Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant authentication methods, such as passkeys, ahead of the planned retirement of SMS first-factor sign-in starting in February 2027. Organizations still relying on SMS-based two-factor authentication will face sign-in disruptions once the retirement takes effect.

Which products are affected?

Entra ID (formerly Azure Active Directory)

What should defenders do?

Administrators should begin migrating Entra ID users to phishing-resistant authentication methods immediately. Recommended actions include enrolling users in passkey solutions, distributing FIDO2 security keys, and configuring conditional access policies to require passwordless or MFA methods. Organizations should test the new authentication methods with a pilot group prior to the February 2027 retirement date. Microsoft Entra admin center provides guidance for transitioning away from SMS-based sign-in.

highPhishing

Microsoft Announces Retirement of SMS-Based First-Factor Sign-in for Entra ID

Admins urged to migrate to phishing-resistant methods like passkeys before February 2027

CyberIntel DeskPublished 9 days agoUpdated less than a minute ago1 min read

Microsoft Announces Retirement of SMS-Based First-Factor Sign-in for Entra ID

Key Takeaways

Microsoft will retire SMS first-factor sign-in for Entra ID starting in February 2027.
Administrators must migrate users to phishing-resistant methods such as passkeys or FIDO2 security keys.
Organizations relying on SMS-based 2FA will face sign-in disruptions if migration is not completed.
No patch is available; this is a policy retirement requiring administrative action.

Related Security News

highMalware

NeedyMantis Malware Used for Long-Term Persistence in Targeted Intrusions

Microsoft has identified a malware family named NeedyMantis being used by threat actors to maintain long-term, unauthorized access to already-breached networks. The malware has been observed in targeted intrusions across a range of sectors, including telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activity has been tracked since at least 2023 and remains ongoing.

The Hacker News1 day ago1 min read