What Changed in Microsoft Entra – May 2026

Microsoft’s May 2026 release cycle delivered a mix of general‑availability (GA) capabilities and public‑preview features across the Entra portfolio. The headline items are:

Category	New Feature	GA / Preview	Core Benefit
Network Access	File‑type content filtering in Global Secure Access (GSA)	GA	Network‑level DLP, blocks PDFs, spreadsheets, etc., before they leave the corporate perimeter
	Prompt‑injection protection in AI Gateway	GA	Real‑time guardrails for generative AI, no code changes required
	iOS / iPadOS client for GSA	GA	Zero‑Trust policies extend to Apple mobile devices via Defender for Endpoint
	Cloud Firewall + remote‑network configuration for internet traffic	GA	Fine‑grained source/destination filtering for branch‑office traffic
	External‑user support in Windows GSA client (MAU‑based billing)	GA	Seamless guest access with tenant‑aware switching
	Remote‑network connectivity for branch offices (IPsec tunnel)	GA	Zero‑Trust for printers, IoT, BYOD without per‑device agents
Identity Governance	Approver details in My Access portal	GA	Faster ticket resolution, transparent request flow
	Conditional Access enforcement on PIM role activation	GA	MFA / risk‑based checks for privileged elevation
	MIM 2016 SP3 with Azure SQL support	GA	Hybrid‑identity stability, reduced on‑prem footprint
	Issuer Hints for certificate‑based authentication (CBA)	GA	Simplified cert picker when multiple certs are present
	CBA on iOS (second‑factor, third in MFA hierarchy)	GA	Phish‑resistant login on Apple devices
	CA scoping for CBA	GA	Policy‑driven restriction to specific certificate authorities
	Configurable token lifetimes (access, ID, SAML)	GA	Align token expiry with risk tolerance and app requirements
	Social IdP support in Entra External ID (Apple, Google, Facebook, custom OIDC)	GA	Native sign‑up/sign‑in in mobile apps via secure web‑view
	Workday termination pre‑fetch	GA	Faster de‑provisioning for APAC/ANZ regions
	License‑usage dashboard in Entra admin center	GA	Visibility into P1/P2/Suite consumption, helps avoid over‑provisioning
Public Preview	Explicit Forward Proxy for Internet Access	Preview	Enables secure web/AI gateway on unmanaged or Linux devices
	Account discovery for connected applications (ID Governance)	Preview	Detect orphaned accounts, improve onboarding hygiene
	Entra Security Operator role extensions for SOC analysts	Preview	Scoped identity‑response actions without full admin rights
	Branding themes for app‑specific sign‑in experiences	Preview	Tailored UI per application, not just tenant‑wide
	OIDC federation between workforce and External ID tenants	Preview	Single sign‑on across internal and external apps, no duplicate accounts
	$count support in Microsoft Graph sign‑in API	Preview	Efficient pagination, reduced payloads for security analytics

Provider Comparison – Where Entra Stands Against the Competition

Feature Set	Microsoft Entra (May 2026)	Okta (2026)	Ping Identity (2026)	Key Takeaways
Network‑level DLP	File‑type filtering in GSA (GA) – integrated with Defender, policy engine shared with Zero‑Trust	Okta Advanced Server Access provides network segmentation but no native file‑type DLP; requires third‑party integrations	PingOne for Enterprise includes firewall‑as‑a‑service, but DLP is limited to URL categories	Entra now offers the first native network‑level DLP tied to identity policies, reducing the need for separate DLP appliances
AI Guardrails	Prompt‑injection protection in AI Gateway (GA) – no SDK changes	Okta AI Shield (beta) focuses on model‑level monitoring, not prompt injection	PingOne does not yet address generative AI attacks	Entra’s approach protects the request path, delivering immediate risk reduction for LLM‑backed apps
Mobile Zero‑Trust	iOS/iPadOS client using Defender for Endpoint (GA) – unified policy across Windows, macOS, iOS	Okta Verify provides MFA but not full traffic routing; requires separate VPN for Zero‑Trust	PingOne Mobile provides MFA only; network access still needs separate SD‑WAN	Entra’s client gives true network‑level Zero‑Trust on Apple devices without extra agents
Branch‑office Zero‑Trust	Remote‑network IPsec tunnel, Cloud Firewall filtering (GA) – no per‑device client	Okta’s Edge does not natively support branch‑office tunneling; relies on third‑party SD‑WAN	PingOne for Enterprise supports edge routers but requires additional licensing	Entra’s remote‑network feature simplifies branch deployment and extends policy to IoT and BYOD
Token Lifetime Control	Configurable access/ID/SAML token lifetimes (GA)	Okta allows custom access token TTLs but not SAML; limited to short‑lived tokens	Ping supports token revocation but not granular lifetime policies	Entra gives administrators fine‑grained control across OAuth and SAML, aligning with compliance windows
Certificate‑Based Auth	Issuer Hints, CA scoping, iOS support (GA)	Okta supports CBA on Windows/macOS, but no issuer hints; iOS support is limited to MFA	PingOne offers CBA on Windows only; no CA scoping	Entra’s enhancements reduce user friction and allow policy‑driven CA restrictions, a differentiator for regulated sectors
SCIM Provisioning Security	Migration to client‑credentials or workload federation (GA)	Okta SCIM uses OAuth 2.0 client‑credentials already; no upcoming change announced	PingOne SCIM still relies on basic auth in many connectors	Entra’s forced move away from Authorization Code grant eliminates credential leakage risk and aligns with Zero‑Trust principles
Governance & Reporting	License‑usage dashboard, approver visibility, account discovery (GA/Preview)	Okta Insights provides usage metrics but not license‑specific breakdowns	PingOne Governance offers similar reports but lacks real‑time license consumption view	Entra’s admin‑center analytics give direct cost‑optimization signals for MAU‑based billing

