Microsoft Entra Passkey Security Updates
The story began on 24 April, when BleepingComputer reported that Microsoft would roll out Entra passkeys on Windows in late April. On 14 July, it reported that passkeys would become the default authentication method for Microsoft Entra ID starting in September. Microsoft reminded administrators on 21 September to migrate Entra ID users to passkeys. On 30 September, BleepingComputer reported that Microsoft would begin blocking Entra ID script injection attacks in October.
BleepingComputer has also reported that attackers are using vishing during Entra passkey enrollment to target Microsoft 365 users. Stronger authentication can still leave enrollment open to human manipulation.
Assuming the account is factual, impact is 10%. Entra ID administrators must manage user migration and prepare for passkeys as the default. Affected Windows and Microsoft 365 users face a changed sign-in process and vishing attempts aimed at enrollment. Microsoft’s planned blocking of script injection attacks would add another security control in October.
Watch for Microsoft deployment updates and administrator reports confirming that passkeys became the default in September and that script injection blocking began in October. Documented changes to the rollout schedule or enrollment process would alter the picture.
Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →