Microsoft Entra ID: Legacy Risk Policy Retirement, Pass-the-Passkey CVE, and Rising Phishing Threats

The week of July 27 brought a mix of planned retirements, vulnerability disclosures, and active threat intelligence that every Entra ID admin needs on their radar. Here’s what changed and what to do about it.

1. Legacy Risk Policies in Entra ID Protection Retiring October 1

Microsoft has confirmed that legacy User Risk and Sign-in Risk policies configured in Entra ID Protection will be retired on October 1, 2026. After that date, these policies will stop functioning entirely — no automatic migration, no grace period.

The danger: If you don’t recreate equivalent policies in Conditional Access by October 1, compromised users flagged as high risk may continue authenticating normally without any additional verification. This is a silent security control removal.

Timeline:

• July 31, 2025 — Risk policy pages became read-only in Entra ID Protection
• October 1, 2026 — Full retirement; policies stop protecting users

Migration path:

1. Create equivalent user-risk and sign-in-risk policies in Conditional Access (start in report-only mode)
2. Validate expected behavior
3. Turn policies On
4. Disable old risk policies in ID Protection

⚠️ Keep user risk and sign-in risk as separate Conditional Access policies. Requires Entra ID P2 licensing.

Microsoft provides pre-built templates in the Conditional Access blade under “Create new policy from templates.”

2. CVE-2026-34348: Pass-the-Passkey Attacks

Security researcher Michael Grafnetter (SpecterOps) identified a family of “Pass-the-Passkey” attacks affecting Windows 11 and Microsoft Entra ID. The research will be presented at Black Hat USA (August 1–6, Las Vegas).

The vulnerability chain:

• CVE-2026-34348 (CVSS 6.5) — Windows Event Logging Service was writing complete copies of passkey-related digital keys to event logs in cleartext, readable by any authenticated unprivileged user
• Entra ID cloud-side flaw — Failed to prevent those assertions from being reused
• Together this forms a replay chain allowing privileged cloud identity impersonation while bypassing phishing-resistant MFA

Microsoft’s response: Patched the Windows issue on July 14, 2026 and quietly fixed the cloud-side behavior.

What to do:

• Apply July 2026 security updates immediately
• Prefer device-bound passkeys for privileged users
• Enforce attestation
• Don’t rely on phishing-resistant MFA as your only layer

3. Active Phishing Campaigns Targeting Entra ID

Device Code Flow Abuse (Trend Micro)

An active phishing campaign documented by Trend Micro is abusing Microsoft’s OAuth 2.0 Device Authorization Grant flow to bypass MFA:

• Attackers impersonate input-limited devices and initiate legitimate device-code requests
• Victims are lured via document-sharing emails, QR codes, or “account verification” prompts
• MFA is satisfied for the real Microsoft login, but tokens are issued to the attacker’s system
• Attackers register rogue devices and obtain long-lived refresh tokens

Defense: Block device code flow via Conditional Access where it’s not strictly needed. Most organizations can block broadly with narrow exceptions.

“Pink” Vishing Campaign (Okta Threat Intelligence)

Threat group O-UNC-066 (“Pink”) is using voice phishing to hijack Entra ID passkey registration at the enrollment stage:

• Attackers call employees posing as IT support, directing them to lookalike domains (setpasskey[.]com, passkeydeploy[.]com)
• A live operator watches the victim’s progress in real time
• While the victim enters credentials and MFA, the attacker enrolls their own passkey in the victim’s M365 account
• Followed by rapid SharePoint/OneDrive exfiltration

Defenses: Alert on authenticator lifecycle events, restrict method registration by network/device, audit existing passkey registrations, and train employees to verify callers through a known support channel.

Action Items for IT Admins

This post was researched and compiled from Microsoft Learn, Microsoft Tech Community, M365 Message Center, SpecterOps research, Trend Micro threat intelligence, and Okta research.