Microsoft Is Making Passkeys the Default: Is Your Business Ready?

Last reviewed: July 2026. Details are based on Microsoft’s announcement of 13 July 2026 and current Microsoft Learn documentation. Rollout details may be refined before the deadlines.

Microsoft is beginning a significant change to how business users sign in to Microsoft 365 and other services protected by Microsoft Entra ID. From 1 September 2026, Microsoft will begin making passkeys the default authentication experience in Entra ID. Microsoft-provided SMS and voice authentication are then scheduled for retirement on 1 February 2027.

For businesses, this means stronger phishing-resistant authentication is moving from an optional improvement towards the expected standard. The important question is no longer simply whether a business uses multi-factor authentication. It is whether the authentication method itself can resist modern phishing attacks.

What happened?

Microsoft Entra ID is the identity platform used behind many Microsoft 365 business accounts. It decides how users prove who they are when they sign in. Microsoft has announced that, from 1 September 2026, it will begin making passkeys the default authentication experience in Entra ID. The rollout may reach organisations in stages, and users currently enabled for SMS or voice authentication may be prompted to register a passkey as the rollout reaches their organisation.

Microsoft-provided SMS and voice authentication are then due to be retired on 1 February 2027. Businesses that still require SMS or voice after that date may need to review the alternative, customer-managed telecom provider options that Microsoft has said it will describe. Administrators should identify which users currently rely on SMS or voice before the deadlines.

• This is primarily an authentication and identity-security change.
• It does not mean passwords universally disappear from every Microsoft service on 1 September 2026.
• It does not mean every employee automatically becomes fully passwordless on the same day.
• It should be treated as a rollout beginning from that date, not a single overnight switch for every tenant.

What is a passkey?

A password is a secret the user knows and types. A passkey uses a cryptographic credential stored on an approved device, authenticator or security key. Passkeys use public-key cryptography: the private credential remains with the user’s approved device or passkey provider, and the user normally confirms sign-in using a PIN, fingerprint, facial recognition or another local device check.

Crucially, the passkey is associated with the genuine website or service it was registered with. That makes it considerably harder to surrender a usable credential to a fake phishing page, because there is nothing memorable to type into the wrong place.

Why is Microsoft moving away from SMS and voice?

SMS and voice authentication improved security compared with passwords alone, but they are not considered phishing-resistant. Attackers have developed reliable ways around them:

• SIM-swap attacks that move a victim’s number to a criminal’s SIM
• Social engineering of mobile providers
• Intercepted or redirected messages
• Users entering codes into fake sign-in pages
• Real-time phishing proxy attacks that relay codes as they are typed
• Attackers simply persuading users to disclose authentication codes

Having SMS MFA is generally better than having no MFA at all. However, businesses should not assume that all forms of MFA provide equal protection.

Why are passkeys more resistant to phishing?

A passkey is linked cryptographically to the legitimate service. There is no reusable password or six-digit SMS code for the user to type into a convincing fake website, and a fraudulent website should not be able to request and reuse the genuine passkey credential in the same way. A local biometric or PIN normally unlocks the credential on the user’s device; the biometric itself is not sent to the website.

That does not make an account impossible to compromise. Remaining risks include:

• Compromised devices
• Weak account-recovery processes
• Poor administrator controls
• Insecure fallback methods
• Stolen authenticated sessions
• Malicious applications
• Social engineering outside the sign-in process
• Inadequate leaver procedures

Passkeys reduce a major route into an account, but they do not replace wider identity and device security.

What types of passkey may a business encounter?

Microsoft Entra ID can support different passkey approaches, subject to configuration and platform support. Depending on the environment, these may include:

• Synced passkeys held through a supported credential provider
• Device-bound passkeys
• Passkeys held in Microsoft Authenticator
• Passkeys protected through Windows Hello
• FIDO2 hardware security keys

Not every option is available or appropriate in every environment. The right choice may depend on company-owned versus personal devices, mobile-device management, shared computers, privileged administrator accounts, regulated or high-security roles, staff working patterns, recovery requirements, support capabilities and organisation policy.

