For years, the password has been the front door to our digital lives. We create increasingly complicated passwords, change them when required, forget them, reset them and—despite all the effort—continue to see them compromised.
Adding multifactor authentication (MFA) made that front door considerably safer. But not all forms of MFA provide the same level of protection, and attackers have become increasingly effective at working around traditional methods such as passwords, text-message codes and voice calls.
Microsoft is now taking another significant step toward a passwordless future.
Beginning September 1, 2026, Microsoft Entra ID will make passkeys the default authentication experience. Users who are currently enabled for SMS or voice authentication will automatically be enabled for passkeys and may begin receiving prompts to register one when they sign in. Then, beginning February 1, 2027, Microsoft will retire its own SMS and voice delivery for authentication in Entra ID.
For organizations using Microsoft 365, this is a good reason to review how employees are signing in today—and to start preparing now rather than waiting for the change to arrive.
What Exactly Is a Passkey?
A passkey is a way to sign in without relying on a traditional password.
Instead of entering a secret that can potentially be stolen, shared or typed into a fraudulent website, a passkey uses cryptographic credentials associated with a user’s device or credential manager. The user typically verifies their identity using something already familiar, such as Windows Hello, a fingerprint, facial recognition or a device PIN.
That distinction is important.
Traditional passwords can be captured through phishing attacks. Even MFA codes delivered by text message can potentially be intercepted or manipulated through techniques such as social engineering and SIM-swapping.
Passkeys are designed to be phishing-resistant. Microsoft notes that they work only with the website or application for which they were created, making it much more difficult for an attacker to trick someone into providing their credentials through a convincing fake login page.
For the employee, however, the experience can actually become simpler: instead of remembering a password and then entering a second code, signing in may be as straightforward as using the same biometric or PIN they already use to unlock their device.
Why Is Microsoft Making the Change?
Cybersecurity has increasingly become an identity problem.
Attackers don’t always need to break through a firewall or exploit sophisticated software vulnerabilities. If they can convince an employee to hand over valid credentials, they may simply sign in.
MFA significantly improves security, but methods such as SMS and voice authentication are still considered susceptible to phishing and other attacks. Microsoft now describes phishing-resistant MFA as the stronger security baseline and is encouraging organizations to adopt methods such as passkeys, Windows Hello for Business and FIDO2 security keys.
Microsoft’s direction is therefore not simply about replacing one login screen with another. It represents a broader shift away from authentication methods that depend on information users can accidentally give away.
What Changes in September?
The September 1 date does not mean that everyone will suddenly lose access to Microsoft 365 or that passwords disappear overnight.
Instead, Microsoft will begin automatically enabling passkeys for users who are currently enabled for SMS or voice authentication. Those users may then be prompted to register a passkey after completing MFA.
Organizations can prepare for this experience themselves rather than leaving employees to encounter an unfamiliar prompt unexpectedly. Microsoft specifically recommends notifying users, planning the rollout and encouraging passkey registration ahead of the change.
The more significant deadline is February 1, 2027. At that point, Microsoft-provided SMS and voice authentication will be retired in Entra ID. Organizations with a legitimate operational or regulatory requirement to continue using those channels will need to consider a customer-managed telecommunications provider. For most users, Microsoft recommends moving to a phishing-resistant authentication method instead.
Five Things Organizations Should Be Doing Now
1. Find out how employees currently authenticate
Before changing anything, understand the current environment.
Which employees are still using SMS or voice calls for MFA? Who already uses Microsoft Authenticator, Windows Hello or a passkey? Are there groups of users with unique device or accessibility requirements?
Microsoft recommends identifying users who are still enabled for SMS or voice before developing a migration plan.
Without that inventory, it is difficult to know how significant the change will be for your organization.
2. Decide what your preferred authentication method will be
Passkeys aren’t limited to a single technology.
Microsoft Entra supports different approaches, including passkeys associated with devices, passkeys stored through credential managers, Windows Hello and FIDO2 security keys.
The right answer may vary depending on the organization. Employees working primarily on corporate Windows laptops may have different requirements from field workers, executives who travel extensively or contractors using personal devices.
Rather than simply turning on another authentication option, organizations should think about which method makes the most sense for each group of users.
3. Start with a pilot group
Authentication changes affect virtually everyone in an organization, which makes testing particularly important.
Start with a small group of users representing different roles, devices and working environments. Confirm that registration works properly, document common questions and identify applications or workflows that could create problems.
Once the experience is understood, rollout can expand gradually.
A phased approach also gives the IT team an opportunity to improve instructions and support before hundreds or thousands of employees encounter the same change.
4. Communicate before users see the prompt
One of the easiest ways to generate unnecessary help-desk calls is to surprise employees with a new security prompt.
Tell users what is changing, why it is changing and what they will need to do.
Microsoft itself recommends a phased communication approach: first building awareness, then asking employees to take action, followed by reminders for those who have not completed registration.
The message doesn’t need to be technical. In fact, simpler is usually better:
We’re introducing a safer and easier way to sign in. You may be asked to set up a passkey using your device. Here is what to expect and what you need to do.
Good communication turns a security initiative into a manageable business change rather than an IT surprise.
5. Look Beyond the Passkey
Introducing passkeys is an excellent opportunity to review the organization’s wider identity and access strategy.
Are administrator accounts receiving stronger protection? Are former employees being removed promptly? Are Conditional Access policies appropriate? Is account recovery secure? Are employees being granted more access than they require?
A passkey strengthens the sign-in process, but strong authentication is only one part of protecting an organization’s identities and data.
Don't Wait Until February
The February 2027 deadline may still seem comfortably distant, but authentication is not something most organizations want to change at the last minute.
The coming months provide an opportunity to inventory existing authentication methods, choose the right approach, test it with a smaller group, communicate clearly and migrate employees gradually.
And there is another benefit: organizations don’t have to wait for a Microsoft deadline to improve security.
Moving from passwords and phishable authentication methods toward passkeys can provide stronger protection while potentially making the everyday sign-in experience easier for employees.
That combination—better security with less friction—is a worthwhile goal regardless of the deadline.
At Litcom, we help organizations assess their Microsoft 365 and technology environments, identify security and operational risks, and develop practical plans for implementing change. If you’re unsure how Microsoft’s authentication changes may affect your organization, now is a good time to review your current environment and determine the right path forward.
Sources
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Microsoft Learn – Passkeys and SMS/Voice Retirement - Microsoft Learn: Phishing-resistant MFA
Microsoft Learn – Phishing-Resistant MFA - Microsoft Security Blog: World Passkey Day: Advancing passwordless authentication
Microsoft Security Blog – Advancing Passwordless Authentication
