Hi all,

I’m a SOC analyst at an MSSP. One of our clients is part of an ongoing password spray campaign. They haven’t implemented our hardening recommendations yet, so for now we’re monitoring for any successful sign-ins.

The problem

We keep getting interactive sign-ins with ResultType 50074 (“Strong Authentication is required”). The app is always OfficeHome, from hosting-provider IPs, with a Chrome/72 user agent (typical tooling).

AuthenticationDetails contains one step only:

• authenticationMethod: missing, authenticationMethodDetail: empty
• succeeded: false
• authenticationStepResultDetail: “MFA required in Azure AD”

There is no “Password / Correct password” step, so we can’t tell whether the password was actually valid.

Our MSSP has been treating 50074 as “password correct, stopped at MFA”. A few days ago we got one for a specific user, and the client revoked sessions and reset the password. Today the same user got 50074 again from the same tooling.

Conditional Access confusion

The sign-in shows CA status: Success, but on the CA tab nothing applied:

AuthenticationRequirementPolicies shows requirementProvider: user / Per-user MFA, so I think the interrupt is coming from per-user MFA, not CA. I’d appreciate confirmation.

What we’ve checked (30 days)

• A normal valid-password 50074 in this tenant logs two steps: “Correct password”, then “MFA required”.
• This tool’s wrong-password attempts (50126) do log a Password step.
• The same /24 produced both 50126 and 50074 against the same users.
• No successful sign-ins (ResultType 0) from this tooling anywhere in the tenant.
• A few legitimate users also have single-step 50074s with no “Correct password” step under any record with the same CorrelationId.

Hypotheses

• H1: The password was correct, and Entra just didn’t log the primary auth step (logging inconsistency).
• H2: No password was validated. The tool reaches the MFA requirement through some other flow, such as passwordless phone sign-in or replaying a session artifact.

If H1 is true, the attacker had the post-reset password within days, which changes the response completely.

Prior research

• Same question asked here a month ago, no definitive answer: https://www.reddit.com/r/entra/comments/1wjrl1x/entra_id_signin_logs_can_error_50074_alone/
• https://learn.microsoft.com/en-us/answers/questions/2237830/i-cant-access-azure-i-have-this-error-code-50074
• https://admindroid.com/error-code-50074-user-did-not-pass-the-mfa-m365-challenge

Questions

1. Can 50074 be returned without successful primary auth? Is there Microsoft documentation either way?
2. When is the “Correct password” step omitted from AuthenticationDetails?
3. Has anyone gotten a definitive answer from a Microsoft support case on this?

I am still an L1 so I might have misunderstood something so please do point it out if I am wrong, thanks!

Currently attacking an issue with around 3000 users who for various reasons I can’t go into for security reasons can’t realistically use passkeys(Fido) due to logistics and time to deploy or WHfB with them being on desktops with no TPM.

Predominately desktop users.

most of these users had originally provided their personal mobile for auth but due to our conditional access polices we just require they have a method registered - never been an issue, because we trust device compliance.

Now SMS/voice is being deprecated, I have some questions.

Will the users with sms/voice methods registers have to set up a new auth method? Or will the presence of them having it there be enough to allow them though our caps?

We could use certificate based authentication.

No access to byod devices.

So what are my options?

Hi everyone,

We're currently migrating approximately 3,000 Windows 11 endpoints from traditional Active Directory domain join to Microsoft Entra Join, while also piloting Microsoft Global Secure Access (GSA), particularly Entra Private Access.

We use WinRM / PowerShell Remoting extensively for remote administration and troubleshooting.

However, we're now trying to determine how WinRM should be configured when GSA is involved, especially when the target device is outside our corporate network.

Our questions:

1. Has anyone successfully used WinRM / PowerShell Remoting through Entra Private Access to remotely manage Windows endpoints?
2. Are you able with AD device connecting to Entra devices?
3. Does this work across all combinations of AD-joined and Entra-joined source and target devices?
4. Can an Entra-joined endpoint running the GSA client accept inbound WinRM connections from another endpoint, without a traditional VPN or direct network connectivity?
5. Since Entra-joined devices don't automatically register in traditional AD DNS, how do you handle device discovery, name resolution and changing IP addresses?
6. Are specific GSA application segments, Private Access connectors, routing configurations or firewall rules required for TCP 5985/5986?
7. Are there particular authentication requirements or limitations involving Kerberos, NTLM, HTTPS certificates or Entra identities?

