Over the last few months, I've spent a lot of time with customers and our teams on one of the biggest security shifts ahead of us: securing an enterprise where people and AI agents are both acting on behalf of the business.

It’s a challenge shaping Microsoft's approach to Secure AI. And while AI makes the challenge urgent, the underlying problem is broader. Organizations need to give more people, applications, workloads, and agents access to more resources, while maintaining control without adding more friction and complexity.

Identity and network access are at the center of the transition.

Customers are clear about what they need. Across my conversations with identity and network access leaders and practitioners, and through our ongoing customer research, four outcomes consistently rise to the top:

1. Keep my organization trusted and resilient
2. Give users and agents secure access without friction
3. Reduce the cost and complexity of access management
4. Adopt AI safely at enterprise scale

So, we're making a change to this blog.

Starting this month, we’re organizing “What’s New” around the outcomes you're trying to achieve, rather than around our product architecture. Our goal is to make the connection between what we're shipping, the challenges you’re having, and where we're headed much clearer. I welcome your feedback on this new approach in the comments.

What I'd pay attention to this month

We’re acting on your feedback with new capabilities that:

• Continue to make access more adaptive. Universal Continuous Access Evaluation in Global Secure Access can now use additional user-risk and device-revocation signals, including when a device is deleted, disabled, or becomes noncompliant.
• Strengthen how workloads establish trust. Service-to-service token binding uses mutual TLS proof of possession to cryptographically bind an access token to the workload that originated it.
• Take complexity out of everyday identity operations. From a guided path to Cloud Sync to Microsoft-managed certificates for TLS inspection, several of this month's updates are about making stronger security easier to deploy and operate.

Here's everything new in Microsoft Entra since September.

Outcome: Keep my organization trusted and resilient

Device signals added to Continuous Access Evaluation (CAE) in Global Secure Access  

Give hybrid users fast, seamless, and secure access with Universal Continuous Access Evaluation (CAE) in Global Secure Access. Universal CAE adapts access based on a user’s location, optimizing the experience on the corporate network while maintaining strong security controls. It now supports user-risk and device-revocation signals, including when a device is deleted, disabled, or becomes noncompliant.

Public Preview

Service-to-service token binding enabled for Entra tokens

This capability uses mutual TLS proof of possession (mTLS PoP) to cryptographically bind an access token to the originating workload. The initial release supports managed identity workloads running on Trusted Launch or Confidential VM/VM Scale Sets, using the latest compatible .NET libraries to access Azure Key Vault. Organizations can enable it in a controlled manner, validate it in preproduction, and expand by cohort.

General Availability

Outcome: Give users and agents secure access without friction

Improved device registration user experience for Windows

When users access resources through supported native applications protected by Microsoft Entra Conditional Access policies that require token protection, they may need to register their device before access is granted. The improved experience lets users complete registration directly during sign-in—without navigating a separate workflow.

General Availability

Streamline access request workflows for users in ServiceNow 

Users can request access packages and view their request history directly in ServiceNow. Designated approvers can review and approve or deny requests without leaving ServiceNow. Access packages, policies, and approver assignments remain centrally managed in Microsoft Entra ID Entitlement Management, combining a streamlined user experience with consistent governance.

General Availability

Enable B2B guest access with Global Secure Access

Guest users can connect through Global Secure Access while signed in to their home organization’s Microsoft Entra ID account. The client detects partner tenants where the user is a guest and offers an option to switch to the customer tenant context. Private traffic is then routed through the customer’s Global Secure Access service for secure, streamlined access.

Public Preview

Outcome: Reduce the cost and complexity of access management

Simplify migration from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync

The guided migration tool gives eligible organizations a structured path from Microsoft Entra Connect Sync to Microsoft Entra Cloud Sync. It brings key activities into one workflow: assessing readiness, setting up the provisioning agent and Cloud Sync configuration, activating Cloud Sync through a controlled transition, and validating the environment after activation.

