins should audit SSPR registration rates now, since users who never completed registration will lose the ability to reset their own passwords once enforcement lands.
Passkey (FIDO2) Policy Expansion
Passkeys are getting more room to grow. The FIDO2 passkey policy now has a dedicated 20 KB allocation within the authentication methods policy, separate from the shared 20 KB limit that previously applied to all authentication methods combined. Microsoft has also raised the maximum number of passkey profiles per tenant from 3 to 10, giving organizations more flexibility to define separate passkey policies for different user populations, device types, or security tiers.
Entra Connect Sync to Cloud Sync Migration Notices
Organizations still running Microsoft Entra Connect Sync should expect to hear from Microsoft directly. Beginning in July 2026, Microsoft is notifying customers through the M365 Message Center, Entra Connect Health, and targeted emails about individual transition timelines for moving to Entra Cloud Sync. The migration is rolling out in phases, so the exact deadline will vary by tenant. Hybrid identity teams should treat these notices as a planning trigger rather than something to dismiss.
Retirement of Non-FIPS Compliant Signing Keys
As of July 1, 2026, non-FIPS compliant signing keys using the P-256K curve have been retired. Organizations still relying on these keys need to upgrade to FIPS-compliant signing keys to avoid disruption to token signing and validation.
What This Means for Your Organization
None of these changes are dramatic on their own, but together they signal where Microsoft is pushing identity security: stronger enforcement around credential registration, tighter control over password reset, broader passkey adoption, and cleanup of legacy sync and cryptography. The practical takeaway is the same every month, review the Entra admin center’s What’s New page, check your tenant against upcoming enforcement dates, and communicate changes to end users before they hit a blocked sign-in screen.
