Skip to content
Microsoft has begun changing how organisations authenticate through Entra ID, with passkeys becoming the default authentication experience and the retirement of Microsoft-provided SMS and voice authentication now approaching.
Since 1 September 2026, users enabled for SMS or voice authentication have been automatically enabled for passkeys and may be prompted to register one when completing MFA. The next major milestone comes on 1 February 2027, when Microsoft-provided SMS and voice authentication will be retired for most users.
For organisations still relying on these methods, the message is clear: now is the time to understand what needs to change.
Why Microsoft is moving towards passkeys
The change reflects a wider move away from authentication methods that remain vulnerable to phishing. Microsoft describes SMS and voice as significantly weaker against phishing and account compromise than passkeys, and recommends organisations move towards phishing-resistant authentication wherever possible.
Passkeys strengthen authentication without relying on users entering passwords or one-time codes that can be captured through phishing. But replacing one authentication method with another is only part of the challenge.
What changes in February 2027?
From 1 February 2027, Microsoft will stop providing native SMS and voice authentication for most Entra ID users. Global Administrators and external users will follow on 1 July 2027.
Users covered by the February retirement whose only available MFA method remains SMS or voice will be required to register a passkey during sign-in to continue accessing their account, unless their organisation has configured another supported authentication approach.
Organisations with a genuine business, regulatory or technical requirement to retain SMS or voice will have the option of using a supported telephony provider through Microsoft Security Store. Microsoft nevertheless recommends phishing-resistant methods such as passkeys instead.
Passkey readiness goes beyond deployment
The important question isn’t simply whether an organisation can enable passkeys. A successful transition also means understanding whether the wider identity environment is ready to support stronger authentication.
That includes reviewing existing authentication methods, privileged and emergency-access accounts, Conditional Access policies, recovery processes and how users and support teams will manage the transition.
For organisations still using legacy or phishable authentication methods, this is an opportunity to look beyond the immediate Microsoft change and consider the wider strength of their identity controls.
Start by understanding where you stand
The February 2027 milestone may feel some way off, but the transition has already started. Passkeys became Microsoft’s default authentication experience in September, and eligible users enabled for SMS or voice can already be prompted to register them.
Organisations should therefore understand which authentication methods are currently in use and identify where changes may be required before the next phase takes effect.
Zensec’s Identity Security Readiness Checklist sets out seven questions to help organisations assess their current position, covering phishing-resistant authentication, privileged and emergency access, Conditional Access, Device Code Flow and wider passkey rollout readiness.
Assess your identity security readiness with our seven-question checklist and identify the practical steps your organisation should consider next.
Further reading:
