service
Microsoft Entra ID: security advisories, deprecations and releases
Microsoft's identity and access service, formerly Azure Active Directory.
- Items, 90 days
- 3
- Critical
- 0
- Last critical
- none
- This week
- 0
Security 1
- MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026
EvilTokens
EvilTokens is a Phishing-as-a-Service (PhaaS) platform that emerged in February 2026, operated by the threat actor Storm-2992. It leverages AI to create tailored phishing lures and automates device code phishing attacks to steal OAuth tokens, bypassing MFA. This has led to the compromise of over 12,000 inboxes across 10,000 organizations. Post-compromise, the platform facilitates reconnaissance via Microsoft Graph, persistence through…
Releases 1
- INFO Azure Updates · 21 Oct 2026
Announcing: Choose Your Own Telephony (CYOT) for Microsoft Entra
Starting October 30, 2026, Microsoft Entra ID will let organizations use a supported third-party provider for SMS and voice authentication.
News and tools 1
- INFO tl;dr sec · 15 Oct 2026
EntraGoat: Deliberately Vulnerable Entra ID Simulation Environment
Semperis released EntraGoat, an open-source lab using PowerShell and Microsoft Graph to simulate real-world Entra ID misconfigurations.
Only hear about Microsoft Entra ID when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.