Top Priority 2026 Detection — Phishing-Resistant MFA (FIDO2/WebAuthn) Removed an

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

Detects the removal of phishing-resistant authentication methods (FIDO2 or Windows Hello for Business) and the registration of weaker, phishable MFA methods (SMS, voice, or phone app) within Entra ID. This behavior is indicative of an attacker attempting to lower the security posture of an account to facilitate future credential theft or unauthorized access.