Microsoft reminds admins to migrate Entra ID users to passkeys
Microsoft has issued a reminder for administrators to migrate Entra ID users to phishing-resistant authentication methods, such as passkeys, ahead of the planned retirement of SMS-based first-factor sign-in in February 2027. This change aims to improve security by reducing reliance on less secure SMS authentication.
AI Analysis
Technical Summary
Microsoft plans to retire SMS first-factor sign-in for Entra ID users starting February 2027. Administrators are advised to migrate users to phishing-resistant authentication methods, including passkeys, to prevent sign-in disruptions. This is a proactive security measure to enhance authentication security by eliminating the less secure SMS-based sign-in option.
Potential Impact
If administrators do not migrate users to phishing-resistant authentication methods before the retirement date, users may experience sign-in disruptions. The change improves overall security posture by removing SMS-based authentication, which is vulnerable to interception and phishing attacks.
Mitigation Recommendations
Administrators should begin migrating Entra ID users to phishing-resistant authentication methods such as passkeys well before February 2027 to avoid sign-in disruptions. This is a planned change by Microsoft, not a vulnerability requiring emergency patching.
Microsoft reminds admins to migrate Entra ID users to passkeys
Description
Microsoft has issued a reminder for administrators to migrate Entra ID users to phishing-resistant authentication methods, such as passkeys, ahead of the planned retirement of SMS-based first-factor sign-in in February 2027. This change aims to improve security by reducing reliance on less secure SMS authentication.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Microsoft plans to retire SMS first-factor sign-in for Entra ID users starting February 2027. Administrators are advised to migrate users to phishing-resistant authentication methods, including passkeys, to prevent sign-in disruptions. This is a proactive security measure to enhance authentication security by eliminating the less secure SMS-based sign-in option.
Potential Impact
If administrators do not migrate users to phishing-resistant authentication methods before the retirement date, users may experience sign-in disruptions. The change improves overall security posture by removing SMS-based authentication, which is vulnerable to interception and phishing attacks.
Defensive Guidance
Administrators should begin migrating Entra ID users to phishing-resistant authentication methods such as passkeys well before February 2027 to avoid sign-in disruptions. This is a planned change by Microsoft, not a vulnerability requiring emergency patching.
Technical Details
- Classification
- {"confidence":0.7,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-admins-to-migrate-entra-id-users-to-passkeys/","fetched":true,"fetchedAt":"2026-09-21T13:16:38.878Z","wordCount":686}
Threat ID: 6ab12e3655bf5e2cf5f22dcb
Added to database: 09/21/2026, 13:16:38 UTC
Last enriched: 09/21/2026, 13:16:43 UTC
Last updated: 09/21/2026, 19:46:48 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.