3 articles
If you are tightening up Microsoft Entra ID security, the first wins are usually not exotic: they are the controls that reduce password abuse, shrink admin exposure, and stop legacy sign-in paths from becoming an easy route in. The trick is to turn on the right controls in the right order, without breaking sign-in for the people who keep the business running.
Microsoft will make passkeys the default sign-in method in Entra ID from 1 September 2026 and retire Microsoft-provided SMS and voice delivery on 1 February 2027. The key risk is strand-through: recovery and helpdesk flows that still assume telecom MFA.
Mirage2FA phishing infrastructure shows how criminals can relay a genuine Microsoft 365 sign-in, capture the resulting session and retain access after MFA. Defending against it requires phishing-resistant authentication and stronger session controls.
