Loading story…
Microsoft is enforcing mandatory multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center, with the policy taking full effect on February 9, 2026. This move follows a phased rollout that began in February 2025 and targets key administrative portals, including portal.office.com/adminportal/home, admin.cloud.microsoft, and admin.microsoft.com. Administrators without MFA enabled will be blocked from signing in, and Microsoft urges organizations to act immediately to avoid disruptions to IT operations and administrative functions. The enforcement is part of Microsoft's broader strategy to combat credential-based attacks, which remain a leading cause of security breaches.
By requiring MFA, Microsoft aims to significantly reduce the risk of account compromise, prevent unauthorized access, and safeguard sensitive data managed through the admin center. The company highlights that MFA is a critical defense against phishing, credential stuffing, brute-force attacks, and password reuse. Administrators are advised to use the MFA Wizard or official documentation to configure organization-wide MFA, while individual users can verify or add authentication methods through the designated setup portal. This policy aligns with Microsoft's ongoing efforts to strengthen identity security, including previous enforcement of MFA for Azure Portal sign-ins across all tenants.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Full enforcement is set to begin on this date, making MFA mandatory for Microsoft 365 admin center access across key administrative URLs. Users and administrators without MFA configured will be unable to sign in.
Microsoft announced that starting February 9, 2026, all users accessing the Microsoft 365 admin center will be required to use MFA and non-MFA sign-ins will be blocked. The company warned organizations to enable MFA before the deadline to avoid administrative lockouts and service disruptions.
Microsoft scheduled broader MFA enforcement for Azure CLI, PowerShell, SDKs, and APIs, extending mandatory stronger authentication beyond web portals. This expanded the company's MFA requirements across administrative and programmatic access paths.
Microsoft began enforcing MFA for Azure Portal access as part of its broader effort to require stronger authentication for administrative and cloud management interfaces. The change was cited as part of the company's wider MFA enforcement program.
Microsoft started a phased rollout of multi-factor authentication requirements for users accessing the Microsoft 365 admin center. This marked the beginning of the transition away from password-only sign-ins for administrative access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has made **external multi-factor authentication (MFA)** generally available in **Microsoft Entra ID**, allowing organizations to integrate trusted third-party MFA providers directly into the identity platform while keeping **Conditional Access**, real-time risk evaluation, and session controls enforced centrally in Entra ID. The feature is built on **OpenID Connect (OIDC)** and lets administrators manage both native and external MFA methods through Entra ID’s authentication methods policy, including assigning them to specific user groups. Microsoft said the capability is aimed at enterprises with regulatory, business, or merger-related requirements that need a consistent MFA approach across fragmented environments. The company also said the new framework will replace Entra ID **Custom Controls**, which are scheduled for deprecation on **September 30, 2026**; existing configurations will continue to work during a migration period, and Microsoft plans to publish migration guidance before retirement. Microsoft warned that sign-in frequency and session settings should be tuned carefully, noting that excessive reauthentication can increase phishing risk.
Jun 29, 2026
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026
Three phishing-as-a-service platforms—**Sneaky 2FA**, **EvilTokens**, and **EvilProxy**—are targeting U.S. organizations to steal Microsoft 365 credentials and authenticated access by capturing session cookies or OAuth tokens after users complete legitimate sign-ins. The kits use different methods, including adversary-in-the-middle session hijacking, abuse of Microsoft’s OAuth 2.0 device authorization flow, and reverse-proxy credential relay, allowing attackers to gain access without breaking MFA cryptographically. Researchers said **EvilTokens**, which emerged in 2026, has already been linked to compromises at more than **340 Microsoft 365 organizations** across at least seven countries, while **EvilProxy** has been used in campaigns against executives and managers at more than **100 organizations**. The campaigns show that standard MFA does not stop phishing when attackers steal the resulting authenticated session artifact instead of the password alone. **Sneaky 2FA** reportedly uses CAPTCHA gates, IP filtering, and cloned Microsoft login pages to evade detection, while the broader activity has created detection opportunities around impossible device-shift patterns, anomalous token use, and suspicious device-code prompts. Defenders are being urged to deploy **phishing-resistant MFA** such as **FIDO2/WebAuthn**, restrict or disable unnecessary device-code authentication in **Entra ID**, and closely monitor Microsoft 365 environments for unexpected MFA prompts and token abuse.
Aug 5, 2026