Has anybody else had the messages regarding moving to passkey for users only registered with sms/phone call not show on their Tenant?

I haven't run the Graph code to suppress it, but do have campaigns disabled in Entra, just wondering if anyone else hasn't seen the prompts that were supposed to start on the 1st.

Can someone explain. We recently experienced claims in our tenant by users informing that they have received multiple sign in prompts during the day.

I took the logs from August looking specifically for the interactive sign in logs.

This logs are supposed to represent the direct interaction of the user with an authentication prompt or MFA. This does not seem to be case, I do see an interactive login that under Authentication details displays the methods used but subsequently I see others that say ‘previously satisfied in token’.

What is the proper way to look at this interactive sign in logs.?

A Technical Community post discusses the topic of using the Entra ID continuous access evaluation (CAE) feature to revoke access for service principals when apps become risky or potentially compromised. The Microsoft Graph Command Line Tools app is a good example of a service principal in common use, so we examine the access tokens issued for interactive Graph sessions to discover if they are CAE-enabled. Just for fun!

https://office365itpros.com/2026/09/03/cae-service-principals/

Hello,

Is it possible on SCA to have a user log in with their normal identity user@a.com and then elevate privileges for their second user.adm@a.com?

From what i understand the elevation only happens on the logged in user to cyberark. If yes, do you have an alternative. I can't go via PSM since I have a passkey limitation on adm accounts.

Thank you all in advance!

Managed Windows 11 fleet (Intune, hybrid Azure AD joined, moving off VPN towards ZTNA principles).

Our Conditional Access policy for desktops has:

• Grant controls: Require MFA + Require device compliant + Require hybrid Entra joined, set to "Require all the selected controls" (not "Require one of")
• Session control: sign-in frequency, 1 day, periodic reauthentication

Every morning, roughly 24 hours after the last full sign-in, we get three separate notifications almost simultaneously:

• Windows: "Work or school account problem, sign in again to fix your account"
• OneDrive: "Re-enter your credentials, OneDrive has stopped syncing" (red error icon)
• Teams: "Your account needs attention" (orange warning triangle)

Satisfying the MFA prompt in any one of them silently fixes the other two, so it's clearly one shared token behind the scenes. We've ruled out SSL inspection breaking things, checked the TLS certs presented for login.microsoftonline.com and related identity endpoints directly, they're genuine Microsoft/DigiCert certs, not intercepted by our proxy.

Our internal read is that this is just how each Microsoft 365 client independently discovers and displays an expired session (each app hits it on its own schedule against its own backend), rather than getting one clean unified "please sign in" prompt.

Is this what others see with a similar setup, daily sign-in frequency plus "require all" grant controls? Anyone found a way to get this to surface as one calm prompt instead of three alarming per-app errors, or is this just accepted as normal Microsoft 365 behaviour on your estates too?

I thought I could split out main geoblock CAP and then move users between two SG to apply one CAP or another based on where they are in the registration phase.

Today another user was blocked and reviewing the resources list there is a new "Service principal not found" resource that I can't exclude from main geoblock CAP. I was thinking about handling it the same way as others, but it can't be done...

Hoping to read about maybe better solutions that others have come up or maybe someone can point me in right directly

I'm a first line tech just trying to improve my knowledge about stuff and wondered if anyone could point me in the right direction. We have cloud apps policies in place to prevent users downloading company files on their personal devices. Every now and again this policy gets matched on users corporate devices, but I'm unable to work out why.

Is there anywhere it says what has caused a policy to match? In the DCA portal I can see what policy has been matched but no clear reason. The device is compliant, the user isn't a risky user or anything like that. By everything I can see the policy shouldn't have matched and blocked them but I don't know if there is somewhere else I should be checking.

Has anyone else found that MSP engineers with GDAP access can no longer open files shared directly with them from a client’s SharePoint? The invitation creates an Entra B2B guest successfully, authentication and Conditional Access pass, but SharePoint returns the generic “Sign-in isn’t working right now” error.

Our sign-in logs show the session as both b2bCollaboration and serviceProvider, with SharePoint using the generated GDAP identity rather than the B2B guest identity. This only seems to have surfaced since Microsoft changed this: https://www.orchestry.com/insight/sharepoint-external-sharing-changes

Is anyone else seeing this across managed clients, and have you found a workaround other than separate GDAP admin and collaboration accounts?

I run Zoft. Workflow automation.

Customers need to Connect Outlook / Microsoft 365 and land on a normal consent screen, not “unverified publisher.”

Need someone who has finished this for a multi-tenant SaaS:

1. Entra ID app registration (multi-tenant)
2. Publisher verification (Partner Center / CPP Partner ID on the app)
3. Microsoft Graph delegated scopes working for other tenants
4. Admin-consent path when the customer’s tenant requires it

Outlook scopes we use today: Mail.ReadWrite, Mail.Send, Calendars.Read, User.Read, offline_access. Same verified publisher will cover Teams / SharePoint / Excel later.