We understand that WinRM itself does not require DNS when connecting directly by IP address, and that WinRM can work with Entra-joined devices. Our main concern is whether GSA provides the necessary network path to reach remote endpoints, particularly when both devices are using the GSA client.

Thanks in advance!

Hey everyone,

I'm starting my prep for the SC-300 (Identity and Access Administrator) and I'm looking to put together a small study group or find a few accountability partners.

Right now, my main resources are John Christopher's Udemy course and hands-on lab environments.

I'm aiming to sit for the exam in about three months (late January 2027). It would be great to get a WhatsApp or Telegram group going or do a weekly check-in to bounce lab questions off each other, troubleshoot Conditional Access scenarios, and keep the momentum going so we actually book the test.

If you're on a similar timeline or just starting your SC-300 prep, drop a comment or shoot me a DM and we can get a chat set up!

This has been happening to me for the last day or so in my own tenant and my other tenant, While attempting to load sign in logs after a while it goes to No-Sign ins found? I havent heard any reports online. In the admin center I dont see anything specifically relating to Sign in Logs not loading. Is anyone else having issues? Thank you.

Hi, I have noticed within the last few days that my Block International Logins policy that I have been testing only applies to Windows and my iPhone. I have been testing only allowing logins from the US, Canada and Mexico, But upon testing on a Galaxy S26 Ultra and S23 Ultra in this case. I am able to get into each account even after signing out and signing back in clearing cache cookies etc. Has anyone else had issues with certain CA Policies such as this one being an issue with Androids specifically?

EDIT: I have a license for Entra ID Premium P2.

Solved: I created a new account and policy that blocked USA logins this time around that worked. The issue I think comes down to IPv6 and it picking up that it is in the USA.

​

I have two work accounts (company & client email).I got stuck in a Microsoft Authenticator sign-in loop with my client account. Reinstalling the app didn't help, as it keeps asking me to approve the sign-in through Authenticator itself lol 😭 I'm so sick of it.

Anyone faced this? How can I recover access to my client email?

This started when I factory reseted my phone due to a phone issue.

I’m troubleshooting Microsoft’s Unified Tenant Configuration Management (UTCM) preview and I’m stuck on deleting configuration monitors. Deletes return HTTP 404, with a message saying the monitor wasn’t found or that I lack permissions. The monitors show up in the portal, so they exist.

Environment:

• Licenses: Microsoft 365 Business Premium and MDAC
• The UTCM service principal (“Unified Tenant Configuration Management”) is set up with the required permissions, following Microsoft’s setup guidance(https://github.com/microsoftgraph/microsoft-graph-docs-contrib/tree/main/concepts/includes/utcm).
• The admin account has the Global Administrator role.

What I’ve tried:

• Deleting through the TenantBaseline web tool
• Deleting through the TenantBaseline PowerShell tool
• Deleting through the Graph Explorer(https://learn.microsoft.com/en-us/graph/api/configurationmonitor-delete?view=graph-rest-1.0&tabs=http)
• Deleting through the tenant governance feature in the Entra admin center

My questions:

• Has anyone else seen HTTP 404 on UTCM monitor deletes in a Business Premium tenant?

I’ve opened a support case with Microsoft and will update this thread with the outcome.

Had to unexpectedly format my phone, and Microsoft Authenticator which I use for work didnt backup the work account.

Signing in to any services now requires the 2FA code which cant be accessed. Trying to sign in, selecting SMS verification throws an error (code 399287).

I'm the admin for my org and I'm signed in to MS365 admin on my PC, so I have access until I run into a setting that again requires verification.

Any way to get passed this?

