Retirement of direct MSA sign-in for Microsoft Engage Center

Note

This article will be updated shortly now that Services Hub is retired. We will provide dates for Phase 4 ase well as best practices for removing any remaining MSA users in Engage Center.

Overview

Microsoft plans to retire the ability for enterprise support customers to sign in to Microsoft Engage Center using personal Microsoft Accounts (MSA) directly. This change is part of our broader Secure Futures Initiative (SFI). The primary goal is to ensure that all user sign-ins use managed, enterprise-controlled identities. For more information on account types, see What's the difference between a Microsoft account and a work or school account?

Users who still want to use a personal Microsoft Account can access Microsoft Engage Center as guest users through Microsoft Entra External Identities, rather than using MSAs as direct sign-ins. This document outlines what's changing and describes a phased transition plan for the retirement process.

Phased retirement plan

Because we recognize that many customers need time to transition off direct sign-ins using MSAs, we're implementing this change in phases. This phased approach minimizes disruptions and makes sure customers have time to make the necessary adjustments.

The following table provides an overview of each retirement plan phase and what it entails.

Phase Key Actions & Changes Target Date
Phase 1 - Announcement Plan Initiation: We're officially announcing the retirement plan. Microsoft is updating documentation and communicating this change. Announced on 08/19/2025
Phase 2a - Partial Removal No New MSA Enablement: For existing customers, any workspace that doesn't have MSA sign-in enabled can no longer invite MSA users to their workspace.

New customers have no option to enable MSA: Any new enterprise support customers can't enable MSA as a means of accessing Services Hub.

Active MSA Users: Any workspace actively using MSA isn't affected and retains access to MSA during this time.		 Completed on 10/13/2025
Phase 2b - Disable Unused MSA Turn off Unused MSA Authentication:  If a workspace has MSA authentication enabled but has no registered MSA users, MSA authentication will be deactivated for that workspace.

Active MSA Users: Any workspace actively using MSA isn't affected and retains access to MSA during this time.		 This phase is no longer in scope and will be skipped
Phase 3 - Access Management Migration Complete transition to Microsoft Engage Center Access Management capability: Access management is migrated from Services Hub to the Engage Center platform. As Engage Center supports Microsoft Entra External Identities, all customers can use Microsoft Entra B2B for collaborating with MSA users during this time.

Begin customer migration: Once your workspace is migrated to Engage Center for access management, you need to begin moving any remaining MSA users to the Entra-based B2B model.

NOTE: New MSA users can only be added by using Entra-based B2B.

NOTE: Existing MSA users aren't able to invite new users.		 Completed in May 2026
Phase 4 - Full Removal Announcement of cut-off date: Microsoft will enable existing MSA users to continue signing in to Enage Center for 120 days after the completion of the Access Management capabilities. Once this migration is complete, a frim date will be shared for when access will be limited to Entra External Identities users.

Removal of MSA authentication: On the set date, the ability to sign in with MSA directly is fully removed from Engage Center for enterprise customers. MSA access using B2B becomes the only way for an MSA user to access Engage Center from this point forward.		 Date To Be Announced.
Once announced, it'll be at least 120 days from the announcement date.

Move to managed identities with Microsoft Entra External ID

All customers can now take advantage of a more secure alternative for scenarios where MSAs are used: Microsoft Entra External Identities (formerly Azure AD B2B collaboration). If you have users who prefer to sign in with an MSA, add them to your tenant as guest users instead of directly signing in to Engage Center using MSA.

Microsoft Entra External ID Support in Engage Center: In this model, MSA functions as the authentication identity, but only after it is invited and managed through your organization's Entra ID tenant as a guest account. Each user authenticates with their identity provider (in this case, their personal MSA sign-in), and your organization's Microsoft Entra ID tenant then checks and controls that user's access as a guest. This approach allows the continued use of MSAs without the security downsides--revoke or monitor access at any time with your Microsoft Entra tenant, and all access complies with the organization's security policies.

