The world of cybersecurity continues to evolve at an incredible pace. Attackers are becoming more sophisticated, phishing campaigns are growing more convincing, and artificial intelligence is making social engineering attacks easier to execute than ever before. As organizations work to protect their users and data, Microsoft is taking a significant step forward by accelerating the move toward phishing-resistant authentication.
Microsoft recently announced that passkeys will become the default authentication experience for many Microsoft Entra ID users and that Microsoft-provided SMS and voice authentication will be retired on February 1, 2027.
For organizations that still rely on text messages or phone calls as a primary multifactor authentication (MFA) method, this is not a change that should be ignored. While there is still time to prepare, administrators should begin evaluating their current authentication methods and planning their migration strategy now.
Why is Microsoft making this change?
For years, organizations have used SMS messages and voice calls as a second factor of authentication. While these methods are certainly better than relying on a password alone, they were never designed to withstand today’s threat landscape.
Modern attackers regularly target SMS and voice authentication through techniques such as:
- Phishing attacks
- SIM swapping
- Social engineering
- MFA fatigue attacks
- Replay attacks
When successful, these attacks can allow a threat actor to gain access to accounts even when MFA is enabled.
Microsoft has publicly stated that SMS and voice authentication are among the weakest MFA methods still in widespread use. As a result, Microsoft is moving toward authentication methods that are considered phishing resistant by design.
This is where passkeys enter the picture.
What exactly is a passkey?
If you’ve heard the term but haven’t looked into it yet, you’re not alone.
A passkey is a modern credential that replaces traditional passwords and relies on public key cryptography. Instead of typing a password and then entering a verification code from a text message, users authenticate using something they already have and trust.
Examples include:
- Windows Hello for Business
- Fingerprint readers
- Facial recognition
- Security keys
- Mobile device biometrics
The user verifies their identity using a biometric factor or device PIN, and the cryptographic process happens behind the scenes.
The result is a sign-in experience that is both more secure and often easier for end users.
What is changing?
Microsoft announced several important milestones that organizations need to understand.
September 1, 2026
Users currently enabled for SMS or voice authentication will automatically become eligible for passkeys.
Microsoft will begin prompting these users to register passkeys the next time they complete an MFA challenge.
Organizations that do not want users automatically enrolled in this process must update their Authentication Methods Policies before this date.
February 1, 2027
Microsoft-provided SMS and voice authentication services will officially retire for Microsoft Entra ID.
Organizations using Microsoft’s built-in telecom delivery methods for MFA will no longer be able to rely on them.
After February 1, 2027
Users whose only MFA methods are SMS or voice will encounter blocking prompts requiring them to register a passkey before continuing to sign in.
Importantly, Microsoft has indicated there is no opt-out mechanism for this enforcement.
The direction is clear: organizations need to move away from SMS and voice authentication.
Why passkeys are better
Whenever Microsoft introduces a major authentication change, administrators naturally ask whether the replacement is truly better.
In the case of passkeys, the answer is yes.
Traditional passwords are shared secrets. Users know them, attackers attempt to steal them, and systems validate them.
Passkeys take a different approach.
Instead of a shared secret, a cryptographic key pair is created. One key remains securely stored on the user’s device while the other resides with the service being accessed.
This provides several advantages:
Stronger protection against phishing
A passkey cannot simply be typed into a fake website.
Even if a user lands on a convincing phishing page, the authentication process is tied to the legitimate service.
Better user experience
Many users struggle with passwords.
They forget them, reuse them, or choose weak passwords.
Passkeys eliminate much of that frustration while reducing help desk calls related to password resets.
Reduced SIM-swap risk
A stolen or transferred cell phone number cannot be used to intercept a passkey authentication process.
This immediately removes one of the most common weaknesses associated with SMS-based MFA.
Improved security posture
Organizations pursuing cybersecurity insurance requirements, compliance initiatives, or Zero Trust architectures will find passkeys align well with current industry security recommendations.
What should organizations do now?
Although February 2027 may seem far away, I would strongly recommend beginning preparations now.
Waiting until the retirement deadline will likely create confusion among users and increase support calls.
Step 1: Identify affected users
The first task is understanding who is currently using SMS or voice authentication.
Many organizations enabled these methods years ago and never revisited their configuration.
A review of authentication methods within Microsoft Entra ID can quickly identify users who will be impacted.
Step 2: Enable passkeys
Organizations should evaluate the passkey options available to them.
Most Microsoft environments can leverage:
- Windows Hello for Business
- Microsoft Authenticator
- FIDO2 security keys
- Device biometrics
The right choice varies depending on security requirements, user populations, and available hardware.
Step 3: Run a registration campaign
Technology changes usually succeed or fail based on communication.
Instead of surprising users in 2027 with mandatory registration prompts, organizations should proactively educate their workforce.
Consider:
- Internal awareness campaigns
- Training sessions
- Quick-start guides
- Help desk readiness planning
The smoother the onboarding process, the higher the adoption rate.
Step 4: Review special requirements
Some organizations operate under regulatory or operational requirements that still require SMS or voice communications.
Microsoft has announced that customer-managed telecom providers will remain available through the Microsoft Security Store.
Organizations with specialized needs should monitor Microsoft’s timelines and evaluate those options before the retirement deadline.
Potential challenges
As beneficial as passkeys are, it would be unrealistic to assume every deployment will be effortless.
Organizations may encounter challenges such as:
- Legacy devices
- Shared workstation environments
- User resistance
- Authentication policy updates
- Device enrollment requirements
These challenges are manageable, but they become significantly easier to address when planning occurs well before enforcement deadlines.
Final thoughts
Microsoft’s announcement represents much more than a simple authentication update. It is another major step toward a passwordless future and a stronger security posture for organizations worldwide.
The retirement of Microsoft-provided SMS and voice authentication on February 1, 2027, gives organizations time to prepare, but that preparation should begin now. Waiting until enforcement begins could create unnecessary disruption for users and administrators alike.
My recommendation is simple: identify users currently relying on SMS or voice authentication, begin enabling passkeys, educate your users, and make the transition on your schedule rather than Microsoft’s.
Organizations that proactively adopt phishing-resistant authentication today will not only avoid future sign-in interruptions, but will also significantly improve their overall security posture moving forward.
This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.
