Microsoft security · what's new
It was a quiet week for new features, so this roundup covers 15–29 October 2026 and includes two deadlines that land now: Intune's Android integrity enforcement on 31 October and the next step in the Entra SMS/voice retirement on 30 October. The change most likely to cause tickets is Windows blocking NTLMv1-derived single sign-on, which breaks MS-CHAPv2 Wi-Fi and VPN on devices without Credential Guard.
Passkeys became the default on 1 September 2026: users enabled for SMS or voice were automatically enabled for passkeys and get nudged to register one. From 30 October, organisations that still need SMS or voice can pick a telephony provider through Microsoft Security Store (Soprano and Telesign first, in private preview). On 1 February 2027 Microsoft-provided SMS and voice retire for everyone except Global Administrators and external users; internal guests are included. Global Administrators and external users follow on 1 July 2027. After each date, users whose only MFA method is SMS or voice get a blocking passkey registration prompt with no opt-out.
What to do: run the entra-sms-voice-usage-analyzer script (Global Reader, Authentication Policy Administrator or Security Reader), enable Passkey (FIDO2) in the authentication methods policy and set the registration campaign to Microsoft Managed for your SMS/voice group. The passkeyDynamicMigration opt-out only postpones the nudges; it does not stop enforcement. Microsoft Learn
Our take: don't buy a telephony provider to keep a weak method alive unless a regulator or a hard operational case requires it, and write that reason down. For admins, go straight to device-bound passkeys or FIDO2 keys, as in our Entra ID hardening checklist.
Google tightened the Strong Integrity verdict for Android 13 and later: it now needs hardware-backed signals and recent security updates. Intune enforces this by 31 October 2026. Android 13+ devices with no security update in the past 12 months may drop to "Device Integrity", which can trigger app protection conditional launch blocks or make the device noncompliant and cut it off through Conditional Access. Android 12 and below are not affected.
What to do: check the last Android security patch in the app protection status report, then use the Min patch version conditional launch setting and the Minimum security patch level compliance setting to warn users before they are blocked. Intune in development
With the 2611 release, Intune plans to add the JIT registration configuration to existing SSO extension policies on eligible tenants (Authenticator deployed as required). No admin action is needed, but expect the policy to change. This is still listed as in development.
Since the 13 October 2026 security update, Windows 11 24H2, 25H2 and 26H2 and Windows Server 2025 block single sign-on that uses NTLMv1-derived credentials when the BlockNtlmv1SSO value is not set. This applies only where Credential Guard is disabled. Symptom: PEAP-MSCHAPv2 or EAP-MSCHAPv2 Wi-Fi, Ethernet and VPN connections fail to sign in automatically (typing credentials manually still works). Microsoft flagged it as a "Take action" item on 16 October.
What to do: look for events 4024 (audit) and 4025 (blocked) in Microsoft-Windows-NTLM/Operational and move those networks to certificate-based authentication. Setting BlockNtlmv1SSO to 0 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 brings back audit mode; Microsoft calls it a scoped, temporary exception. KB5066470
Our take: if you already deploy SCEP or PKCS certificates from Intune, moving Wi-Fi to certificate-based EAP is mostly profile work. It also takes a password-replay path off your NIS2 risk register.
From the October 2026 security update, quick machine recovery also covers Windows Server 2025: WinRE can fetch fixes from Windows Update when a widespread boot failure hits. Cloud remediation is off by default on servers and is enabled through Group Policy. Windows message center
Sensor v3.x turned on by default (rolling out). Tenants licensed for Defender for Identity with an active workspace get a 30-day banner on the Sensor management tab. After that, automatic sensor v3.x activation and automatic Windows auditing configuration are enabled, even where they are currently set to Off, unless you select Opt out in the banner. If audit policy is GPO-controlled, decide now.
Sensor v3.x without Defender for Endpoint: GA. Supported on domain controllers, AD FS, AD CS and Entra Connect servers running Windows Server 2019 or later, for new deployments only. Migration from v2.x is not available yet.
New detections: 26 alerts, including suspicious MFA method registration and Temporary Access Pass sign-ins in Entra ID, AD CS abuse (ESC1, ESC8, ESC11), diamond tickets and Okta privileged-account activity. Microsoft Learn
Vulnerability assessment for Microsoft Store apps: GA. Defender Vulnerability Management now adds supported Store apps to the software inventory and assesses them. Coverage is limited to a select set of common apps, and the Software evidence area shows the file path. Microsoft Learn
Report Teams meetings as a security concern. Users can report scheduled or Meet now meetings, or individual participants, during or after the meeting. Reports go to your reporting mailbox, to Microsoft, or both, according to your Teams user-reported settings.
ApproverUpn in EmailPostDeliveryEvents. Advanced hunting now records who approved a post-delivery remediation action, which helps when you need audit evidence. Microsoft Learn
Endpoint DLP for FTP and SFTP transfers: GA. On managed Windows devices onboarded to Purview, Endpoint DLP can now audit, block or block-with-override sensitive files sent over FTP/SFTP, with full file evidence. It is off by default; enable the FTP/SFTP activities in your policy and review hits in Activity explorer under "File transfer by FTP/SFTP". Microsoft Learn
Our take: in a PCI DSS Level 1 payment environment, SFTP to "that one partner" is a classic undocumented data flow. Run a month in Audit only and use the results as data-flow evidence before you block anything.
Want a second pair of eyes? Start with our free assessment, or see our Entra ID hardening and Microsoft 365 security audit services.
Microsoft-provided SMS and voice retire on 1 February 2027 for all users except Global Administrators and external users, who follow on 1 July 2027. After those dates, users who only have SMS or voice must register a passkey to sign in.
Intune enforces Google's updated Strong Integrity definition by 31 October 2026. Android 13+ devices with no security update in the past 12 months can drop to Device Integrity and fail app protection or compliance checks.
Windows 11 24H2 and later and Server 2025 now block NTLMv1-derived single sign-on by default on devices without Credential Guard, which breaks MS-CHAPv2-based Wi-Fi and VPN. Move to certificate-based authentication; KB5066470 describes a temporary registry rollback.
We review Entra ID, Intune and Defender configurations against a hardened baseline and give you a prioritized fix list, with the evidence your NIS2 or PCI DSS auditor will ask for.
Get in touch →