Loading story…
Microsoft announced a major authentication overhaul for Microsoft Entra ID in the public cloud, making passkeys the default sign-in experience starting September 1, 2026 and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets.
Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the Microsoft Security Store. Administrator configuration for supported providers is scheduled to begin on October 30, 2026, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin February 1, 2027. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft announced that passkeys will become the default authentication experience for Microsoft Entra ID in the public cloud. The change also includes retirement of Microsoft's native SMS and voice-based MFA delivery in favor of phishing-resistant authentication.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcereddit.com
Open sourcehelpnetsecurity.com
Open sourcemicrosoft.com
Open sourcereddit.com
Open sourcelearn.microsoft.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said it is phasing out SMS-based authentication and account recovery for personal Microsoft accounts, citing fraud, phishing, SIM-swapping, and delivery delays as key reasons for the change. Updated support guidance says users will be moved toward passwordless sign-in with **passkeys** and **verified secondary email addresses**, reflecting a broader industry retreat from SMS as a security control. The company has begun rolling out a redesigned sign-in experience that encourages users to choose a **"sign in faster"** option and create a passkey backed by device biometrics or a PIN. Microsoft said passkeys can be stored on devices, in password managers, or through Windows Hello-compatible hardware across Windows 11, Android, iOS, and macOS, but it has not given a final cutoff date for SMS, meaning users who still rely on texted codes will need to set up a passkey or verified backup email before the transition is completed.
Jun 29, 2026
Microsoft is rolling out **passkey support for Microsoft Entra on Windows devices**, enabling *phishing-resistant*, passwordless sign-in using **Windows Hello** (face, fingerprint, or PIN). The capability is **opt-in** and is scheduled to enter **public preview from mid-March through late April 2026** for worldwide tenants, with **government cloud environments** (GCC, GCC High, DoD) following in a later window. A key security impact is that Entra passkeys extend passwordless authentication to **unmanaged Windows devices** (e.g., personal/shared endpoints) that previously often fell back to passwords. Microsoft states the passkeys are **device-bound** and stored in the Windows Hello container; they are **cryptographically bound to the device** and **not transmitted over the network**, reducing exposure to credential phishing and certain malware-based theft scenarios used to bypass MFA. Each Entra account registers its own passkey per device (multiple accounts can coexist on one machine), but passkeys **do not sync across devices**, requiring separate registration per device. For preview enrollment, administrators must enable the **Passkeys (FIDO2)** authentication method in Entra Authentication Methods policies, create a passkey profile with the required Windows Hello **AAGUIDs**, and assign it to the appropriate groups.
Jun 29, 2026
Microsoft has begun rolling out support for syncing passkeys across Windows devices and its Edge browser, addressing a key barrier to widespread adoption of passwordless authentication. This phased rollout starts with Edge on Windows 10 and 11, with plans to expand to iOS, Android, and MacOS, aiming to make passkey management seamless for users and organizations. The move is expected to accelerate the shift away from traditional passwords, leveraging the FIDO Alliance's non-phishable passkey standard to enhance security and usability across platforms. Industry experts highlight that passwordless authentication is not just a technological upgrade but a critical component in modern fraud prevention strategies. As organizations transition to passkeys and device-based authentication, they face challenges such as cross-device access and user education. Integrating behavioral analytics with passwordless systems is seen as essential for detecting sophisticated fraud attempts, including those involving AI-driven identity spoofing and deepfakes, ensuring both external and internal threats are mitigated effectively.
Jul 12, 2026