Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Microsoft-provided SMS and voice face February 2027 Entra retirement deadline
Microsoft Entra ID will begin retiring Microsoft-provided SMS and voice authentication on February 1, 2027. Organizations must move users to passkeys or other authentication methods, or configure a customer-managed telecom provider, to avoid sign-in disruptions. The period also brings a planned MFA recognition change for Windows Hello for Business and macOS Platform SSO, alongside substantive preview guidance and limitations for Entra Internet Access cloud firewall deployments.
- Microsoft-provided SMS and voice authentication retirement
Entra ID · AuthenticationMicrosoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Administrators must migrate users to passkeys or other methods, or configure a customer-managed telecom provider; passkeys are recommended and migration is intended to prevent sign-in disruptions.
- Windows Hello and macOS Platform SSO become standalone MFA factors
Entra ID · Conditional AccessStarting in early November 2026, Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors, allowing users to satisfy MFA without an additional passkey. No configuration changes are required, but onboarding and MFA registration guidance should reflect the change.
- Internet Access guidance documents a preview DNS-acquisition limitation
Internet Access · GeneralUpdated guidance states that the Internet Access traffic forwarding profile does not acquire DNS traffic in preview. Wildcard acquisition rules and FQDN destinations do not enable DNS acquisition, so cloud firewall policies cannot filter DNS traffic.
- New preview guidance covers cloud firewall setup for Global Secure Access clientsInternet Access · General
A new preview article explains traffic acquisition, Allow and Block firewall rules, security profiles, and enforcement verification for Global Secure Access client traffic. It also identifies the required roles, licensing, forwarding profiles, and client prerequisites.
- Authenticator Android backup adds passkey supportEntra ID · Authentication
Starting in mid-January 2027, Microsoft Authenticator for Android will provide clearer backup and restore guidance and support passkeys. Users must enable Google One backup and screen lock; work and school accounts are not backed up, and backup works only in the Android personal profile. No administrator action is required.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
10 updates
Microsoft Entra ID
5 updatesMicrosoft Authenticator for Android will improve backup and restore with clearer setup guidance and support for passkeys starting mid-January 2027. Users must enable Google One backup and screen lock. Work/school accounts aren’t backed up, and backup works only in the Android personal profile. No admin action needed.
Snowflake Tutorial
Doc updateThe tutorial now uses single quotes in the Snowflake ALTER SECURITY INTEGRATION commands and links to Snowflake’s SAML2 security integration guide.
Snowflake Tutorial
Feature updateThe tutorial now uses the Account Administrator role, reorganizes the SQL setup steps, updates Snowflake URL parameters, and links to automated user provisioning and deprovisioning.
Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting early November 2026, allowing users to satisfy MFA without additional passkeys. No configuration changes are needed, but organizations should update onboarding and MFA registration guidance accordingly.
Microsoft Entra Internet Access
5 updatesA new article explains configuring traffic acquisition, Allow and Block firewall rules, security profiles, and enforcement verification for client traffic in Microsoft Entra Internet Access. It also lists required roles, licensing, forwarding profiles, and client prerequisites.
The documentation now states that the Internet Access traffic forwarding profile does not acquire DNS traffic in preview. Wildcard acquisition rules and FQDN destinations do not enable DNS acquisition, so cloud firewall policies do not filter DNS traffic.
Configure Cloud Firewall Clients
Doc updateThe documentation now states that Internet Access traffic forwarding does not acquire DNS traffic in preview, including with wildcard rules. Cloud Firewall cannot filter DNS queries; FQDN rules apply to connections to named destinations.
The documentation now explains that acquisition rules determine which traffic is forwarded, while cloud firewall policies allow or block it. It adds client and remote-network configuration links, wildcard acquisition examples for TCP and UDP, bypass and routing precedence details, and QUIC limitations.
The article title and heading now explicitly focus on configuring cloud firewall for remote networks.