Loading story…
Microsoft is making passkeys the default authentication experience for Microsoft Entra ID public-cloud users beginning September 1, 2026 and will retire Microsoft-provided SMS and voice authentication. SMS first-factor sign-in and native Microsoft SMS/voice capabilities for workforce tenants will end on February 1, 2027; Global Administrators and external users have until July 1, 2027. SMS first-factor authentication has already been retired for Entra ID Free tenants.
Organizations must migrate affected users to phishing-resistant authentication to avoid sign-in disruptions. Users relying only on Microsoft-provided SMS or voice will have to register a passkey before they can sign in after the applicable deadline, with no opt-out from enforcement; a temporary opt-out only defers the initial passkey-default rollout until February 1, 2027. Microsoft also supports QR-code authentication, FIDO2 security keys, and other Entra methods, while organizations needing SMS or voice must use a supported customer-managed telecom provider through the Microsoft Security Store.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft began rolling out passkeys as the default Entra ID public-cloud authentication experience. Users enabled for SMS or voice authentication are automatically enabled for passkeys and prompted to register one during a subsequent MFA sign-in.
Microsoft retired SMS first-factor sign-in for Microsoft Entra ID Free tenants. The company also no longer enables SMS sign-in for newly created Entra ID tenants.
Microsoft announced that passkeys would become the default authentication experience for Microsoft Entra ID in the public cloud, replacing reliance on phishable authentication methods.
Microsoft plans to block SignInNoPassword SMS first-factor authentication across Microsoft Entra ID workforce tenants worldwide, including US Government Community Cloud tenants. The change will remove related configuration controls and does not apply to Azure AD B2C or Entra External ID customer identity scenarios.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026
Microsoft has warned administrators to stop using SMS- and voice-based authentication in **Microsoft Entra ID**, saying the methods are too vulnerable to phishing, SIM-swapping, replay attacks, and increasingly effective AI-assisted social engineering. The company will begin prompting Entra users who still rely on phone-based verification to register a **passkey** starting September 1, with Microsoft positioning passkeys and **Microsoft Authenticator** as phishing-resistant, passwordless alternatives. Microsoft plans to permanently disable SMS and voice verification for all Entra ID accounts on February 1, 2027, with no tenant opt-out reported. The company is also moving to phase out text-based verification and account recovery for personal Microsoft accounts, though it has not announced a final consumer cutoff date. The shift is expected to force organizations to update onboarding and recovery processes, support users on older devices, and reduce the risk of account compromise tied to phone-based authentication.
Aug 15, 2026
Microsoft said it is phasing out SMS-based authentication and account recovery for personal Microsoft accounts, citing fraud, phishing, SIM-swapping, and delivery delays as key reasons for the change. Updated support guidance says users will be moved toward passwordless sign-in with **passkeys** and **verified secondary email addresses**, reflecting a broader industry retreat from SMS as a security control. The company has begun rolling out a redesigned sign-in experience that encourages users to choose a **"sign in faster"** option and create a passkey backed by device biometrics or a PIN. Microsoft said passkeys can be stored on devices, in password managers, or through Windows Hello-compatible hardware across Windows 11, Android, iOS, and macOS, but it has not given a final cutoff date for SMS, meaning users who still rely on texted codes will need to set up a passkey or verified backup email before the transition is completed.
Jun 29, 2026