TLDR; Set up entra break glass accounts BEFORE something happens :)

I had a close call today. I had messed up intune authenticator deployment and my work phones authenticator was reinstalled. I could restore accounts from my iCloud backup, but all the Office accounts needed to relogin and wasnt possible with out MFA. Being a global admin, this was a huge problem. Luckily i was saved by sms authentication, but this isnt available much longer.

Creating our break glass accounts has been on my todo list for over a year, but i had "more important" things to do. This intune misconfiguration woke me up that global admin access can be lost this easily. The problem is that both global admins use iphones and this change could have made both authenticators useless.

Anyway, this is a reminder/warning to everyone who hasn't set up break glass accounts. The safest solution seems to be a security key, so dont rely on ny mobile apps.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access

Just saying upfront: I have nothing against the forced passkey rollout itself. I think it's great, long overdue and finally we can get rid of outdated practices.

However, i'm working in a highly regulated environment with loads of compartmentalised departments. Which means things sometimes move.... slowly. I just see their 1 February deadline while they're still basically properly rolling out all their passkey features and I just think 'come on man... how do i make a planning around this?'

I'm talking procedures updates, end user information, handing over from the admins to the service desks (again, highly compartmentalised).

Their features of passwordless SSPR, having passkeys as first sign up, actually showing proper registration of passkeys in the account information. Some of their features even have a completion date past their sms / voice disruption.

Am I just exaggerating here or does it just feel they don't even have their own house in order when it comes to this ?

#SanityCheck

Authentication methods | Policies Blade on Entra is coming up with Error 404 Not Found. Has something changed? We've logged under Global Admin credentials.

Edit to add these are UK tenants and on 28/10/26 appears be be OK now.

Just kind of looking for a sanity check here.

For the last 48 hours or so we are unable to dismiss risky users (or "confirm safe" for that matter). Have tried GUI and Graph Powershell.

The operation completes successfully - and shows in the audit log, but the user remains risky.

I work for an MSP and we have this issue across a dozen or so tenants. I was unable to find anybody else complaining about this.