Microsoft Entra July 2026: Backup, BYOD, AI Security

Introduction

Microsoft Entra's July 2026 update brings important changes for identity, access, and resilience. For IT administrators, the biggest takeaway is better protection against accidental or malicious directory changes, along with expanded support for external users, BYOD scenarios, and emerging AI agent security needs.

What's new in Microsoft Entra for July 2026

General Availability features

• Microsoft Entra Backup and Recovery is now generally available. It automatically backs up critical directory objects daily and retains snapshots for 7 days for tenants with Entra ID P1 or P2 licenses.
• Admins can view snapshots, compare changes, and run recovery jobs to restore a known good state after misconfigurations or security incidents.
• Direct admin assignment to external users by email is now available in entitlement management. External users can be assigned to access packages before they exist in the directory and are then invited as Guest users.
• BYOD support for the Global Secure Access Windows client now works with Microsoft Entra-registered devices, removing the previous requirement for Windows devices to be domain-joined.
• Microsoft Entra Kerberos key rotation has been improved to reduce authentication failures during rollover events by validating referral tickets with both primary and secondary keys.
• Domainless SAML federation allows external users to authenticate with their own identity provider without requiring email domain matching.

Public Preview

• Conditional Access for AI agents adds more granular targeting for agent user accounts, including custom security attributes and agent-specific policy controls.
• Restrict AD group changes to Entra provisioning helps centralize group management and reduce configuration drift between Active Directory and Entra ID.
• Custom call-outs for unique alias generation during provisioning now support advanced transformations using Azure Logic Apps.

Announcements

• Jailbreak/root detection in Microsoft Authenticator is now secure by default on iOS and Android for work or school accounts.
• Starting in August 2026, Authenticator on iOS will support an improved backup and restore process using iCloud and iCloud Keychain.
• SCIM 2.0 APIs in U.S. Government Cloud are now available, extending standards-based provisioning support to government environments.

Why this matters for IT admins

These updates strengthen operational resilience and improve identity governance across hybrid and external collaboration scenarios. Backup and Recovery is especially significant because it gives Entra admins a built-in recovery option for critical tenant objects, reducing downtime and recovery complexity.

The BYOD and domainless federation updates also make it easier to support partners, guests, and remote users without relying on older domain-bound assumptions.

Next steps

• Review whether your tenant licensing supports Entra Backup and Recovery and test recovery workflows.
• Evaluate BYOD access policies for Global Secure Access.
• Assess Conditional Access for AI agents if your organization is deploying agent-based workloads.
• Communicate upcoming Authenticator iOS backup changes to end users and help desk teams.