Microsoft will retire Entra ID SMS and voice sign-in in February 2027
Worldwide and GCC tenants must move telephone-only users to passkeys or another provider before February 1, 2027.
46
Product
Microsoft Entra ID
- Mentions · 7d2
- Mentions · 30d22
- All mentions39
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
39 articles · newest firstMicrosoft tells Entra ID admins to leave SMS and voice before 2027
Microsoft-provided SMS and voice MFA end February 1, 2027 for workforce tenants, not Azure AD B2C or Entra External ID.
46
Stolen Microsoft 365 sessions replayed at 79 organizations
Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.
76
ARTEX-using actor expands targeting of IT and software vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
76
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
74
ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
78
Stolen ConnectWise app credentials used against Microsoft 365 tenants
Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.
78
ConnectWise disables cloud apps after Microsoft 365 tenant access
Seven application identities were disabled October 17; Huntress says a later wave against 16 tenants failed.
80
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
82
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
85
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress says abused ConnectWise Cloud Backup credentials accessed at least 162 Microsoft 365 tenants.
84
Employees using personal ChatGPT at work? Here's what IT admins need to do
NordLayer pitches AI Scout to block employees from pasting sensitive data into personal ChatGPT accounts.
18
AI Used in 84% of Ransomware Attacks as Identity Infrastructure Comes Under Fire.
Semperis survey of 1,200 ransomware victims finds AI in 84% of incidents and identity systems widely targeted.
64
11 Best Cloud Directory Services Compared (2026): Features & Pricing
A 2026 buyer's guide ranks Microsoft Entra ID the top cloud directory, ahead of JumpCloud and Okta Universal Directory.
16
Cybersecurity jobs available right now: October 6, 2026
Help Net Security lists October 6 cybersecurity job openings at NSA, Synopsys, BMO, and other employers.
18
Session Cookie Vulnerability Lets Attackers Bypass Entra ID MFA and Impersonate Users
Resecurity found a yard-management app’s forged session cookies bypassed Entra ID MFA and impersonated users.
52
Authentication Bypass Successfully Impersonated 95 Users Without Passwords or MFA
Testers forged session cookies on a yard-management app and impersonated 95 users without passwords or MFA.
50
12 Best SSO Solutions Compared (2026): Features & Pricing
A 2026 comparison ranks 12 SSO platforms, favoring Microsoft Entra ID for Microsoft 365 and Okta for mixed SaaS.
22
Windows 11 26H2 Enables Settings Backup by Default for Eligible Devices
Windows 11 26H2 enables settings backup by default on eligible unconfigured Entra-joined commercial devices.
36
12 Best IAM Solutions Compared (2026): Features & Pricing
A 2026 buyer's guide ranks 12 IAM products, favoring Entra ID and Okta for workforce identity.
18
China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks
China-linked TA419 used AiTM phishing to steal Microsoft 365 sessions from U.S. AI policy experts.
74
Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts
China-linked TA419 impersonated an Anthropic employee to phish US AI policy experts for Microsoft 365 sessions.
76
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
Proofpoint says UNK_CondorFiltration password-sprayed 5,700 Microsoft 365 accounts and breached seven MFA-less service accounts in Chile.
74
One Bad Prompt Took Down a Company’s Salesforce: RSA’s Jim Taylor on Agent ID and Taming the 4,000 Shadow AI Agents Hiding in Your Enterprise
RSA launched Agent ID to discover, secure, and govern enterprise AI agents after finding thousands of shadow agents.
62
Top 10 Best Cloud Directory Services in 2026 [Ranked & Scored]
A 2026 ranking puts Microsoft Entra ID first among cloud directories, ahead of JumpCloud and Okta.
18
Microsoft Password Reset Portal Could Reveal Users and MFA Protection Details
Microsoft Entra ID’s public password-reset portal can reveal valid accounts and registered MFA methods to unauthenticated users.
62
SentinelOne extends Wayfinder coverage across endpoints, identities, and cloud workloads
SentinelOne extended Wayfinder threat hunting to AWS, Azure, and Google Cloud control planes.
37
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
The Phishing Kit That Turned Microsoft’s Login Flow Into an AI-Powered Fraud Machine
EvilTokens PhaaS kit uses AI and device-code phishing to bypass MFA, compromising 12,000+ corporate inboxes for payment fraud.
80
Microsoft Entra ID to Block SMS First-Factor Sign-Ins Worldwide in February 2027
Microsoft will block SMS first-factor sign-in for Entra ID workforce tenants worldwide on February 1, 2027.
46
Microsoft reminds admins to migrate Entra ID users to passkeys
Microsoft reminds admins to migrate Entra ID users to passkeys before SMS first-factor sign-in is retired in February 2027.
35
Top 10 Best Single Sign-On (SSO) Solutions in 2026
Editorial buyer's guide ranks ten 2026 SSO solutions, naming Entra ID the bundled default and Okta the neutral catalog leader.
12
GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
73
Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.
80
Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
52
Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.
66
AWS limits AI agents’ data access, even when manipulated
AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.
48
How to Spot and Stop Rogue Device Joins
Wiz details how adversaries use realistic device names in Entra ID registrations to evade detection and which behavioral signals still expose them.
48
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing
Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.
65
Related CVEs
by mentions- CVE-2026-688209%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2026-83997<1%8.1Use-After-Free RCE in Windows Message Queuing (MSMQ)
- CVE-2026-84000<1%7.8Heap Buffer Overflow in Microsoft Graphics Component Enables Local Code Execution
- CVE-2026-83979<1%7.8Use-After-Free Privilege Escalation in Windows Biometric Service
- CVE-2026-83978<1%7.8Local Privilege Elevation via Heap Buffer Overflow in Windows Biometric Service
- CVE-2026-83986<1%7.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally
- CVE-2026-83985<1%7.8Heap Buffer Overflow in Windows Biometric Service Enables Local Privilege Escalation
- CVE-2026-84001<1%7.5Out-of-bounds Read in Windows Kerberos KDC Enables Network Denial of Service
- CVE-2026-85360<1%7.0Use-After-Free Local Privilege Escalation in Windows Kernel (CVE-2026-85360)
- CVE-2026-34348<1%6.5Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network
Appears with
- Microsoftvendor · 37
- Microsoft 365product · 14
- Oktavendor · 10
- Microsoftorganization · 9
- Huntressorganization · 8
- Oktaproduct · 7
- ConnectWisevendor · 6
- Ping Identityvendor · 5
- Googlevendor · 5
- OneLoginvendor · 5
- JumpCloudproduct · 4
- ConnectWise Cloud Backupproduct · 4
- JumpCloudvendor · 4
- Azure AD B2Cproduct · 3
- Proofpointorganization · 3
- WSO2vendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.