Why this update matters for SMB admins
Microsoft publishes a monthly “what’s new” roundup for Microsoft Entra, and the November 2026 edition covers a cluster of identity and access changes that touch MFA registration, continuous session evaluation, and governance over guests and access packages. For small and midsize organizations that rely on Entra ID for sign-in, device trust, and access to Microsoft 365 and other apps, it’s worth knowing exactly which of these changes are live today (General Availability, or GA) versus still being tested (Public Preview), and whether any of them require a specific license.
This article checks five specific items against Microsoft’s own November 2026 Entra blog post and related Microsoft Learn documentation: passkey as the first MFA method, Windows Hello for Business and macOS Platform SSO as standalone MFA factors, Continuous Access Evaluation (CAE) using device and risk signals, access package drift detection, and automated guest lifecycle policies.
One thing worth flagging up front: the blog post is titled “November 2026” but its own text describes the changes as “everything new in Microsoft Entra from October 2026.” Treat this post as a monthly roundup blog rather than a precisely dated release-notes document, and confirm exact rollout dates against the linked Microsoft Learn articles before you plan change management around specific calendar dates.
The five changes, confirmed against the source
Passkey or passwordless sign-in as the first MFA method — General Availability
Microsoft’s November 2026 Entra blog confirms that users can now register a passkey or another passwordless option as their very first MFA method, rather than needing to register a traditional method first. This is listed as Generally Available, with rollout continuing through February 2027. In practical terms, this means new users (or users registering MFA for the first time) can start with a phishing-resistant credential from day one, instead of registering a phone number or Authenticator push notification first and adding a passkey later.
Windows Hello for Business and macOS Platform SSO as standalone MFA factors — General Availability
The same blog confirms that Windows Hello for Business and macOS Platform SSO now qualify as standalone MFA factors — meaning they can satisfy step-up authentication prompts, Authentication Strength policies, and sign-in frequency checks on their own, without requiring an additional passkey registration. This is listed as Generally Available, with rollout beginning in early November 2026.
It’s important not to confuse this with a separate, related change described in a different Microsoft Entra blog post: starting the week of July 13, 2026, Conditional Access policies targeting the “Register security information” action also began applying to Windows Hello for Business provisioning and macOS Platform SSO registration. That earlier change is about enforcing Conditional Access during credential setup; the November 2026 item is about using the resulting credential as a standalone MFA factor during sign-in. They are related but distinct, and they rolled out on different timelines.
Continuous Access Evaluation with device and risk signals — General Availability
Microsoft confirms that Universal Continuous Access Evaluation (CAE) now evaluates both user risk and device risk. According to the blog, when a device is disabled or found noncompliant, or when high user risk is detected, the Global Secure Access client triggers reauthentication within two minutes. This is listed as Generally Available. Note that this behaviour is tied to the Global Secure Access client, so organizations that haven’t deployed Global Secure Access should confirm what this dependency means for their environment before assuming the two-minute reauthentication behaviour applies tenant-wide.
Access package drift detection — Public Preview, licensed feature
This is the one item in the list where Microsoft’s blog explicitly states a licensing requirement. Access package drift reports are described as helping admins spot where real-world access has diverged from the intent of an access package policy — for example, over-granted permissions or missing assignments — with reports refreshing daily. This feature is listed as Public Preview and explicitly requires a Microsoft Entra ID Governance or Microsoft Entra Suite license. If your organization doesn’t already hold one of these licenses, you will not be able to use this capability even once it reaches General Availability status, unless Microsoft changes the licensing model.
Automated guest lifecycle policies — Public Preview
The blog confirms automated guest lifecycle policies as a new Public Preview capability. Admins can define guest policies based on sponsor attestation, recent activity, or redemption state, and automatically disable or delete guests who no longer meet those requirements. The stated goal is reducing stale external access. The source material does not state a specific license requirement for this feature, so don’t assume it’s free of licensing conditions — check the linked Microsoft documentation and your tenant’s license assignments before planning a rollout, since Entra features involving entitlement and lifecycle management have required Entra ID Governance or Entra Suite licensing in other recent releases.
