Loading story…
Microsoft has warned administrators to stop using SMS- and voice-based authentication in Microsoft Entra ID, saying the methods are too vulnerable to phishing, SIM-swapping, replay attacks, and increasingly effective AI-assisted social engineering. The company will begin prompting Entra users who still rely on phone-based verification to register a passkey starting September 1, with Microsoft positioning passkeys and Microsoft Authenticator as phishing-resistant, passwordless alternatives.
Microsoft plans to permanently disable SMS and voice verification for all Entra ID accounts on February 1, 2027, with no tenant opt-out reported. The company is also moving to phase out text-based verification and account recovery for personal Microsoft accounts, though it has not announced a final consumer cutoff date. The shift is expected to force organizations to update onboarding and recovery processes, support users on older devices, and reduce the risk of account compromise tied to phone-based authentication.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft said it will permanently disable SMS and voice verification for all Entra ID accounts on February 1, 2027. After that, affected users will need to use stronger authentication methods such as passkeys.
Starting September 1, Microsoft said Entra users who still rely on SMS or voice authentication will be prompted during sign-in to register a passkey. The move is part of Microsoft's push toward phishing-resistant authentication.
Microsoft notified Microsoft Entra ID tenants of an authentication security change, warning administrators that SMS- and voice-based authentication are too vulnerable to phishing, SIM-swapping, replay attacks, and AI-assisted social engineering. The notice said there would be no opt-out for tenants.
Microsoft published support documentation stating that it has begun phasing out SMS-based authentication and account recovery for personal Microsoft accounts, describing SMS as a leading source of fraud. No final consumer cutoff date was announced.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026
Microsoft said it is phasing out SMS-based authentication and account recovery for personal Microsoft accounts, citing fraud, phishing, SIM-swapping, and delivery delays as key reasons for the change. Updated support guidance says users will be moved toward passwordless sign-in with **passkeys** and **verified secondary email addresses**, reflecting a broader industry retreat from SMS as a security control. The company has begun rolling out a redesigned sign-in experience that encourages users to choose a **"sign in faster"** option and create a passkey backed by device biometrics or a PIN. Microsoft said passkeys can be stored on devices, in password managers, or through Windows Hello-compatible hardware across Windows 11, Android, iOS, and macOS, but it has not given a final cutoff date for SMS, meaning users who still rely on texted codes will need to set up a passkey or verified backup email before the transition is completed.
Jun 29, 2026
Microsoft has made **external multi-factor authentication (MFA)** generally available in **Microsoft Entra ID**, allowing organizations to integrate trusted third-party MFA providers directly into the identity platform while keeping **Conditional Access**, real-time risk evaluation, and session controls enforced centrally in Entra ID. The feature is built on **OpenID Connect (OIDC)** and lets administrators manage both native and external MFA methods through Entra ID’s authentication methods policy, including assigning them to specific user groups. Microsoft said the capability is aimed at enterprises with regulatory, business, or merger-related requirements that need a consistent MFA approach across fragmented environments. The company also said the new framework will replace Entra ID **Custom Controls**, which are scheduled for deprecation on **September 30, 2026**; existing configurations will continue to work during a migration period, and Microsoft plans to publish migration guidance before retirement. Microsoft warned that sign-in frequency and session settings should be tuned carefully, noting that excessive reauthentication can increase phishing risk.
Jun 29, 2026