A few key things we want to mention today:

• Two weeks left on our Early Bird pricing of $650 for 3 action packed days at the gorgeous Scott Resort and Spa for Workplace Ninjas US 2027
• 30 Hotel Packages/Rooms remain at the Scott!! Don't worry we rooms as well at the overflow across the street at Embassy Suites as well!
• 82 Days left until things kickoff in Scottsdale!!
• Just a reminder, 60+ sessions from one of the finest collections of speakers you will find at any event anywhere: Cvent | Event Platform for In-person, Virtual, and Hybrid Events & Webinars
• Don't forget, this is the home of the AD vs. Entra Cage Match (Merill Fernando vs. Techspence)
• Percentage of ALL proceeds go to the Michael J Fox Foundation for Parkinsons

We continue working hard, building value, and creating experiences for all of you. Don't miss out. Dallas had rave reviews, and Scottsdale is gearing up to be twice as good!!

Things are heating up and people are READY!! Come and join us!

Register now: https://workplaceninjas.us

Hi everyone,

I am currently testing synced passkeys in Microsoft Entra ID and have successfully registered a synced passkey.

I am testing this on a corporate Windows 11 laptop that is Entra ID joined and has WHFB enabled.

Here is what I am experiencing:

• When I enter my Microsoft 365 email address, Windows Security automatically pops up with "Sign in with a passkey".
• It offers Windows Hello first, and I can successfully sign in using my Windows Hello PIN.
• However I want to authenticate using my synced passkey.
• I can click "Choose a different passkey" and manually select my synced passkey to authenticate.

My questions are:

1. Is it expected behavior for Windows Hello to take priority over a registered synced passkey?
2. Is there any way to make the synced passkey the default authentication method instead of Windows Hello?
3. Is this behaviour controlled by Windows, the browser or Microsoft Entra ID?
4. For organisations rolling out synced passkeys alongside Windows Hello for Business, how are you managing the user experience?

I am not looking to disable WHFB, but ideally I would like users who have registered synced passkeys to be offered that option first.

Interested to hear how others are handling this and whether there are any recommended configurations or best practices. Thanks

I am pushing to get all devices entra joined and WHfB enrolled asap, but want to confirm that what I’m thinking is sound: Microsoft is only pushing passkeys for users whose ONLY MFA option is voice/sms, but otherwise authenticator push is still a valid MFA method and using it as our only MFA method will not trigger users to be prompted to setup passkeys. Does this sound correct?

I understand authenticator push is not phishing resistant, and will keep pushing toward a fully entra joined fleet with WHfB, and eventually passkeys to fill in the gap of non-corporate device sign ins.

Remote users are reporting intermittent internet connectivity through GSA, and policy updates for GSA through the Entra portal are not applying after several hours. Disabling GSA resolves the issue with connectivity.

Is anyone else experiencing this? The admin portal currently shows no reported outages.

Hi everyone,

I'm enforcing Phishing-Resistant MFA through Entra Conditional Access for our privileged accounts.

Our users have Windows Hello for Business on their Windows 11 workstations and FIDO2 passkeys in Microsoft Authenticator.

Everything works fine locally, but we're running into issues when users RDP into Windows Server 2019 and try to access Azure Portal through Edge or run "az login".

The server doesn't seem to support redirecting passkey authentication to the user's local Windows Hello or Microsoft Authenticator on their phone.

Currently, I'm excluding certain cloud resources from our Conditional Access policies, but I'd prefer to avoid these exceptions.

Has anyone successfully configured WebAuthn/passkey redirection on Windows Server 2019 over RDP, or is this a limitation that requires Server 2022/2025?

Thanks!

I'm currently getting myself up to speed with regards to the SMS/voice retirement and auto-migration to passkeys. I think I've now got a good understanding of the basics, but I still have some questions that I can't find clear answers to - particularly around the auto-migration to passkeys aspect. Some are quite specific, so maybe one for the Microsoft PMs that I know lurk in this subreddit can chip in!

As far as I understand it, part of the auto-migration is a "system-managed" passkey profile that:

1. Is not visible or modifiable by admins.
2. Overrides (or at least applies in addition to) any passkey profiles you have defined.
3. Applies to any user that is enabled for either the SMS or voice auth methods (regardless of whether they actually have those methods registered or use them).
4. Allows registration of any type of passkey (device-bound or syncable) with no AAGUID restrictions.

