Loading story…
Microsoft has made external multi-factor authentication (MFA) generally available in Microsoft Entra ID, allowing organizations to integrate trusted third-party MFA providers directly into the identity platform while keeping Conditional Access, real-time risk evaluation, and session controls enforced centrally in Entra ID. The feature is built on OpenID Connect (OIDC) and lets administrators manage both native and external MFA methods through Entra ID’s authentication methods policy, including assigning them to specific user groups.
Microsoft said the capability is aimed at enterprises with regulatory, business, or merger-related requirements that need a consistent MFA approach across fragmented environments. The company also said the new framework will replace Entra ID Custom Controls, which are scheduled for deprecation on September 30, 2026; existing configurations will continue to work during a migration period, and Microsoft plans to publish migration guidance before retirement. Microsoft warned that sign-in frequency and session settings should be tuned carefully, noting that excessive reauthentication can increase phishing risk.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft said the older Custom Controls feature in Entra ID will be deprecated as external MFA becomes its replacement. The company set the retirement date for September 30, 2026, and said migration guidance would be published before the feature is retired.
Microsoft announced the general availability of external multi-factor authentication in Microsoft Entra ID, enabling organizations to integrate trusted third-party MFA providers while keeping Conditional Access, risk evaluation, and session controls centralized in Entra ID. The feature is built on OpenID Connect and can be managed through Entra ID authentication methods policies for selected user groups.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is enforcing mandatory multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center, with the policy taking full effect on February 9, 2026. This move follows a phased rollout that began in February 2025 and targets key administrative portals, including `portal.office.com/adminportal/home`, `admin.cloud.microsoft`, and `admin.microsoft.com`. Administrators without MFA enabled will be blocked from signing in, and Microsoft urges organizations to act immediately to avoid disruptions to IT operations and administrative functions. The enforcement is part of Microsoft's broader strategy to combat credential-based attacks, which remain a leading cause of security breaches. By requiring MFA, Microsoft aims to significantly reduce the risk of account compromise, prevent unauthorized access, and safeguard sensitive data managed through the admin center. The company highlights that MFA is a critical defense against phishing, credential stuffing, brute-force attacks, and password reuse. Administrators are advised to use the MFA Wizard or official documentation to configure organization-wide MFA, while individual users can verify or add authentication methods through the designated setup portal. This policy aligns with Microsoft's ongoing efforts to strengthen identity security, including previous enforcement of MFA for Azure Portal sign-ins across all tenants.
Jun 29, 2026
Microsoft is rolling out **passkey support for Microsoft Entra on Windows devices**, enabling *phishing-resistant*, passwordless sign-in using **Windows Hello** (face, fingerprint, or PIN). The capability is **opt-in** and is scheduled to enter **public preview from mid-March through late April 2026** for worldwide tenants, with **government cloud environments** (GCC, GCC High, DoD) following in a later window. A key security impact is that Entra passkeys extend passwordless authentication to **unmanaged Windows devices** (e.g., personal/shared endpoints) that previously often fell back to passwords. Microsoft states the passkeys are **device-bound** and stored in the Windows Hello container; they are **cryptographically bound to the device** and **not transmitted over the network**, reducing exposure to credential phishing and certain malware-based theft scenarios used to bypass MFA. Each Entra account registers its own passkey per device (multiple accounts can coexist on one machine), but passkeys **do not sync across devices**, requiring separate registration per device. For preview enrollment, administrators must enable the **Passkeys (FIDO2)** authentication method in Entra Authentication Methods policies, create a passkey profile with the required Windows Hello **AAGUIDs**, and assign it to the appropriate groups.
Jun 29, 2026
Microsoft identity-related security enforcement is changing across both on-prem AD and cloud Entra environments, with potential authentication and access-control impacts if organizations have legacy configurations. In Windows Server 2025, **LDAP signing** is enabled by default on domain controllers via a new policy setting (`LDAP server signing requirements Enforcement`), while **LDAP channel binding** default behavior is unchanged; organizations are advised to audit before enforcing to avoid breaking LDAP-dependent applications and integrations. Separately, Microsoft Entra will change **Conditional Access** enforcement starting March 27, 2026 (phased through June 2026) for sign-ins via client apps requesting only **OIDC scopes** or a limited set of directory scopes when Conditional Access targets **All resources** and includes **resource exclusions**. After the change, Conditional Access will be enforced at sign-in even when exclusions exist, which may newly trigger controls such as **MFA** or device compliance for affected tenants; tenants without “All resources” policies that include exclusions are not impacted.
Jun 29, 2026