authentication

Microsoft Entra ID to Block SMS First-Factor Sign-Ins Worldwide in February 2027

/ , ,

Microsoft will retire SMS-based first-factor sign-in for all Microsoft Entra ID workforce tenants worldwide on February 1, 2027, requiring organizations to migrate users to more secure, phishing-resistant authentication methods such as passkeys, Windows Hello for Business, or FIDO2 security keys. This change aims to eliminate vulnerabilities associated with SMS authentication, including interception and SIM swapping, and avoid disruptions in Microsoft 365 and other Entra-protected services by prompting administrators to update authentication policies and user enrollment processes ahead of the deadline.

https://cybersecuritynews.com/entra-id-sms-sign-in-retirement/

I Don’t Like Passkeys

/ ,

Ethan Hawksley critiques passkeys, highlighting that while they offer strong protection against phishing and server breaches, they pose significant risks for personal users, particularly around account lockout and recovery challenges. He points out limitations in hardware keys, reliance on operating system account syncing, fragmented third-party manager support, and usability issues on non-personal devices. Hawksley concludes that passkeys are better suited for enterprise environments and that current alternatives like password managers combined with TOTP remain more practical for individual users.

https://hawksley.dev/blog/i-dont-like-passkeys

Your Identity Governance Wasn’t Built for AI Agents

/ , , ,

AI agents challenge traditional identity governance frameworks because they do not fit neatly into human or machine identity categories, acting dynamically on behalf of users with shifting permissions. Current governance programs often struggle with visibility, ownership, and managing evolving access risks, making it critical for organizations to inventory non-human identities, enforce least privilege, and implement continuous real-time monitoring beyond periodic reviews. Security strategies must evolve from static identity validation toward adaptive governance that watches agent behavior to prevent unauthorized access as AI agents increasingly proliferate across enterprise systems.

https://www.cio.com/article/4212025/your-identity-governance-wasnt-built-for-ai-agents.html

Microsoft Entra ID Gets Passkeys Default Authentication Starting September

/ ,

Microsoft will make passkeys the default authentication method for its Entra ID enterprise identity service starting September 2026, automatically enabling passkeys for users currently relying on phone-based SMS and voice authentication, which Microsoft plans to retire by February 2027. Organizations are advised to transition to phishing-resistant methods before the retirement deadline to avoid sign-in disruptions, as Microsoft aims to reduce reliance on phishable authentication and improve account security against increasing credential theft and phishing attacks.

https://www.bleepingcomputer.com/news/microsoft/microsoft-entra-id-gets-passkeys-default-authentication-starting-september/

The Death of Identity as We Know It

/ ,

In “The death of identity as we know it,” Steve Tout discusses the evolving challenges of AI governance, emphasizing that identity must shift from traditional authentication toward authorship and lineage of AI entities like agents, swarms, and digital twins. He highlights the necessity of new governance models that track who creates, trains, authorizes, and controls AI-powered digital representations to ensure accountability, protect institutional knowledge, and prevent misuse as AI becomes integral to enterprise decision-making.

https://www.cio.com/article/4170235/the-death-of-identity-as-we-know-it.html

What CISOs Need to Get Right as Identity Enters the Agentic Era

/ , ,

As agentic AI identities rapidly increase, CISOs face new security challenges in managing and securing both human and non-human identities within enterprises. Experts Dustin Wilcox and Michael Adams advise adopting an identity-first security model that emphasizes continuous verification, strong identity hygiene, inventorying non-human identities, and evolving beyond traditional MFA to address expanded attack surfaces and behavioral signal erosion. This shift is critical as identity becomes the primary control plane for security in the AI era, requiring CISOs to rethink frameworks and focus on intent-based access and real-time monitoring.

https://www.cio.com/article/4164014/what-cisos-need-to-get-right-as-identity-enters-the-agentic-era-2.html

Understanding Passkeys

/ ,

The article explores the concept of passkeys as a modern authentication method based on cryptographic key pairs managed by authenticators, offering benefits like phishing resistance, improved security, and ease of use over traditional passwords. It clarifies common misconceptions, such as the risk of being locked out if a device is lost and how passkeys relate to two-factor authentication, and shares personal experiences using passkeys with various services, highlighting both usability and security considerations. Ultimately, the author advocates for adopting passkeys—especially via password managers—as a convenient and secure replacement for passwords and encourages better security hygiene.

https://marending.dev/notes/passkeys/

Where Multi-Factor Authentication Stops and Credential Abuse Starts

/ , ,

MFA often fails in Windows environments due to reliance on Active Directory for logins, allowing attackers to exploit valid credentials. Key vulnerabilities include local logins, RDP access, legacy NTLM, Kerberos ticket abuse, local admin credential reuse, SMB authentication, and unmonitored service accounts. To mitigate these risks, organizations should enforce strong password policies, block compromised passwords, limit legacy protocols, and audit service accounts. Effective tools like Specops can enhance security against credential abuse.

https://thehackernews.com/2026/03/where-multi-factor-authentication-stops.html

Rising Identity Complexity: How CISOs Can Prevent It From Becoming an Attacker’s Roadmap

/ , , ,

The identity surface has expanded dramatically, encompassing employees, contractors, machines, and cloud workloads, making identity management a critical security concern. IAM has evolved from an administrative utility to a proactive defense layer, integrating with security operations to detect and respond to identity-based threats. A threat-aware IAM strategy focuses on continuous posture assessment, attack path analysis, and automated mitigation to protect against credential misuse and privilege escalation.

https://thenewstack.io/ciso-identity-complexity-strategy/

Passwords Are Where PCI DSS Compliance Often Breaks Down

/ , , , ,

Extreme TLDR: PCI DSS compliance often fails due to poor password practices, like reuse and insecure storage. Enhanced training on password management and using password managers can improve compliance. These tools support key requirements, reduce risky behaviors, and should be integrated into employee onboarding to make secure practices routine. Compliance becomes easier when secure password handling is a default behavior.

https://www.helpnetsecurity.com/2026/01/08/passwords-pci-dds-compliance/

Scroll to Top