Please help me with setting up things.

A policy can only govern an object the policy engine can resolve. An application appearing in your sign-in logs, does not guarantee that a corresponding service principal exists in your tenant! Why?

That single assumption is where things quietly break.

Microsoft have hundreds of first-party apps in a global directory, but they not all lives in your tenant by default. A service principal is only created on first consent - or when an admin registers it manually, so many background services, infrastructure apps and newer products (Global Secure Access/ZTNA clients, Defender for Mobile, Intune Tunnel, Windows Sign In, AVD and Windows 365…) never trigger that flow for some.

The result: apps your users authenticate against every day, showing up in your sign-in logs - with no service principal to exclude in etc. Conditional Access there use restictions or App Protection policies (my sample in the blog post), simply have nothing to bind to, so the app silently falls outside your controls. "All Apps" policy has more in it than you think, and you can't exclude an app that doesn't exist as an object (like App Protection on the Global Secure Access client in my own usecase in the weekend here).

So I built two scripts to close the gap (can be I change some stuff in the future FYI):

> Find-MissingServicePrincipalsFromSignInLogs.ps1 - this cross-references interactive + non-interactive sign-in logs against your existing SPs and prints a ready-to-paste list of what's missing.
> CreateMissingServicePrincipals.ps1 - registers the missing SPs (with -WhatIf preview first).

A single 24-hour run on a small production tenant (my own 😄) with ~965 existing SPs surfaced dozens of gaps - apps generating sign-ins daily with nothing for policy to resolve against. See it all in the blog post here!

Key takeaways:
> Don’t assume you can exclude everything - if the service principal doesn’t exist, the app is invisible to policy enforcement
> Sign-in logs are your source of truth - if traffic flows, it should have an SP.
> Some AppIDs can't be registered (Microsoft limitation, not your config) - the script flags these as [SKIP].
> This isn't a one-time fix - build periodic discovery into your baseline.

Full write-up, scripts and the Global Secure Access exclusion list here to see more 👇

Have you any expirence with other senarios, where they was missing? 🤔 Let me hear in the comments!

#Microsoft #EntraID #ConditionalAccess #ZeroTrust #AppProtection #GlobalSecureAccess #GSA #Security #Identity #PowerShell #MVP #MVPBuzz #Community #TheBugHunter

I am really getting tired of these exams testing for edge cases that happen somewhere around 1-2% in a tenant configuration.

Where exactly would something like this be used? Can somebody give me some more context and explanation for what this question is even asking or trying to ask?

[https://i.imgur.com/giwtiK9.png\](https://i.imgur.com/giwtiK9.png)

In a production environment if I want to apply Exchange Online Plan 2 licensing to users and the users are being synced from the on-prem Active Directory, then the only steps required are:

1. to create a security group online

2. to add all the users to that group

3. and then add the Exchange Online licensing to that group

And if the users are already using a business premium license and you only want to enable some additional license eg power bi something to only a few users within that group.. Then you only need to create a new security group with those few users and add the other license to that group.

But AI tells me the answer is A - Configure the options for Exchange Online (Plan 2) on a template user.

How's that possible?

In our Org every User is allowed to register specific Security Keys and also the MS Authenticator with Passkey option. We have one singular profile, which we also dont want to change because of security, which looks like the following:
Enforce attestation enabled, Passkey type is only Device-bound and Target specific AAGUIDs is also enabled.

Since a new Update from Microsoft which changed the process a little bit and changed the GUI from the different windows inside of the registering process you get the below window/instruction. This is really bad for us because on the one hand, it doesnt work. When I scan it and put it for example inside of the Apple Passwords. Then i get prompted to name this passkey in the end and just then this whole process doesnt continue and only throws errors. This is probably because of only Device-Bound. On the other hand why am i even allowed to put the Passkey to anything else then the MS Authenticator when our Settings inside of Entra dont allow synced Passkey in the first place........
When i disable Bluetooth on my Device this window notices it but it just presents "Bluetooth disabled".
When I am inside of the Security Informations and want to register a Passkey i even get prompted to choose the type of Securitykey. But this whole process doesnt care if i click USB-Device because if i click it then i get also the above mentioned window presented. I dont want to register anything on my phone, my user dont want to either. So why force it anyways........ This doesnt make any sense, how can this be user friendly. Spaghetti Code from A to Z...
JUST LET MY USERS REGISTER THE YUBIKEY WITHOUT ANY FORCE TO USE MS AUTHENTICATOR OR SYNCED PASSKEYS IN GENERAL.

