💡 Our Technical Review in summary
Summary
- Microsoft is transitioning Microsoft Entra ID device registration for Android to a hardware-bound model to enhance security.
- As a result of this security hardening, the manual “Enable Browser Access” (EBA) feature found in the Microsoft Authenticator and Microsoft Company Portal apps for Android is being retired.
- Once the update is implemented, browser access will be automatically enabled by default during the device registration process, removing the need for manual user intervention.
Impact
- User Experience: Android users will no longer need to navigate through app settings to manually toggle “Enable Browser Access.” This simplifies the onboarding process for browser-based corporate applications.
- Device Identity: Device identities will become hardware-bound, providing a more robust security posture against identity spoofing or credential theft.
- Management: This change is global and will be applied automatically to all Android devices registering with Microsoft Entra ID.
- Timeline: While previously scheduled, the rollout timeline is currently being updated. Organizations should monitor the Message Center for the new General Availability dates.
Action Required
- No Technical Action: There are no administrative configurations or backend changes required to enable this feature; the transition happens automatically.
- Update Documentation: IT Admins should update internal “Bring Your Own Device” (BYOD) or enrollment guides. Instructions that previously directed users to manually enable browser access in the Authenticator or Company Portal apps should be removed.
- Help Desk Awareness: Notify support staff that the “Enable Browser Access” toggle will eventually disappear from the Android apps and that this functionality is now inherent to the registration process.
- Ignore if Applicable: If your organization does not support or allow Android devices for corporate access, no action is necessary.
Microsoft Official Update
Service: N/A
Category: planForChange
Severity: normal
Updated July 24, 2025: We have updated the timeline. Thank you for your patience.
If your organization does not support Android devices, you can safely ignore this message.
As part of our overall security hardening efforts, we will migrate Microsoft Entra ID device registration to be hardware-bound. Since the device identity will be hardware-bound, we will retire the ability for users to enable a feature called Enable Browser Access (EBA) in the Microsoft Authenticator app and the Microsoft Company Portal app for Android. After this retirement, browser access will automatically be enabled as part of device registration.
[When this will happen:]
General Availability (Worldwide): We will communicate via Message center when we are ready to proceed.
[What you need to do to prepare:]
No action or preparation is required from admins or users regarding this change. The change will occur automatically.
The Enable Browser Access feature will retire from the Company Portal and Authenticator apps for Android:
This change was first announced in What’s new in Microsoft Entra – September 2024 | Microsoft Community Hub (September 2024).
This rollout will happen automatically by the specified date with no admin action required before the rollout. Review your current configuration to determine the impact for your organization. You may want to notify your users about this change and update any relevant documentation.
