Loading story…
Microsoft announced that Microsoft Entra ID will, starting in March 2026, automatically enable passkey profiles and add synced passkeys support as the capability moves into general availability. The update introduces a new passkeyType property to control whether users can register device-bound passkeys, synced passkeys, or both, and adds a new admin experience that supports group-based configuration rather than tenant-wide-only settings. Microsoft plans a staged rollout with an opt-in window; tenants that do not opt in will be migrated later, with existing FIDO2/passkey authentication method settings moved into a default passkey profile and passkeyType set based on current attestation configuration.
Separately, Microsoft is preparing a Microsoft Teams feature (Microsoft 365 Roadmap ID 488800) that can automatically set and display a user’s work location based on the organizational Wi‑Fi network (SSID) they connect to, mapping recognized network identifiers to building/location data configured by tenant administrators. The feature is described as off by default and requires admin enablement, with rollout now targeted for March 2026 after prior delays; it is positioned as a hybrid-work coordination improvement but raises potential privacy/employee monitoring concerns due to automated location inference.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft said that starting in March 2026, Entra ID will automatically enable passkey profiles and add general availability support for synced passkeys. The change includes a new group-based passkey profile experience and a passkeyType setting to control device-bound, synced, or both passkey types.
Microsoft disclosed that Teams will be able to automatically update a user's work location, such as a building, by matching connected corporate Wi‑Fi SSIDs to administrator-defined location mappings. Microsoft said the feature will only operate during defined working hours and will clear the location status at the end of the workday.
Microsoft's Microsoft 365 Roadmap entry 488800 for a Teams feature that auto-detects and displays a user's work location based on organizational Wi‑Fi was postponed from January 2026 to February 2026 and then to March 2026. The feature is described as off by default, requiring tenant admin enablement and end-user opt-in.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has started rolling out **Workplace Check-in** for Microsoft Teams, a Microsoft 365 feature that can mark employees as present in a specific office building by using corporate Wi-Fi data and, on some devices, location permissions. The capability is tied to organizations using **Microsoft Places**, remains **disabled by default** at the tenant level, and must first be enabled by enterprise administrators before users are prompted to participate. Microsoft says the feature is optional and designed as an office-presence signal rather than continuous location tracking, noting it is not meant to follow employees between floors or buildings throughout the day. Even so, the rollout has renewed privacy concerns because administrators can configure prompts that encourage location sharing and employers could use the resulting attendance data to monitor return-to-office compliance; deployment may also be gradual because organizations must configure details such as office locations and Wi-Fi `BSSID` mappings.
Jun 29, 2026
Microsoft is rolling out **passkey support for Microsoft Entra on Windows devices**, enabling *phishing-resistant*, passwordless sign-in using **Windows Hello** (face, fingerprint, or PIN). The capability is **opt-in** and is scheduled to enter **public preview from mid-March through late April 2026** for worldwide tenants, with **government cloud environments** (GCC, GCC High, DoD) following in a later window. A key security impact is that Entra passkeys extend passwordless authentication to **unmanaged Windows devices** (e.g., personal/shared endpoints) that previously often fell back to passwords. Microsoft states the passkeys are **device-bound** and stored in the Windows Hello container; they are **cryptographically bound to the device** and **not transmitted over the network**, reducing exposure to credential phishing and certain malware-based theft scenarios used to bypass MFA. Each Entra account registers its own passkey per device (multiple accounts can coexist on one machine), but passkeys **do not sync across devices**, requiring separate registration per device. For preview enrollment, administrators must enable the **Passkeys (FIDO2)** authentication method in Entra Authentication Methods policies, create a passkey profile with the required Windows Hello **AAGUIDs**, and assign it to the appropriate groups.
Jun 29, 2026
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026