What does this mean for a small business?

A business should not wait until users encounter an unexpected registration prompt. An unmanaged rollout tends to produce predictable problems:

• Users not understanding what a passkey is
• Staff registering credentials on inappropriate personal devices
• People being unable to sign in after changing phones
• Shared devices being unsuitable for a personal credential
• Unclear recovery procedures
• Administrators continuing to use weaker fallback methods
• Helpdesk demand increasing during an unmanaged rollout
• Policies allowing passkeys without deciding which types are acceptable

Consider a simple example: a member of staff replacing or losing a phone should not discover during an urgent sign-in that nobody knows how their passkey or recovery process was configured.

Does this replace MFA?

Passkeys can satisfy strong or phishing-resistant authentication requirements when correctly configured and supported. A passkey is not merely a second factor bolted onto a password: depending on the implementation, it may provide passwordless multi-factor authentication through possession of the credential plus local user verification.

However, adopting passkeys does not remove the need for an authentication policy. Businesses still need to define acceptable methods, and Conditional Access may still be required. Recovery methods must be protected, risky sign-ins and unusual activity still need monitoring, privileged accounts may require stronger controls, and legacy authentication must remain blocked where applicable.

Practical business implications

User preparation

• What a passkey is
• Which device staff should use
• Whether personal devices are permitted
• What the sign-in prompt will look like
• What to do if a device is lost or replaced
• Who to contact for help

Device ownership

Organisations should decide whether passkeys may be stored on company-managed computers, company-managed mobile devices, personal devices or hardware security keys — and record that decision before users start registering.

Recovery

Strong authentication can be undermined by weak recovery. Businesses should document replacement-device procedures, lost-device procedures, temporary access arrangements, how identity is verified before authentication is reset, and leaver and access-removal processes.

Privileged accounts

• Dedicated administrator accounts
• Phishing-resistant authentication
• Hardware security keys where appropriate
• Emergency access accounts
• Monitoring and alerting
• Avoiding routine work from privileged accounts

Questions to Ask Your IT Provider

1. 1Which of our users still rely on SMS or voice authentication?
2. 2Are passkeys already enabled in our Microsoft Entra environment?
3. 3Which types of passkey will we allow?
4. 4Can staff register passkeys on personal devices?
5. 5How will we support shared or front-desk computers?
6. 6What happens when an employee loses or replaces a device?
7. 7How will new employees register securely?
8. 8How are authentication methods removed when somebody leaves?
9. 9Do administrator accounts use phishing-resistant authentication?
10. 10Have our Conditional Access and authentication-strength policies been reviewed?
11. 11Is there a tested emergency-access procedure?
12. 12What communication and training will users receive before the Microsoft rollout reaches us?
13. 13Are any applications still dependent on older authentication methods?
14. 14Who will monitor failed registrations, unusual sign-ins and authentication changes?

The IT Club View

Microsoft’s direction is sensible. Passwords, SMS codes and approval prompts have all been repeatedly targeted by attackers because they depend heavily on the user recognising a fraudulent request. Passkeys can remove much of that burden by making the credential specific to the genuine service.

However, a secure technology can still be introduced badly. The main risk for many smaller businesses is not that passkeys are too complicated. It is that nobody takes ownership of the transition until users begin receiving prompts or SMS authentication stops working.

Businesses should use the period before February 2027 to identify affected users, agree an appropriate passkey model, test recovery and communicate the change. The goal should not simply be to comply with Microsoft’s deadline. It should be to make business accounts genuinely harder to phish.

The Operational Heartbeat

Authentication security is not a one-off project. A regular identity-security review should check for users still using weaker authentication methods, newly created accounts, administrator authentication, stale or inactive accounts, authentication-method changes, risky sign-ins, emergency-access account readiness, failed registration patterns and leaver account closure.

Strong authentication needs an operational heartbeat: it should be checked, tested and improved rather than assumed to be working forever.