What the Comparison Means for Your Stack

• If you already run a Microsoft‑centric stack (Azure AD, Defender, Microsoft 365), the new Entra features plug directly into existing policies, reducing integration overhead.
• For organizations evaluating a switch from Okta or Ping, the network‑level DLP and AI guardrails are compelling reasons to consider Entra as a single‑pane‑of‑glass solution. The migration effort is mitigated by the announced transition from Entra Connect Sync to Entra Cloud Sync, which removes the on‑premises sync server.
• Cost considerations: MAU‑based billing for external guests and the new license‑usage dashboard give clearer visibility into spend. However, the introduction of explicit forward proxy (preview) may require additional Edge or Intune licensing for unmanaged devices.

Business Impact – Migration, Security Posture, and Operational Efficiency

1. Migration Planning

• Entra Cloud Sync adoption – Microsoft’s shift from the legacy Connect Sync to the cloud‑native Cloud Sync is scheduled to begin in July 2026. The migration window will be communicated via the Microsoft 365 Message Center. For customers, the key actions are:
  1. Run the Cloud Sync readiness assessment (available in the Entra admin center).
  2. Deploy the Azure AD Connect Health agent to monitor sync health during the cut‑over.
  3. Validate password‑hash sync, pass‑through authentication, and write‑back scenarios in a test tenant before production migration.
• SCIM provisioning re‑configuration – All provisioning jobs using the OAuth Authorization Code grant must be recreated with client‑credentials or workload federation. The migration guide (linked below) provides PowerShell scripts to export existing jobs, update the authentication method, and re‑import them.
• Token‑lifetime policy rollout – Start with low‑risk applications (e.g., internal dashboards) to test custom lifetimes. Use the Microsoft Graph API to create tokenLifetimePolicy objects and assign them via application or servicePrincipal objects.

2. Security Posture Enhancements

• Network‑level DLP adds a data‑exfiltration control point before traffic reaches the internet, complementing existing Microsoft Information Protection labels.
• Prompt‑injection protection mitigates a fast‑emerging attack surface for LLM‑powered services. By enforcing guardrails at the gateway, organizations avoid the need to embed defensive code in each AI integration.
• Conditional Access on PIM activation raises the bar for privileged accounts, ensuring MFA or device‑trust checks are enforced every time a role is enabled.
• CA scoping for CBA lets regulated industries (finance, healthcare) restrict authentication to internal PKI hierarchies, simplifying audit evidence collection.

3. Operational Efficiency

• Unified admin‑center dashboards (license usage, approver visibility) reduce the time security teams spend gathering data from disparate sources.
• Remote‑network IPsec tunnels eliminate the need for per‑device GSA clients in branch locations, cutting support tickets related to client configuration and version drift.
• Explicit Forward Proxy (preview) opens a path to secure web traffic from Linux VDI or kiosk deployments without installing the full GSA client, simplifying device management policies.

4. Cost Implications

• MAU billing for external guests replaces per‑user licensing, which can lower costs for organizations with large partner ecosystems, provided usage stays within the free tier limits.
• License‑usage insights help identify under‑utilized P2 features, enabling rightsizing of Entra subscriptions.
• SCIM migration to client‑credentials reduces the need for secret rotation infrastructure, potentially lowering operational overhead.

---

Next Steps for Decision‑Makers

1. Review the May 2026 release notes on the official Microsoft Entra documentation site.
2. Run the Cloud Sync readiness check and schedule the migration window with your Microsoft account team.
3. Audit your SCIM connectors for Authorization Code usage and plan the re‑configuration to client‑credentials.
4. Pilot the file‑type content filter in a non‑production branch network to validate DLP policy impact.
5. Update token‑lifetime policies for high‑risk applications to align with compliance windows (e.g., 1‑hour access tokens for privileged APIs).
6. Enable the new approver view in My Access to reduce ticket turnaround time for entitlement requests.

---

Resources

• Official release notes – https://learn.microsoft.com/entra/whats-new/2026-05
• Cloud Sync migration guide – https://learn.microsoft.com/entra/cloud-sync/migrate
• SCIM authentication update – https://learn.microsoft.com/entra/scim/authentication-migration
• Prompt‑injection protection troubleshooting article – https://learn.microsoft.com/entra/secure-ai/prompt-injection
• Microsoft Graph $count documentation – https://learn.microsoft.com/graph/query-parameters#count
• Entra ID Governance guest usage workbook – available in the Entra admin center under Identity Governance → Workbooks.

---

Prepared by a Microsoft Entra consulting specialist, this briefing is intended for security architects, identity engineers, and IT decision‑makers evaluating the impact of the May 2026 updates on their multi‑cloud strategy.