sync: auto-sync from HOWARD-HOME at 2026-07-22 09:18:55
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-22 09:18:55
This commit is contained in:
@@ -0,0 +1,55 @@
|
||||
# Cascades — Entra SMS/Voice MFA Retirement Prep
|
||||
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** Howard-Home
|
||||
- **Role:** tech
|
||||
|
||||
## Session Summary
|
||||
|
||||
Howard flagged the Microsoft Entra ID SMS/voice authentication retirement announcement for inclusion in the Cascades of Tucson work plan. The announcement confirms that Microsoft will auto-enable passkeys and nudge SMS/voice users starting September 1, 2026, and fully retire Microsoft-provided SMS/voice delivery on February 1, 2027 with a blocking passkey registration prompt (no opt-out, all tenants enforced).
|
||||
|
||||
The article was fetched and analyzed against the current Cascades Entra/MFA posture documented in the wiki and REMAINING-WORK-PLAN.md. The Cascades tenant has one known SMS/voice exposure: `sysadmin@cascadestucson.com` (Howard's admin account) is the sole member of `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`), a scoped exception allowing voice-call MFA. Caregivers are excluded from MFA entirely (protected by network + device CA policies), so they are not affected. Admin/director/nurse users on the "Require MFA for all users" policy need to be scanned for SMS-only registrations.
|
||||
|
||||
Action items were added to REMAINING-WORK-PLAN.md under Workstream 4 (M365) and to the wiki article (cascades-tucson.md) in both the MFA line of the Email & Identity section and the Open Pending Items list. The break-glass account design (FIDO2/YubiKeys) is already passkey-compatible and requires no changes.
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- Added the SMS/voice retirement prep as a WS4 item rather than a new workstream — it is an identity/MFA task that fits naturally alongside the existing Zeke Huerta MFA registration and break-glass account items.
|
||||
- Noted that a third-party telecom provider is likely unnecessary for a 45-seat tenant where all staff can move to Authenticator, but flagged it as a decision point after the usage scan.
|
||||
- Flagged the Sep 1, 2026 date as the action deadline (not Feb 1, 2027) since the auto-enablement and nudging starts then and it is cleaner to be ahead of it.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
- `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` — added Entra SMS/voice MFA retirement prep block under WS4 with full timeline, action items, and HIPAA note.
|
||||
- `wiki/clients/cascades-tucson.md` — added inline flag on the MFA line in Email & Identity section; added new pending item in Open Pending Items.
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
None. No new credentials discovered or created.
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- Cascades M365 tenant: `207fa277-e9d8-4eb7-ada1-1064d2221498` (cascadestucson.com)
|
||||
- Voice-call exception group: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`), single member `sysadmin@cascadestucson.com`
|
||||
- MFA-for-all CA policy: `7e87a1c7`
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
None — this was a planning/documentation session.
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- **Run SMS/voice usage analyzer** ([script](https://github.com/microsoft/entra-sms-voice-usage-analyzer)) against Cascades tenant to identify all users registered for SMS or voice MFA. Requires Global Reader, Authentication Policy Administrator, or Security Reader role.
|
||||
- **Retire `SG-MFA-Voice-Call-Scoped-sysadmin`** and remove voice-call as a method for sysadmin@ — switch to Authenticator or passkey.
|
||||
- **Migrate any SMS-only users** found by the scan to Authenticator or passkey before Sep 1, 2026.
|
||||
- **Decide on third-party telecom provider** — evaluate after usage scan (likely not needed).
|
||||
- **Communicate to Ashley Jensen** about passkey registration prompts starting Sep 1.
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Microsoft announcement: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
|
||||
- SMS/voice usage analyzer script: https://github.com/microsoft/entra-sms-voice-usage-analyzer
|
||||
- Microsoft Security Store telecom providers: available Sep 18, 2026; configurable Oct 30, 2026
|
||||
- Passkey deployment guide: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication
|
||||
- Temporary opt-out API for Sep 1 changes: available Aug 1, 2026 (opt-out does NOT apply to Feb 1, 2027 enforcement)
|
||||
Reference in New Issue
Block a user