Microsoft Entra ID updates MFA flows to prioritize more secure non-telephony methods over SMS and voice, which remain available under "Show more verification methods." The rollout occurs in October 2026, with no configuration changes required. Users should prepare for a resend waiting period and plan for SMS/voice retirement in February 2027.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Entra MFA elevates non-telephony methods as GoTo provisioning migration deadline approaches
Microsoft Entra MFA is prioritizing more secure non-telephony methods over SMS and voice; telephony options remain under “Show more verification methods,” with SMS and voice retirement planned for February 2027. No MFA configuration changes are required. Separately, GoTo provisioning must move from Authorization Code Grant to Client Credentials Grant by March 31, 2027, while a cross-tenant synchronization caveat affects when administrators should restart jobs after removing users from scope.
- MFA flows prioritize non-telephony verification methods
Entra ID · AuthenticationThe MFA rollout places more secure non-telephony methods ahead of SMS and voice. Users can still choose SMS or voice under “Show more verification methods.” Microsoft also notes a resend waiting period and plans to retire SMS and voice in February 2027; no configuration changes are required.
- GoTo provisioning must move to Client Credentials Grant
Entra ID · ProvisioningThe GoTo provisioning tutorial now directs administrators to create an OAuth client and configure Client Credentials Grant because Authorization Code Grant is being retired. Migration is required by March 31, 2027; otherwise user and group synchronization may stop, while SSO remains unaffected.
- Cross-tenant sync deletions depend on the next cycleEntra ID · Provisioning
When a user is removed from a cross-tenant synchronization job’s scope, restarting the job before the next synchronization cycle does not delete that user from the target tenant. The documented workaround is to wait for the next cycle before restarting.
- Admin consent guidance distinguishes static and dynamic permissions
Entra ID · GeneralThe admin consent workflow FAQ now identifies the two consent requests as representing static consent permissions and dynamic consent permissions, giving administrators a clearer way to interpret the requests.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
9 updates
Microsoft Entra ID
9 updatesHowto Vm Sign In Azure Ad Linux
Feature updateThe documentation now lists AlmaLinux 10, Debian 13, openSUSE Leap 16, Oracle Linux 10, Rocky Linux 10, SLES 16, and Ubuntu through 26.04.
Howto Vm Sign In Azure Ad Linux
Feature updateThe supported versions now include Debian 13, Oracle Linux 10, and Rocky Linux 10.
Howto Vm Sign In Azure Ad Linux
Feature updateThe documentation no longer lists Debian 13, Oracle Linux 10, or Rocky Linux 10 as supported versions. Debian 9–12, Oracle Linux 8–9, and Rocky Linux 8–9 remain listed.
Howto Vm Sign In Azure Ad Linux
Doc updateThe Linux VM sign-in article received a minor formatting edit, with one line removed.
Configure GoTo for automatic user provisioning with Microsoft Entra ID
RetirementAction requiredThe tutorial now directs administrators to create an OAuth client and configure Client Credentials Grant because Authorization Code Grant is being retired. Migration is required by March 31, 2027; otherwise provisioning may stop, affecting user and group synchronization, while SSO remains unaffected.
Known issues for provisioning in Microsoft Entra ID
Doc updateAction requiredUsers removed from a cross-tenant synchronization job’s scope aren’t deleted from the target tenant if the job is restarted before the next synchronization cycle.
Admin Consent Workflow Faq
Doc updateThe FAQ now specifies that the two admin consent requests represent static consent permissions and dynamic consent permissions.
Consent Types Developer
Doc updateThe guidance now explicitly states that the App registrations and Enterprise applications portal experiences do not know about dynamic consent permissions at consent time.