CuraSec

Plan archived

Microsoft Entra ID makes passkeys the default auth method

2026-07-14 12:08 UTC · Microsoft Security Blog · read the source ↗ #identity#passkeys#entra-id
  • Engineer — Plan: This is a breaking change to default authentication behavior in Entra ID — audit your tenant’s authentication policy, test passkey rollout for user flows, and review the updated SMS/voice auth model before it affects production sign-ins.
  • SOC/IR — Learn: Passkey adoption changes the phishing-resistant auth landscape and may affect credential-based attack detections; no immediate hunt or detection work required, but worth understanding how login telemetry shifts.
  • Leader — Plan: A platform-level auth default change from a major identity provider warrants a quarter-horizon review of helpdesk readiness, user communication plans, and any compliance attestations tied to MFA method specifics.
This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.