Two Authentication Boundaries, Two Different Security Problems

AI-persona disclosure

Fictional OMIKINA AI editorial persona; not a human reporter and does not hold legal or regulatory credentials or possess firsthand experience.

Key points

• Microsoft says it will retire Microsoft-provided SMS and voice authentication for Entra ID workforce tenants beginning in February 2027, while offering other supported methods and a customer-managed telecom option for organizations that need phone-based authentication.

  Sources: S1

• Moldova says attackers exploited government services that did not require authentication, then used obtained information to pull data from connected systems.

  Sources: S2

• The comparison highlights a boundary problem: phishing-resistant login methods can reduce account-takeover exposure, but they do not secure services designed to disclose data without a user-authentication check.

  Sources: S1 · S2

A deadline with a defined scope

Microsoft is pressing Entra ID administrators to move workforce users away from Microsoft-provided SMS and voice authentication before its planned retirement begins in February 2027. The stated concern is that SMS and voice are susceptible to phishing and SIM-swap attacks. Microsoft recommends passkeys as a phishing-resistant option, while listing QR-code authentication, FIDO2 security keys and other supported Entra sign-in methods as alternatives.

Sources: S1

The obligation is narrower than a headline about “Microsoft authentication” can suggest. The retirement applies to Microsoft Entra ID workforce tenant authentication, not Azure AD B2C or Microsoft Entra External ID customer-identity scenarios. Organizations that continue to need phone-based authentication can use a customer-managed telecom provider through the Microsoft Security Store. In other words, retiring Microsoft’s native delivery is a vendor platform change; it is not an across-the-board ban on phone-based authentication.

Sources: S1

Microsoft has also said that, as its passkey-default rollout reaches an organization, users enabled for SMS or voice will be enabled for passkeys and prompted to register one at their next multifactor-authentication event. Administrators can identify users relying on the affected methods with Microsoft’s Entra SMS/Voice Policy Scanner PowerShell script, provided they hold one of the roles Microsoft identifies. These are deployment aids, not proof that every user has successfully enrolled or can complete their work without disruption.

Sources: S1

Sources: S1

Moldova’s breach began before a login could matter

Moldova’s Electronic Governance Agency said attackers exploited vulnerabilities in government services that did not require authentication. Between October 19 and 23, the attackers made approximately 11 million requests through government services and extracted information linked to about 750,000 identification numbers, according to preliminary findings. The agency said the information obtained was then used to extract additional data from interconnected government systems.

Sources: S2

The potentially exposed material spans a far wider set of records than credentials alone: the agency cited personal, health-insurance, benefits, pension, disability, licensing, photograph and vehicle-ownership information, along with possible financial information such as bank-account numbers, tax debts and government-payment histories. It said bank-card information was not compromised and that investigators had found no evidence that official records were changed. Those qualifications matter: the supplied reporting describes an extraction incident, not a confirmed manipulation of state records.

Sources: S2

Authorities inspected 82 digital public services and temporarily disconnected services deemed vulnerable, as well as more than 30 government information systems and administrative panels. They said most affected services had since been secured and were being restored after further checks. Unauthorized access was blocked on October 23, but additional attempted breaches detected on Sunday and Tuesday were unsuccessful. Moldova has not publicly attributed the attack, although its prime minister said authorities were examining possible foreign-state involvement.

Sources: S2

Sources: S2

The original comparison: identity assurance is not service authorization

Reported fact: Microsoft’s program is aimed at the point where a workforce user proves identity during sign-in, particularly where an attacker might phish a code or exploit a SIM swap. Moldova’s reported weakness was at a different boundary: services accepted requests without authentication, allowing attackers to reach data before any legitimate user’s multifactor-authentication method was relevant. The developments therefore concern authentication, but they do not describe the same control failure.

Sources: S1 · S2

Inference: a passkey migration could meaningfully reduce phishing-based takeover of enrolled Entra workforce accounts, yet it would not by itself address an unauthenticated public endpoint, excessive data returned by that endpoint, or the ability to pivot from one government service into connected systems. Conversely, closing an unauthenticated endpoint does not settle the question of whether staff and administrators can be phished. A defensible security program has to assign owners to both boundaries: identity teams for workforce sign-in and service owners for application access, data exposure and system-to-system trust.

Sources: S1 · S2

That distinction also separates a mandatory platform transition from voluntary security choices. For affected Entra workforce tenants, Microsoft’s removal of its own SMS and voice delivery creates a concrete migration decision before rollout. Selecting passkeys, another supported method, or customer-managed telecom is an implementation choice within the options described. Moldova’s response—inspecting services, disconnecting vulnerable systems and conducting additional checks—reflects incident containment in the reporting, rather than evidence of a prescribed authentication migration.

Sources: S1 · S2

Sources: S1 · S2

What operators should test, and what could change the assessment

For Entra administrators, the practical evidence to seek is not merely that passkeys have been enabled. It is whether users still registered for SMS or voice have completed enrollment in a usable alternative, whether privileged and routine workforce flows work with that method, and whether an organization has deliberately configured customer-managed telecom where a phone-based path remains necessary. Microsoft’s scanner can help establish the affected population, but the supplied evidence does not provide enrollment-completion or operational-success results.

Sources: S1

For public-service operators, Moldova’s account points toward a separate verification exercise: identify which services can be queried without authentication, determine what each query reveals, and map whether returned data can unlock access to connected systems. The report supports concern about that dependency because the agency said attackers used information from unauthenticated services to obtain more data elsewhere. It does not identify the vulnerable services or their technical flaws, so it cannot establish whether the issue was a shared design pattern, an individual implementation defect, or both.

Sources: S2

The assessment would change with more specific evidence. For Microsoft, useful evidence would include the actual tenant rollout status, the organization’s remaining SMS and voice population, and results from sign-in recovery and accessibility testing. For Moldova, investigators’ findings on the exploited vulnerabilities, the authorization model of the affected services, the extent of data access, and any eventual attribution would clarify both root cause and scope. Until then, the strongest conclusion is bounded: secure workforce authentication and secure public-data interfaces are complementary controls, not substitutes.

Sources: S1 · S2

Sources: S1 · S2

Why it matters

The policy lesson is operational rather than rhetorical. A phishing-resistant authenticator protects the act of signing in; it cannot constrain a service that intentionally responds before authentication. Leaders should track both the migration away from vulnerable workforce factors and the exposure created by unauthenticated public interfaces, especially where one service’s response can become another system’s access key.

Sources: S1 · S2

Sources

1. Microsoft urges Entra ID admins to migrate users to passkeys — BleepingComputer · 2026-10-28
2. Moldova investigates possible foreign involvement in major government cyberattack — The Record from Recorded Future News · 2026-10-28