https://hackingpassion.com/tags/entra-id/Recent content in Entra ID on HackingPassion.com : root@HackingPassion.com-[~]HugoenTue, 11 Aug 2026 14:15:01 +0200https://hackingpassion.com/pass-the-passkey-windows-entra-mfa-bypass/Tue, 11 Aug 2026 14:15:01 +0200https://hackingpassion.com/pass-the-passkey-windows-entra-mfa-bypass/<p><strong>Someone could sign in as a company&rsquo;s top admin by reading one Windows log file.</strong> The admin&rsquo;s password and passkey were never touched. Microsoft called it medium severity and paid the finder 1,000 dollars. 🧐</p> <p>Passkeys were supposed to make this impossible. Instead of a password you type, your device holds a secret key and proves who you are with it. The key is never typed and never sent to a website, so a fake login page has nothing to grab. That is why they are called <strong>phishing-resistant</strong>, and Microsoft is pushing them hard. On <strong>September 1, 2026</strong> it switches passkeys on by default and starts nudging users still on text or voice codes to register one. That nudge can be snoozed. The hard deadline is <strong>February 1, 2027</strong>. After that, if a text or voice code is your only way in, you have to register a passkey before you can sign in, and companies cannot opt out.</p>