Microsoft Ends SMS and Voice MFA Methods, Urges Stronger Authentication

Psu.Edu

Microsoft Ends SMS and Voice MFA Methods, Urges Stronger Authentication

First seen 12 Oct 2026, 16:34 UTC • •30.9

Article Content

1 / 3

Browse articles

ThreatCluster •October 12, 2026 at 16:34 UTC

•Microsoft will discontinue SMS and voice MFA methods on February 1, 2027.
•Users must transition to stronger MFA options like phishing-resistant passkeys.
•Failure to switch will result in loss of access to secure university resources.

Microsoft announced that starting February 1, 2027, it will discontinue SMS and voice call methods for Multifactor Authentication (MFA) at Penn State. Users currently relying on these methods must transition to alternatives like phishing-resistant passkeys to maintain access to secure resources. Failure to switch by the deadline will result in loss of access to services such as Outlook and Canvas. The university encourages users to set up multiple MFA methods to avoid authentication issues. This change is part of a broader initiative to enhance security and reduce vulnerabilities associated with SMS and voice-based MFA methods, which are susceptible to various attack vectors, including SIM swapping and phishing. Microsoft is nudging users to make this transition during their sign-in process.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-12

Microsoft announces MFA changes

Microsoft confirmed the discontinuation of SMS and voice call MFA methods effective February 1, 2027.

More articles in this cluster (2)

Threat Graph

10 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Phishing
T1566 - Phishing

Organization (3)

Outlook
Simba
Workday

Affected Platform (4)

Google Authenticator
LionPATH
Microsoft Authenticator
Okta Verify

Tool (1)

Canvas

Relationships

Phishing targets Google Authenticator
Phishing targets LionPATH
Phishing targets Microsoft Authenticator
Phishing targets Okta Verify
T1566 - Phishing targets Google Authenticator
T1566 - Phishing targets LionPATH
T1566 - Phishing targets Microsoft Authenticator
T1566 - Phishing targets Okta Verify
Canvas related to Outlook
Canvas related to Simba
Canvas related to Workday

Following this threat?

Track Outlook in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What MFA methods should I switch to?

Consider using phishing-resistant passkeys or authenticator apps like Microsoft Authenticator.

What happens if I don't switch by the deadline?

You will lose access to secure Penn State resources until you set up a new MFA method.

Why is Microsoft discontinuing these methods?

SMS and voice call methods are vulnerable to attacks like SIM swapping and phishing, prompting the shift to more secure options.

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…