Microsoft yana Entra ID administratorlaridan foydalanuvchilarni fishingga chidamli usullarga ko'chirishni so'radi, chunki 2027-yil fevral oyida SMS va ovozli autentifikatsiyani bekor qilishdan oldin kirish uzilishlarining oldini olish kerak.
Bu bekor qilish jarayoni faqat Microsoft Entra ID ishchi ijarachi autentifikatsiya ssenariylariga tegishli va Azure AD B2C yoki Microsoft Entra External ID mijoz identifikatsiya ssenariylariga emas.
Microsoft SMS va ovozli autentifikatsiyani bekor qilishdan oldin, administratorlar o'z tashkilotlaridagi barcha foydalanuvchilar fishingga chidamli usuldan foydalanishini ta'minlashi kerak, chunki ular endi ularni ko'p faktorli autentifikatsiyani yakunlash va o'z hisoblariga kirish uchun ishlata olmaydilar.
Administratorlar passkeylar, QR kod autentifikatsiyasi, FIDO2 xavfsizlik kalitlari va boshqa Entra ID tomonidan qo'llab-quvvatlanadigan kirish usullaridan tanlashlari mumkin.
"Microsoft tomonidan taqdim etilgan SMS va ovozli autentifikatsiya 2027-yil 1-fevraldan boshlab bekor qilinadi. Foydalanuvchilarning kirish tajribasini uzmaslik uchun tarqatish boshlanishidan oldin ko'chirishni yakunlang," deb aytdi Microsoft seshanba kuni Microsoft 365 Xabar Markazi yangilanishida.
"SMS va ovoz fishing va SIM-almashish hujumlariga zaif. Microsoft kuchliroq, fishingga chidamli himoya uchun passkeylarni tavsiya qiladi. Shuningdek, siz boshqa qo'llab-quvvatlanadigan autentifikatsiya usuliga ko'chishingiz yoki Microsoft Security Store orqali mijoz tomonidan boshqariladigan telekom provayderini (CYOT) sozlash orqali SMS va ovozni saqlab qolishingiz mumkin."
Microsoft sentyabr oyida berilgan oldingi eslatmada ta'kidlaganidek, Authentication Policy Administrator, Global Reader yoki Security Reader rollariga ega administratorlar Entra SMS/Ovoz Siyosati Skaneri PowerShell skripti yordamida SMS yoki ovozli autentifikatsiyadan foydalanadigan foydalanuvchilarni topishlari mumkin.
Telefon asosidagi autentifikatsiyadan foydalanishi shart bo'lgan tashkilotlar Microsoft Security Store orqali uchinchi tomon telekom provayderlarini sozlashlari kerak.
Passkeylar endi Entra IDning standart autentifikatsiya usuli
Iyul oyida Microsoft passkeylar sentyabr oyidan boshlab Entra ID korporativ identifikatsiya xizmati uchun standart autentifikatsiya tajribasi sifatida tarqatilishini e'lon qildi.
"Tarqatish har bir tashkilotga yetib borganda, SMS yoki ovozli autentifikatsiya uchun yoqilgan foydalanuvchilar avtomatik ravishda passkeylar uchun yoqiladi va ular keyingi safar ko'p faktorli autentifikatsiyani amalga oshirganda, ularga passkey ro'yxatdan o'tkazish taklif qilinadi," deb aytdi Microsoft.
"Bu o'tishdan so'ng, 2027-yil 1-fevralda Microsoft SMS va ovozli autentifikatsiya uchun Microsoft tomonidan taqdim etilgan telekom yetkazib berishni bekor qiladi va SMS va ovozni Microsoft Entra-ning mahalliy qobiliyati sifatida endi taklif qilmaydi."
Microsoft shuningdek, fishing, firibgarlik va hisobni buzish xavflari tufayli Microsoft Entra ID Free ijarachilar uchun SMS birinchi faktorli kirishni avgust oyida bekor qildi va yangi yaratilgan ijarachilar uchun uni yoqishni to'xtatdi.
Entra ID-da fishingga chidamli parolsiz autentifikatsiyani joylashtirish va boshqarish bo'yicha batafsil yo'riqnoma ushbu maxsus Microsoft hujjatlashtirish sahifasida mavjud.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaani o'lchaydi.
Hisobotni oling
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027.
This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios.
Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts.
Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods.
"Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.
"SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store."
As Microsoft noted in a previous reminderissued in September, admins with the Authentication Policy Administrator, Global Reader, or Security Reader roles can find users with SMS or voice authentication with the Entra SMS/Voice Policy Scanner PowerShell script.
Organizations that must use phone-based authentication have to configure third-party telecom providers through the Microsoft Security Store.
Passkeys now the default Entra ID auth method
In July, Microsoft announced that passkeys will start rolling out as the default authentication experience for the Entra ID enterprise identity service starting in September.
"As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multifactor authentication, they'll be prompted to register a passkey," Microsoft said.
"Following this transition, on February 1, 2027, Microsoft will retire Microsoft-provided telecom delivery for SMS and voice authentication and will no longer offer SMS and voice as a native Microsoft Entra capability."
Microsoft also retired SMS first-factor sign-in for Microsoft Entra ID Free tenants in August due to phishing, fraud, and account compromise risks, and stopped enabling it for newly created tenants.
Detailed guidance on deploying and managing phishing-resistant passwordless authentication in Entra ID is available on this dedicated Microsoft documentation page.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report