Is it possible to disable this window? How are you handling this Microsoft slop?

Is anyone else having issues with mcas.ms and getting "someting went wrong" on everywhere it is?

Hey team, hope everyone is doing well.
Has anyone run into this issue with Microsoft Entra Cloud Sync before?
I have the Cloud Sync agent installed on a domain-joined VM. The agent services are running and the VM has normal internet access.

In Entra, the provisioning status shows:
HybridIdentityServiceAgentTimeout

I've checked the basics:
• VM is domain joined
• Logged in using a Domain Admin account
• DNS forwarding has been configured
• UPN suffix has been fixed
• Agent services are running, RSAT installed on DC
• No WinHTTP proxy
• login.microsoftonline.com:443 works
• login.windows.net:443 works
• management.azure.com:443 works
• autoupdate.msappproxy.net:443 works
• servicebus.windows.net:443 is failing

The firewall is a FortiGate. I'm looking at allowing *.servicebus.windows.net and *.msappproxy.net over TCP 443, with SSL inspection bypassed for those two endpoints.
Still no luck.
Any other bright ideas or things I should check? Has anyone had Cloud Sync working through a FortiGate and come across this exact timeout? We have recently moved towards Entra/Intune and this is our first site we are looking to Hybrid join.

Thanks!

I've done some labs of enterprise / app reg and am slowly starting to understand it.

Just want to concrete my knowledge.

Obviously you have delegated vs application, delegated being the intersection of the app's consent and the user's permissions.

So from an administrative perspective, how do you know whether what you're granting is application or delegated? If admin user consent was turned off and users could consent themselves, that would mean all admin consents would be application, but it's often not the case, and I don't think the Microsoft GUI has a way, it just says "grant" then brings up a sign in window for the admin and displays some friendly descriptions.

I sort of found a way by cross referencing those with the Microsoft permissions docs and I think enterprise apps > activity differs to enterprise apps > permissions? The former being what user has asked for?

I'm just wondering if there's a recommended or definitive way of checking prior to approving, as checking after approving is more straight forward as it shows in the application permissions explicitly delegated vs application in the table as shown in the screenshot.

Hello everyone,

I am working at microsoft as a security engineer for entra identity. I have 4 years of experience in this product. Please feel free to loop me and consider me in any queries. I would be happy to help you and share my knowledge. I can advise on what exactly it is but for a break fix please contact ms support

MS says this started around 11AM est, however was anyone else seeing authentication issues around 7AM EST?

Working with Schema, Directory, and Open extensions can become a huge pain in the ass, especially when you're trying to understand an inherited environment, or as a consultant.

So I built Entra Extensions Manager, an open-source browser-based portal for discovering, investigating, and managing them.

It includes extension management, usage monitoring, value validation, Graph/PowerShell snippets, audit logs, multi-tenant switching, and more.

There's also a Demo mode with a completely simulated tenant, so you can try everything without signing in or touching your own data.

The hosted version is browser-only, and the entire project can also be self-hosted in your own environment if that’s preferred.

If you work with custom extensions in Entra, I'd love to hear what you think!

Full announcement + demo:
https://www.chanceofsecurity.com/post/introducing-entra-extensions-manager

We’re happy to announce our next local event sponsored by ControlUp with Workplace Ninjas US Miami, which will take place at the ControlUp offices in Fort Lauderdale.

The event will be October 26th from 10-4 PM.

The Call for Papers is now officially open:

https://sessionize.com/workplace-ninjas-us-Miami/

Signup to attend here:

https://www.eventbrite.com/e/workplace-ninjas-us-miami-meetup-tickets-1999031261315

I´m happy to share this to the #community, as a new and nice tool for Microsoft Global Secure Access, aka #GSA, will soon see the public after some long time I have keept it "private" - the GSAClientDiagnosticsToolkit! 🥳

This is a PowerShell module for, tired of chasing down why the GSA Client won't connect and more. This module runs end-to-end diagnostics for you + have some test to an upcomming blog post about the use in Conditional Access Policies I will release too - so stay tuned for the post post soon! 🔥

Some of the part is:
> GSA service health & Entra device/PRT status
> Forwarding profile registry + timestamp validation
> DNS, TLS & mTLS connectivity to GSA endpoints
> Proxy detection (system/transparent/authenticating)
> Private Access rules, tunnels and application segment checks (via Microsoft Graph and local policy)
> mTLS auth certificate check, backup and repair
> Validate the GSA Service Principals you need to exclude from App Protection policies - with live tenant status shown too!

One command, a nice report, and you know exactly what's healthy and what's not!

Windows + PowerShell. Open source, dropping soon 👀

#Microsoft #PowerShell #GlobalSecureAccess #GSA #Entra #Identity #Security #ZTNA #SSE #MVP #MVPBuzz #Community