|
Microsoft Moving MFA To Passkeys
Microsoft is moving their 365 authentication toward a passkey-first model, making passkeys the default multifactor authentication experience beginning September 1, 2026.
Users who are currently enabled for SMS or voice authentication will be automatically enabled for passkeys and prompted during their next sign-in after the change hits your organization’s tenant to register the new method that Microsoft has labelled as more phishing-resistant method. The shift, per Microsoft, is part of a push to reduce reliance on authentication methods that can be intercepted, socially engineered, or compromised through tactics such as SIM swapping.
Perhaps the more important deadline comes February 1, 2027, when Microsoft plans to retire its native SMS and voice MFA delivery in Entra ID. Organizations that still need or want to use phone-based authentication will need to move to customer-managed telecom providers through the Microsoft Security Store. Passkeys, Windows Hello for Business, FIDO2 security keys, and other phishing-resistant methods will continue to work at that time.
Due to the popularity of the phone-based methods, it is important that this information get shared with as many end users as possible so that they are aware of these changes.
| 