General Availability

Move SAP SuccessFactors Provisioning to Workload Identity-based authentication 

Microsoft Entra now supports Workload Identity-based authentication for SAP SuccessFactors provisioning, replacing long-lived usernames and passwords with Entra-managed credentials and short-lived, standards-based access tokens. Customers can upgrade authentication in place on existing provisioning jobs, without recreating or restarting them. This helps organizations move to a more secure model ahead of SAP SuccessFactors’ planned deprecation of basic authentication for its APIs in November 2026. The option supports inbound provisioning to Active Directory and Microsoft Entra ID, as well as writeback scenarios, while reducing manual credential handling and rotation.

Public Preview

Clear null or empty attribute values within Microsoft Entra provisioning 

Microsoft Entra provisioning can now clear an existing target attribute when the corresponding source attribute is null or empty. Also known as null-value provisioning, this capability keeps target systems synchronized when values are removed from the system of record. It is available for API-driven inbound provisioning, Workday inbound user provisioning, and SAP SuccessFactors inbound user provisioning to Microsoft Entra ID and on-premises Active Directory.

Public Preview

Generate unique aliases with custom call-outs

Use custom call-outs with Azure Logic Apps during user provisioning to perform advanced attribute transformations for your organization. For example, custom call-outs can generate unique employee aliases. They are supported for create events in HR inbound, SaaS outbound, and cross-tenant synchronization provisioning flows in Microsoft Entra.

Public Preview

Discover and govern application groups and memberships

Microsoft Entra ID Governance can now discover groups and group memberships in connected applications. Administrators can identify local or orphaned groups without a matching Microsoft Entra object, as well as groups and users without a corresponding application assignment in Microsoft Entra ID. This helps organizations reconcile access, investigate potentially unauthorized access, and identify groups that should be governed through Microsoft Entra ID Governance.

Public Preview

Gain efficiency with Microsoft-managed certificates for TLS inspection in Global Secure Access 

Previously, TLS inspection required customers to provision and manage their own certificates and trust chains. With Microsoft-managed certificates, Microsoft provisions the inspection certificate, removing the need for customers to operate their own certificate authority or public key infrastructure to use TLS inspection.

Public Preview

Outcome: Adopt AI safely at enterprise scale

AI is changing the security problem.

For decades, much of identity and access has been built around understanding who is requesting access, what they should be allowed to do, and under what conditions. Now we need to answer those same questions for AI agents that can reason, act, use tools, access data, and operate on behalf of people and organizations.

That's why Secure AI is an area I'm personally spending a lot of time on across Microsoft.

I believe the answer has to start with visibility and control. Organizations need to know what agents exist, understand what they can access and do, contain them within appropriate boundaries, and continuously adapt those protections as the agent, its context, and its risk change.

Identity and network access are foundational to that system, but they're not sufficient on their own. Securing AI will require us to connect identity, access, network, endpoint, data, application, and runtime signals with the ability to act when risk changes.

At Microsoft Ignite, November 17–20, we'll share much more about how we're approaching this across Microsoft, including the role Microsoft Entra and Agent 365 will play.

This is one of the areas I'm most excited about, and one you'll hear much more about from me.

Onwards,

Yina Arenas

CVP and Chief Product Officer of Identity and Network Access

Follow me on LinkedIn

 Learn more about Microsoft Entra

Secure access for people and agents to AI, applications, and resources with comprehensive identity and network access solutions.

• ⁠Microsoft Entra News and Insights | Microsoft Security Blog
• Microsoft Entra blog | Tech Community
• Microsoft Entra documentation | Microsoft Learn
• Microsoft Entra discussions | Microsoft Community 

Excel has always been where work gets done.

The best outcomes in Excel rarely come from a single analysis. They come from bringing in the right data, preparing it with confidence, applying the processes you trust, and turning the result into something others can understand and act on.