Other identity changes happening around the same time
Two other dated changes are worth knowing about, even though they weren’t part of the core five items and come from a separate Microsoft Entra blog post focused on security updates:
- SSPR will require explicitly registered authentication methods starting November 9, 2026. Self-service password reset will no longer accept directory-sourced phone numbers or email addresses that were never formally registered as authentication methods. A registration campaign to prompt affected users began ahead of this date.
- Custom controls are being retired in favor of External MFA, with Custom controls retiring September 30, 2026, and reaching end of life in May 2027. Organizations currently using Custom controls to integrate third-party MFA providers with Conditional Access should begin migration planning.
Neither of these is a GA or preview feature announcement in the same sense as the five items above — they’re deprecation and enforcement milestones — but they land in the same general timeframe and are relevant to the same admins managing MFA and Conditional Access policy.
The broader passkey push: context for the MFA changes
Separately from the November 2026 “what’s new” items, Microsoft Learn documentation confirms a broader shift toward passkeys as the default authentication experience in Entra ID. Starting September 1, 2026, passkeys became the default sign-in experience and users enabled for SMS or voice MFA began being automatically enrolled and nudged toward passkey registration. Microsoft-provided SMS and voice delivery is scheduled to retire February 1, 2027 for most users (and July 1, 2027 for Global Administrators and external users), after which organizations needing to keep SMS or voice must configure a third-party telephony provider through Microsoft Security Store, with provider selection available from October 30, 2026.
This broader passkey timeline helps explain why the November 2026 update includes “passkey as first MFA method” and “Windows Hello / macOS Platform SSO as standalone MFA factors” as GA features in the same cycle — they’re part of a larger, multi-month effort to make phishing-resistant authentication the default rather than an opt-in add-on.
Licensing summary
Based strictly on what the supplied Microsoft source material states:
- Access package drift detection explicitly requires Microsoft Entra ID Governance or Microsoft Entra Suite.
- Passkey as first MFA method, Windows Hello/macOS Platform SSO as standalone MFA factors, and CAE with device and risk signals are listed as GA features without an explicit license requirement stated in the source.
- Automated guest lifecycle policies is Public Preview without an explicit license requirement stated in the source.
Where no license is mentioned, that should not automatically be read as “included with every Entra plan” — it means the supplied source material doesn’t specify one. Confirm licensing against your own tenant’s admin center or current Microsoft Learn documentation before planning a deployment.
Practical recommendations for SMB admins
The following are practical suggestions based on the confirmed changes above, not documented Microsoft requirements:
- Inventory your Conditional Access policies that reference registration flows, Custom controls, or SSPR, since several unrelated enforcement changes (SSPR registration requirement, Custom controls retirement) are landing in the same general period as the MFA feature updates.
- Check your Entra ID Governance or Entra Suite license status before planning to pilot access package drift detection, since it’s a licensed Public Preview feature.
- Treat Public Preview features (drift detection, guest lifecycle policies) as non-production-ready until Microsoft confirms General Availability, and test them in a controlled group first.
- Re-verify rollout dates in Microsoft Learn rather than relying solely on blog post timing, given the “November 2026 blog describing October 2026 changes” inconsistency noted above.
Conclusion
Microsoft’s November 2026 Entra blog does confirm all five researched items, with three reaching General Availability (passkey as first MFA method, Windows Hello/macOS Platform SSO as standalone MFA factors, and CAE with device and risk signals) and two remaining in Public Preview (access package drift detection and automated guest lifecycle policies). Only drift detection carries an explicit licensing requirement in the supplied source material. Given the blog’s own internal inconsistency about whether it covers October or November 2026 changes, SMB admins should use this article as a starting point and verify exact rollout dates and licensing against the Microsoft Entra admin center and current Learn documentation before making tenant-wide changes. As always, this article is a draft summary intended to support — not replace — your own verification against official Microsoft sources.