Entra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft employee.
- Host
- Merill Fernando
- Publisher
- Independent (entra.news) · Independent
- Pillar
- Workforce Identity
- Level
- Practitioner
- Format
- Interview
- Cadence
- Weekly, 35 to 60 min
- Status
- Active, last episode 2026-09-17
- Since
- 2025
- Episodes
- 78
What it is
Entra.Chat is a weekly podcast from Merill Fernando, published through his entra.news newsletter since March 2025. Each episode pairs an Entra practitioner or Microsoft Entra team member with a specific operational topic: passkey rollouts, dynamic group changes, conditional access, and Active Directory testing with the open-source Maester tool.
Who it suits
Administrators and architects running Microsoft Entra ID or hybrid Active Directory. If your estate is not Microsoft-centred, most episodes will be of limited use.
Editor note
It is the most practical Microsoft identity show available, and it moves fast on change notices and research: the August 2026 episodes on General Motors' 200,000-user passkey rollout and on the Pass-the-Passkey research from Black Hat are both on our passkeys learning path. The trade-off is scope and vantage point. The host works at Microsoft, so expect Microsoft's framing of Microsoft's products.
Where to start
- Shadow Admins: The Non-Human Identities Hiding in Your Entra Tenant2026-06-20 · 69 min · Practitioner · Non-human and AI agent identity
How service principals, app registrations, and agent identities become hidden admins, which API permissions to hunt for, and why to replace secrets with managed identities.
- How General Motors Moved 200,000 People to Passkeys2026-08-31 · 44 min · Practitioner · Passkeys and FIDO
How a large enterprise moved a mixed workforce of office, factory, call center and guest users to passkeys without locking people out.
- Entra & Azure Power-Up: Secure Service Principal Impersonation with Simon Gottschlag2025-05-10 · 38 min · Practitioner · Privileged access management
How a prototype uses Azure Functions, Key Vault, and Entra ABAC so developers can impersonate service principals under four-eyes approval and least privilege.
Also in our learning paths
- Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra Admins2026-08-17 · 36 min · Architect · Passkeys and FIDO
How passkey phishing resistance depends on browser origin binding, and how the Pass-the-Passkey attacks replayed assertions outside the browser.
- One Compromised Agent ID Blueprint Can Cross Tenant Boundaries2026-07-12 · 54 min · Architect · Non-human and AI agent identity
How Entra Agent ID blueprints, agent identities, and agent users relate, and how stolen blueprint credentials could reach agent identities in other tenants.
- Pushing Microsoft Entra to its Limits to Secure On-Prem AD2025-06-20 · 48 min · Architect · Privileged access management
How to design a Bastion Forest PAM setup for on-prem Active Directory using Entra PIM for Groups, group write-back, phish-resistant credentials, and privileged access workstations.
Last verified 2026-09-30 against the show's feed, recent episode notes, and the publisher's own pages. Status and last-episode date update weekly from the feed.
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to [email protected].
Related on Start with Identity
- BlogEntra ID makes passkeys the default, and retires SMS and voice in 2027
From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- GlossaryAdaptive Authentication
Authentication flows that change based on risk signals. Low-risk sign-ins may complete with one factor; high-risk sign-ins escalate to step-up MFA or are blocke
- GlossaryDevice Posture
The state of a device at the time of access: OS patch level, disk encryption status, EDR presence, jailbreak detection, certificate enrollment. Posture is an in
- GlossaryIdentity Resilience
The ability to keep authenticating and authorising legitimate users, and to recover the identity system itself, when the identity provider or directory is degra