From 982aeee252921a96cf28ed9e5d78fdaad162093c Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Wed, 22 Jul 2026 09:19:26 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-22 09:18:55 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-22 09:18:55 --- ...-howard-entra-sms-voice-retirement-prep.md | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-entra-sms-voice-retirement-prep.md diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-entra-sms-voice-retirement-prep.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-entra-sms-voice-retirement-prep.md new file mode 100644 index 00000000..010607df --- /dev/null +++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-22-howard-entra-sms-voice-retirement-prep.md @@ -0,0 +1,55 @@ +# Cascades — Entra SMS/Voice MFA Retirement Prep + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Howard flagged the Microsoft Entra ID SMS/voice authentication retirement announcement for inclusion in the Cascades of Tucson work plan. The announcement confirms that Microsoft will auto-enable passkeys and nudge SMS/voice users starting September 1, 2026, and fully retire Microsoft-provided SMS/voice delivery on February 1, 2027 with a blocking passkey registration prompt (no opt-out, all tenants enforced). + +The article was fetched and analyzed against the current Cascades Entra/MFA posture documented in the wiki and REMAINING-WORK-PLAN.md. The Cascades tenant has one known SMS/voice exposure: `sysadmin@cascadestucson.com` (Howard's admin account) is the sole member of `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`), a scoped exception allowing voice-call MFA. Caregivers are excluded from MFA entirely (protected by network + device CA policies), so they are not affected. Admin/director/nurse users on the "Require MFA for all users" policy need to be scanned for SMS-only registrations. + +Action items were added to REMAINING-WORK-PLAN.md under Workstream 4 (M365) and to the wiki article (cascades-tucson.md) in both the MFA line of the Email & Identity section and the Open Pending Items list. The break-glass account design (FIDO2/YubiKeys) is already passkey-compatible and requires no changes. + +## Key Decisions + +- Added the SMS/voice retirement prep as a WS4 item rather than a new workstream — it is an identity/MFA task that fits naturally alongside the existing Zeke Huerta MFA registration and break-glass account items. +- Noted that a third-party telecom provider is likely unnecessary for a 45-seat tenant where all staff can move to Authenticator, but flagged it as a decision point after the usage scan. +- Flagged the Sep 1, 2026 date as the action deadline (not Feb 1, 2027) since the auto-enablement and nudging starts then and it is cleaner to be ahead of it. + +## Configuration Changes + +- `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` — added Entra SMS/voice MFA retirement prep block under WS4 with full timeline, action items, and HIPAA note. +- `wiki/clients/cascades-tucson.md` — added inline flag on the MFA line in Email & Identity section; added new pending item in Open Pending Items. + +## Credentials & Secrets + +None. No new credentials discovered or created. + +## Infrastructure & Servers + +- Cascades M365 tenant: `207fa277-e9d8-4eb7-ada1-1064d2221498` (cascadestucson.com) +- Voice-call exception group: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`), single member `sysadmin@cascadestucson.com` +- MFA-for-all CA policy: `7e87a1c7` + +## Commands & Outputs + +None — this was a planning/documentation session. + +## Pending / Incomplete Tasks + +- **Run SMS/voice usage analyzer** ([script](https://github.com/microsoft/entra-sms-voice-usage-analyzer)) against Cascades tenant to identify all users registered for SMS or voice MFA. Requires Global Reader, Authentication Policy Administrator, or Security Reader role. +- **Retire `SG-MFA-Voice-Call-Scoped-sysadmin`** and remove voice-call as a method for sysadmin@ — switch to Authenticator or passkey. +- **Migrate any SMS-only users** found by the scan to Authenticator or passkey before Sep 1, 2026. +- **Decide on third-party telecom provider** — evaluate after usage scan (likely not needed). +- **Communicate to Ashley Jensen** about passkey registration prompts starting Sep 1. + +## Reference Information + +- Microsoft announcement: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement +- SMS/voice usage analyzer script: https://github.com/microsoft/entra-sms-voice-usage-analyzer +- Microsoft Security Store telecom providers: available Sep 18, 2026; configurable Oct 30, 2026 +- Passkey deployment guide: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication +- Temporary opt-out API for Sep 1 changes: available Aug 1, 2026 (opt-out does NOT apply to Feb 1, 2027 enforcement)