Now, Copilot can help take on more of that work for you. From preparing the data and learning the repeatable processes behind your work to transforming the results into polished, connected experiences for your audience.

From data to something beautiful

With a simple prompt, Copilot can transform your workbook data into a polished, interactive canvas.

Whether you're creating executive reviews, project updates, status reports, or something entirely new, this helps turn workbook data into a dynamic experience tailored to your audience.

Since it stays connected to your workbook, it automatically updates as your data changes. If you want to modify the report, just ask Copilot. Refine the layout, surface a different insight, or tailor the story for your audience through conversation.

It’s a faster, more engaging way to share the insights in your data and help others act on them.

Teach Excel to work like you do

The final report is only part of the story. Behind every insight is a process. The approach you've refined through experience. The work that happens every week, month, and quarter before the final answer is ready.

You know that process best. Now, you can teach it to Copilot through conversation or demonstration.

Tell Copilot: With skill builder*, you can tell Copilot exactly what you want done. Share your preferred workflow, instructions, previous prompts, or examples of completed work, and Copilot can turn that knowledge into a reusable skill.

Show Copilot: Sometimes it's easier to demonstrate than explain. With skill recorder*, you can show Copilot how you complete a recurring task. As you perform the work, Copilot observes the process and turns those actions into a reusable skill.

Whether you show it or tell it, Copilot helps transform your expertise into a skill that can be used again and again. The next time that work comes around, Copilot is ready.

Less manual preparation, more progress

Great analysis starts with data you can trust.

Get the data you need: Skip the complexity of building Power Query queries yourself. With get data, this becomes a conversational experience. Simply describe the data you need, where to pull it from, and how it should be shaped, and let Copilot do the work.

Clean the data you have: Real-world data isn't always analysis-ready. Sometimes "USA," "US," and "United States" all appear in the same column. Sometimes data types are incorrect, formatting is inconsistent, or duplicate records slip through. With clean data, Copilot can identify potential issues, explain what it found, and recommend corrections before you begin your analysis.

Less time searching for data. Less time cleaning it up. More time putting it to work.

A more capable partner for your work

Together, these experiences help you spend less time on repetitive work and more time moving work forward.

Bring in data. Prepare it for analysis. Teach Copilot the processes you repeat. Create reports that stay connected to your latest information.

Because the future of Excel isn't just helping you analyze data. It's helping you spend less time doing the work and more time focused on the decisions.

Availability

• Interactive canvas is currently available in Insiders.
• Skill builder began rolling out to general availability this month.
• Skill recorder will be available in Insiders by the end of October.
• Get data will roll out to general availability mid-October. This can be accessed via the web app.
• Clean data began rolling out to general availability this month.

*This feature is subject to service capacity and usage limits, which may vary over time.

What would happen to the mail - and the nation’s ability to communicate - if a major Cold War emergency struck? The U.S. government spent decades preparing for that possibility, and the Post Office Department became an important part of its civil defense plans.

Mailin’ It! hosts Karla and Jeff talk with USPS historian Steve Kochersperger and Smithsonian National Museum of American History military history curator Frank Blazich about the Postal Service’s fascinating role in Cold War preparedness.

They explore how roughly 1,500 Post Office buildings were designated as fallout shelters by the mid-1960s, with space for approximately 1.3 million people. Those shelters were stocked with emergency food, water, medical and sanitation supplies, and radiation detection equipment. Postmasters were even prepared to serve as shelter managers, responsible for maintaining order and rationing supplies.

Thousands of postal vehicles were designated for emergency transportation, while special safety notification and change-of-address cards were created to reconnect displaced Americans with their families. The Post Office Net enlisted amateur radio operators to provide a backup communications network if conventional systems failed.

Fortunately, many of these plans were never needed for their intended purpose. But the preparation wasn’t wasted. The infrastructure, emergency planning and nationwide reach that made the Postal Service valuable during the Cold War continue to play an important role when communities face hurricanes, wildfires, natural disasters and other emergencies.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.