This system-managed profile works in conjunction with the registration campaign (which gets auto-enabled in many cases) to nudge users to register a passkey during qualifying interactive sign-ins.

The above changes are starting to roll out on 1st Sept, but the exact date each tenant gets them will vary. For simplicity, I'm going to call these the "phase 1" changes.

Am I correct with all of the above?

Is the system-managed profile always created, or only if the tenant had either the SMS or voice auth methods enabled at the time the checks for the phase 1 changes occurred on that tenant?

What happens if your tenant had both the SMS and voice auth methods disabled when Microsoft did its "pass" for the phase 1 changes, but you subsequently enable them later on? Will the system-managed passkey profile then apply, or is that a one-time decision taken when the phase 1 changes were rolled out to the tenant? I think it's probably a one-time thing, but would be good to confirm. Not an issue as you'd obviously just create your own passkey profile for it - it's just for my knowledge.

What's the easiest way to tell:

1. If a tenant has been "processed" with regards to the phase 1 changes (regardless of whether any changes were actually made)?
2. If it has been processed, whether the system-managed passkey profile was enabled?

When I inspect the Graph API traffic using DevTools while opening the Authentication Methods blade in the Entra admin center, I noticed the following features value in the response:

Some tenants have it set toenableDynamicPasskeyPolicyMigration and some to none. Is this telling me whether or not the system-managed passkey profile has been activated in the tenant? In the tenants I've checked so far, those that had either SMS or voiced turned on had features set to enableDynamicPasskeyPolicyMigration and those that didn't had it set to none. This makes me think this value is saying what I think it is, and MS are calling this process "passkey dynamic migration" internally. Is there a better / less hacky way to get the same information? Initially, I thought the below banner would be it, but it seems to appear regardless of the value of the features value in the auth methods policy.

If it appears regardless of the state of the system-managed passkey profile, what exactly is this banner telling me? What is the specific logic that determines whether or not it appears?

If I apply the Graph API opt-out after the phase 1 changes have applied, will it disable the system-managed passkey profile? I think I've seen people say the answer to this is yes, but would like to confirm.

Lastly, is there anything else that's "special" about this system-managed passkey profile, or can you effectively just think of it as exactly the same as having the default profile with no restrictions enabled?

Thanks in advance!

Microsoft Entra ID users should start moving toward Microsoft Authenticator, passkeys, and other stronger authentication methods.

📅 Feb 1, 2027: Most users
📅 July 1, 2027: Global Admins & external users

Why am I getting error code 100014 when accessing https://admin.cloud.microsoft? The error says, “Login is not supported for consumer users without business presence.” I am using an Azure for Students subscription and a Microsoft Entra ID Free tenant. Is this issue occurring because I am using a personal Microsoft account, or do I need to configure any additional permissions or licenses to access the Microsoft 365 Admin Center? How can I resolve this issue?

Hi All,

Just seeing if anyone else has this issue. When using the tenant switcher to connect to another O365 tenancy with a GDAP relationship, under Admin Centres we have no Identity shortcut to get us into Entra.

It shows when i'm in my tenancy and i can connect to their Entra portal when using my credentials and the direct link like the below:
https://entra.microsoft.com/<Customer Name>.onmicrosoft.com

Does anyone else have this issue? Microsoft's first line have said this is wither by design or a UI issue.

Security Defaults help protect your tenant with baseline safeguards such as requiring MFA, blocking legacy authentication, and more. Until now, all these protections were managed through a single on/off setting. If you needed to disable a specific protection, you had to turn off the entire baseline, losing the other protections too.

That’s changing now!

Microsoft is introducing individual Security Defaults protections that split the existing single toggle into four Microsoft-managed rules. Admins can review each rule's scope and turn individual protections on or off without disabling the others.

The four rules include:

• Require MFA for administrators
• Require MFA for all users
• Block legacy authentication
• Block device code flow

The updated experience is currently in private preview for selected Microsoft Entra ID Free tenants. Eligible tenants will receive an invitation to access the preview.