# This Week in Identity, Issue 4 Source: https://startwithidentity.com/newsletter/2026-07-14-this-week-in-identity-04/ Last updated: 2026-08-29 License: content by Start with Identity. Cite the source URL. --- Issue 4 of This Week in Identity. A big week for passkeys, in both directions. ## In brief - Entra ID is making passkeys the default authentication method and retiring SMS and voice in 2027, the largest single push toward phishing-resistant credentials to date. - Attackers are already phishing the enrollment step rather than the login, because enrolling an attacker-controlled passkey is durable and looks legitimate afterwards. - A SharePoint JWT validation bug let an unauthenticated attacker become any user, with no password and no MFA prompt anywhere in the chain. ## The big story **Microsoft is making passkeys the default in Entra ID, and phasing out SMS and voice in 2027.** Announced alongside Google Workspace adding FIDO2 keys to Windows login the following week, this is the point at which phishing-resistant authentication becomes the path of least resistance rather than a project. Why it matters: the attacks in the same news cycle tell you where the work moves next. [Entra passkey enrollment vishing](https://startwithidentity.com/blog/2026-07-09-entra-passkey-enrollment-vishing-targets-microsoft-365-users/) targets the registration flow, not the login. A passkey the attacker enrolled is a passkey that works forever, is phishing-resistant on their behalf, and raises no alerts. Enrollment is now the weakest link in a passwordless rollout, which means it needs the same rigor as a password reset: verified identity, an existing strong factor, and an alert on every new credential registered. Sources: [Entra passkey default](https://startwithidentity.com/blog/2026-07-14-microsoft-entra-id-gets-passkeys-default-authentication-starting-septe/), [enrollment vishing](https://startwithidentity.com/blog/2026-07-09-entra-passkey-enrollment-vishing-targets-microsoft-365-users/). ## Patch this week - **[CVE-2026-55040](https://startwithidentity.com/cves/cve-2026-55040/)** (CVSS 9.1), SharePoint. Four JWT validation weaknesses chain into an unauthenticated bypass: know a target's SID or UPN and you are them, up to farm administrator. Patched July 2026. [Post](https://startwithidentity.com/blog/2026-07-14-sharepoint-jwt-auth-bypass-lets-attackers-assume-any-user-identity/). ## The pattern Three separate stories this week are token forgery or token theft rather than password compromise: the SharePoint JWT bypass, OAuth client ID spoofing used to validate stolen Entra credentials, and device-code phishing kits. The credential is increasingly beside the point. See [token replay against unbound endpoints](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/) and [device code phishing](https://startwithidentity.com/techniques/device-code-phishing/) for the classes. ## What else happened - **A CISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months.** The lesson is not "developers leak keys," it is that nobody was scanning. [Secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/) is the technique; automated detection at push time is the control. [Post](https://startwithidentity.com/blog/2026-07-13-cisa-github-leak-exposed-aws-govcloud-credentials/). - **npm 12 disabled install scripts by default** and began killing tokens that bypass 2FA, removing two of the supply chain's most reliable footholds. [Post](https://startwithidentity.com/blog/2026-07-10-npm-12-disables-install-scripts-by-default-to-reduce-supply-chain-risk/). - **Jalisco and OmegaLord**, two phishing kits built around device-code abuse, moved the technique from research to commodity. [Post](https://startwithidentity.com/blog/2026-07-14-new-phishing-kits-target-microsoft-365-accounts-evade-mfa/). - **OAuth client ID spoofing** let attackers test whether stolen Entra credentials are valid without triggering a sign-in. [Post](https://startwithidentity.com/blog/2026-07-14-oauth-client-id-spoofing-lets-attackers-validate-stolen-microsoft-entr/). ## New from Start with Identity - **Vendor internal linking is now editorial policy**: every article, guide and ranking links first mentions to the vendor profile, which we applied across 57 articles this week. - **An IAM interview questions repository** and a refresh of every [career guide](https://startwithidentity.com/guides/career/). - **A FIDO and passkey news hub**, plus depth passes on the [SAML](https://startwithidentity.com/standards/saml-2-0/), [OIDC](https://startwithidentity.com/standards/openid-connect/) and [WebAuthn](https://startwithidentity.com/standards/webauthn-fido2/) standards pages. ## From the community Corrections are welcome and credited. Send them through the [contact form](https://startwithidentity.com/contact/). That's Issue 4. [Subscribe](https://startwithidentity.com/subscribe/) for the next one.