Loading story…
Microsoft identity-related security enforcement is changing across both on-prem AD and cloud Entra environments, with potential authentication and access-control impacts if organizations have legacy configurations. In Windows Server 2025, LDAP signing is enabled by default on domain controllers via a new policy setting (LDAP server signing requirements Enforcement), while LDAP channel binding default behavior is unchanged; organizations are advised to audit before enforcing to avoid breaking LDAP-dependent applications and integrations.
Separately, Microsoft Entra will change Conditional Access enforcement starting March 27, 2026 (phased through June 2026) for sign-ins via client apps requesting only OIDC scopes or a limited set of directory scopes when Conditional Access targets All resources and includes resource exclusions. After the change, Conditional Access will be enforced at sign-in even when exclusions exist, which may newly trigger controls such as MFA or device compliance for affected tenants; tenants without “All resources” policies that include exclusions are not impacted.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The phased rollout window for the Entra Conditional Access enforcement change is scheduled to run through June 2026, marking the expected completion period for the update across affected tenants.
Microsoft said the Conditional Access enforcement change in Entra will begin rolling out on March 27, 2026, and continue in phases through June 2026. Only tenants with policies targeting all resources and one or more resource exclusions are affected.
Microsoft announced that Conditional Access policies targeting 'All resources' with resource exclusions will be enforced at sign-in for certain client applications requesting only OIDC or limited directory scopes. The change can trigger new controls such as MFA or device compliance checks for affected tenants.
With Windows Server 2025 domain controllers, Microsoft introduced the 'LDAP server signing requirements Enforcement' policy so that leaving it 'Not Configured' results in 'Require Signing,' effectively enabling LDAP signing by default. LDAP channel binding defaults were not changed and remain disabled unless explicitly configured.
Microsoft's August 8, 2023 update KB4520412 for Windows Server 2019 and 2022 domain controllers added additional telemetry for LDAP channel binding failures, improving visibility into non-compliant LDAPS clients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has made **external multi-factor authentication (MFA)** generally available in **Microsoft Entra ID**, allowing organizations to integrate trusted third-party MFA providers directly into the identity platform while keeping **Conditional Access**, real-time risk evaluation, and session controls enforced centrally in Entra ID. The feature is built on **OpenID Connect (OIDC)** and lets administrators manage both native and external MFA methods through Entra ID’s authentication methods policy, including assigning them to specific user groups. Microsoft said the capability is aimed at enterprises with regulatory, business, or merger-related requirements that need a consistent MFA approach across fragmented environments. The company also said the new framework will replace Entra ID **Custom Controls**, which are scheduled for deprecation on **September 30, 2026**; existing configurations will continue to work during a migration period, and Microsoft plans to publish migration guidance before retirement. Microsoft warned that sign-in frequency and session settings should be tuned carefully, noting that excessive reauthentication can increase phishing risk.
Jun 29, 2026
Researchers disclosed two separate Microsoft Entra Conditional Access bypasses that could let attackers obtain **Microsoft Graph** access without the intended controls, including MFA in some cases. NetSPI reported that **Nested App Authentication (NAA)**, also called **BroCI**, allowed certain brokered application flows to exchange an Azure Portal refresh token for Graph access tokens without Conditional Access enforcement. The issue affected specific clients, including `ADIbizaUX` and two Microsoft Intune portal extension clients, and was primarily useful as a persistence mechanism after an attacker had already stolen an Azure Portal refresh token through methods such as phishing or adversary-in-the-middle collection. Microsoft classified that issue as medium severity and deployed a fix; post-patch testing returned `AADSTS53003` access-blocked errors for the previously successful exchanges. A separate disclosure showed that Entra policies configured for **all resources** but with at least one excluded resource could also be bypassed to obtain Graph tokens without the expected Conditional Access checks. The researcher said the gap was broader than Microsoft had publicly documented and warned that some Microsoft first-party applications appeared able to reach Entra ID data through Graph beyond the scopes visible in issued tokens, enabling tenant enumeration and potentially modification where user privileges allowed it. Microsoft later acknowledged the problem and began rolling out **baseline scope enforcement** changes, with enforcement starting June 15 and an early opt-in option available through the Entra Admin Center; according to the researcher, enabling that enforcement closes the Graph token bypass and restores proper Conditional Access evaluation.
Jul 12, 2026
Microsoft announced that **Microsoft Entra ID** will, starting in March 2026, automatically enable *passkey profiles* and add **synced passkeys** support as the capability moves into **general availability**. The update introduces a new `passkeyType` property to control whether users can register **device-bound passkeys**, **synced passkeys**, or both, and adds a new admin experience that supports **group-based configuration** rather than tenant-wide-only settings. Microsoft plans a staged rollout with an opt-in window; tenants that do not opt in will be migrated later, with existing FIDO2/passkey authentication method settings moved into a default passkey profile and `passkeyType` set based on current attestation configuration. Separately, Microsoft is preparing a **Microsoft Teams** feature (Microsoft 365 Roadmap **ID 488800**) that can automatically set and display a user’s **work location** based on the **organizational Wi‑Fi network (SSID)** they connect to, mapping recognized network identifiers to building/location data configured by tenant administrators. The feature is described as **off by default** and requires admin enablement, with rollout now targeted for March 2026 after prior delays; it is positioned as a hybrid-work coordination improvement but raises potential **privacy/employee monitoring** concerns due to automated location inference.
Jun 29, 2026