After Phase 4, all users will sign in with either:

  • Entra ID work accounts or
  • Entra ID guest accounts (for external collaborators, using MSAs or other accounts)

Direct use of MSAs as a sign-in type in Engage Center won't be available, but those users with those acounts instead smoothly transition to guest accounts. From an end-user perspective, they still use their MSA email to sign in--the difference lies in how the account is provisioned and managed on the backend.

How to prepare

We recommend removing any MSA users that are not needed. If you must continue to use MSA users at this time, add them to your tenant as guest users instead of directly signing in to Engage Center using MSA.

By proactively cleaning up MSA usage now, you ensure a smooth transition ahead of the retirement.

FAQs and additional information

How do I identify an MSA user in my workspace?

You can identify an MSA user in User Management following this guide.

I'm seeing a user with my organization's domain being marked as an MSA user. Is that possible?

Yes, in the past users were allowed to create personal accounts using a work email address. This is a very common scenario for organizations who have had support for a long time. These accounts are still personal accounts. Review the following list of articles for more information. The guidance in this situation is to remove these users and re-invite them so they can login with their Entra accounts.

What if my organization only uses MSAs because we don’t have Microsoft Entra ID?

After Phase 4, Microsoft Entra ID will be required to use Microsoft Engage Center. If you don’t have a Microsoft Entra tenant, reach out to your Microsoft account team to learn more about setting up Microsoft Entra for your organization’s use.

We operate in a National cloud. How do these changes affect us?

Engage Center supports access management using Azure Government Entra for individual users. Engage Center does not support using Entra Groups for Azure government.

Microsoft Engage Center doesn't directly support Microsoft Azure operated by 21Vianet. Instead, Engage Center supports Microsoft Entra B2B collaboration for external users. Organizations that use Microsoft Azure operated by 21Vianet can collaborate with Engage Center by configuring cross‑cloud B2B collaboration between their 21Vianet Entra tenant and their commercial Microsoft Entra tenant.

When cross‑cloud settings are enabled, users from a 21Vianet tenant can be invited as B2B guest users and then added to Engage Center using standard User Management flows, including direct user invitations or Entra group membership.

If Microsoft Entra B2B collaboration is not an option for your organization, at this time you can continue to utilize MSA.

Does this change affect any other Microsoft services, or just Microsoft Engage Center?

This plan is specific to Engage Center for enterprise support. It doesn't directly change anything about Microsoft accounts in other contexts. MSAs continue to work for personal services and other Microsoft offerings.

Microsoft Support for Business customers aren't affected by this change.

After this retirement, does a person still have the ability to use their personal Microsoft account (MSA) email to sign in?

Yes, but not directly. After the retirement, if someone attempts to sign in to Engage Center with an MSA, that sign in attempt won't be accepted unless that MSA was set up as a guest in a Microsoft Entra tenant.

If you invite that MSA as a guest to your directory, the user can sign in by entering that same email, but behind the scenes the authentication is happening via Microsoft Entra’s B2B guest mechanism. In summary, users continue to use the same email address, though you must configure them as external users rather than relying on the legacy direct sign-in method.

What about Microsoft Account users in Microsoft Entra B2B? Is that different?

Microsoft Entra B2B use is exactly what we encourage as the alternative starting in Phase 3. Microsoft Entra B2B allows a Microsoft Account to be used for guest sign-in in a controlled way. This change doesn’t block MSAs from being used in Microsoft Entra; it only removes the legacy, unmanaged approach of using MSAs straight in Engage Center.

Conclusion

Microsoft is committed to helping you secure your support experience. Retiring direct MSA sign-ins in favor of Microsoft Entra ID authentication is an important step to ensure that access to support resources is managed and auditable. Although change is sometimes inconvenient, this transition will significantly improve the security posture for Engage Center users by eliminating a vector of risk (unmanaged personal accounts).

We're rolling out the change in phases to give you time to adapt, and we'll support you throughout the process. Begin reviewing your users and planning for this change now. Addressing it early allows you to avoid any last-minute issues when the cut-off date arrives (to be announced in the future).

We'll continue to update our documentation with the latest information. Thanks for your cooperation in making Engage Center more secure for everyone.

More Resources:

  • Last updated on