Key takeaways:

• Microsoft deadline: Starting September 2026, Entra ID defaults to passkeys, retiring SMS/voice authentication by February 2027.
• Phishing resistance: Passkeys use public-key cryptography to prevent credential theft.
• Implementation strategy: Success requires removing legacy authentication methods and securing recovery workflows, not just enabling passkeys.

For years, organisations have been told that multifactor authentication (MFA) is one of the most important things they can do to protect their users. Whilst that advice was right, the threat has moved on.

Passwords are still routinely stolen through phishing. One-time codes can be intercepted or socially engineered. SMS-based authentication can be targeted through SIM swapping and number-porting attacks. Increasingly sophisticated phishing attacks can create convincing replicas of legitimate Microsoft 365 sign-in experiences.

So, the question is no longer simply:

“Do you have MFA enabled?”

The more important question is:

“Can an attacker phish your authentication method?”

Microsoft’s answer is increasingly clear: organisations should move towards phishing-resistant authentication, and passkeys are becoming a central part of that strategy.

From 1 September 2026, Microsoft Entra ID will begin making passkeys the default authentication experience. Users currently enabled for SMS or voice authentication will be automatically enabled for passkeys and prompted to register one. Microsoft-provided SMS and voice authentication will then be retired from Entra ID from February 2027.

We think this is the right direction, but there is an important distinction between deploying passkeys and actually improving your security.

MFA changed the identity security landscape and by adding something you have, such as a phone or authenticator app, alongside something you know, such as a password, dramatically reduced the risk of a stolen password being enough to compromise an account, but some authentication methods are substantially more resistant to modern attacks than others.

If a user can be persuaded to enter a password and approve an unexpected authentication request, or provide a one-time code to an attacker, the presence of MFA doesn’t necessarily stop the attack.

This is why Microsoft is increasingly making the distinction between traditional MFA and phishing-resistant MFA.

Rather than asking a user to prove their identity by providing a secret that can be captured, a passkey uses public-key cryptography. The private key remains protected by the authenticator, while the authentication process is tied to the legitimate service.

If there is no password for a phishing site to collect and no one-time code for a user to read out to an attacker, that’s a fundamental security improvement, not simply a better MFA experience.

We’ve been helping organisations strengthen their Microsoft identity environments for years, and one lesson comes up repeatedly:

Security improvements work best when they remove opportunities for users and attackers to make the wrong choice.

It’s easy to create a policy that says “use stronger authentication”, but it’s much harder to design an identity environment where the strongest authentication method is also the easiest one to use.

A user shouldn’t have to understand FIDO2, WebAuthn, authentication strengths or Conditional Access to sign in securely. They should simply be able to prove who they are using something they already have and trust, often their device and its biometric authentication or PIN.

Microsoft supports several phishing-resistant passwordless approaches, including passkeys, Windows Hello for Business, FIDO2 security keys and other platform credentials.

The technology is increasingly mature, the challenge is now adoption.

We’ve worked with organisations implementing stronger authentication across Microsoft Entra ID, and the technical configuration is only one part of the project.

The difficult questions are usually operational:

• What happens to users who haven’t registered?
• What happens to someone who loses their phone?
• What happens when a device is replaced?
• How do administrators recover a privileged account?
• What happens to users who work across multiple devices?
• What about third-party applications?
• What about shared or specialist accounts?

And, perhaps most importantly:

• What happens to the old authentication methods?

These questions matter because deploying a passkey while leaving weaker authentication paths available can create a false sense of security.

Microsoft itself has highlighted this problem: passkeys improve sign-in security, but remaining passwords, SMS methods and weak recovery mechanisms can continue to provide attackers with an alternative route into an account.

That’s one of the biggest lessons we’ve taken from real-world deployments.

A common approach to security is additive.

Enable MFA.

Add Conditional Access.

Enable passkeys.

Keep everything else “just in case”.

That approach can leave an organisation with a remarkably complicated authentication landscape.

A stronger strategy is to think about authentication pathways.
For every user, ask: What are the ways this person can authenticate today?

Then classify them:

• Phishing-resistant
• Phishable but protected
• Legacy
• No longer required

The objective isn’t simply to increase the number of authentication methods, it’s to progressively reduce the number of ways an attacker can authenticate as that user.

There’s another area that deserves considerably more attention: account recovery.

If an organisation removes passwords and SMS authentication but the helpdesk can reset an account using relatively weak identity checks, the security boundary has moved, and account recovery becomes another authentication mechanism.

That’s why we believe a passkey rollout should always consider:

• How users register their first credential
• How additional credentials are registered
• How lost devices are handled
• How users recover access
• How privileged accounts are recovered
• How helpdesk identity verification works
• How emergency access accounts are protected
• How authentication methods are monitored and audited

Microsoft’s own guidance increasingly recognises this wider picture, recommending strong onboarding protections such as Temporary Access Pass alongside phishing-resistant authentication.

If authentication gets stronger, recovery needs to get stronger too.

Security teams sometimes worry that stronger authentication means more friction. In our experience, that isn’t necessarily the case.

If we consider the difference between:

Enter password > approve MFA notification > enter code > continue

and:

Look at your device > you’re signed in.

When properly implemented, passwordless authentication can actually make security less visible to the user.

That’s important because the best security controls are often the ones users don’t have to think about.

This is where organisations should resist the temptation to treat passkeys as simply another security project, because when done properly, it’s an opportunity to simplify authentication while making it substantially harder to attack.

The September 2026 change shouldn’t be treated as the date you start thinking about passkeys, more as a deadline that confirms the direction of travel.

Microsoft is making phishing-resistant authentication increasingly central to Entra ID. The organisation’s own Secure Future Initiative includes a goal of protecting all user accounts with securely managed, phishing-resistant MFA, and Microsoft has reported that it has already rolled this out to 99.9% of its own users and devices.

The question for organisations isn’t really whether passwords, SMS and weaker MFA methods will eventually disappear, it’s whether you’re going to design that transition deliberately or have it designed for you.

For organisations using Microsoft 365 and Microsoft Entra ID, we’d approach passkeys as part of a broader identity security programme rather than a standalone configuration exercise.

Identify who is using passwords, SMS, voice, Microsoft Authenticator, Windows Hello, FIDO2 security keys and other authentication methods.

Pay particular attention to privileged users, service accounts and users with unusual authentication requirements.

Decide which authentication methods you want different groups of users to use.

For many organisations, that could mean Windows Hello for Business for managed Windows devices, passkeys for broader scenarios and FIDO2 security keys for privileged or specialist users.

There isn’t necessarily one answer for everyone.

Start with a representative group.

Test registration, sign-in, device replacement, recovery and application compatibility.

Most importantly, learn where your exceptions are.

Don’t remove an authentication method until you understand how users will recover from losing their primary credential.

This is particularly important for administrators and other high-value accounts.

The goal isn’t simply to encourage users to register a passkey. It’s to eventually make phishing-resistant authentication the requirement for accessing the resources that matter.

Microsoft Entra Conditional Access provides the mechanism to turn that ambition into an enforceable security policy.

Registration is only one metric.

Look at actual authentication behaviour.

Then progressively remove weaker methods and unnecessary fallbacks.

That’s when the security benefit really starts to compound.

We support Microsoft’s move towards passkeys because we believe it represents something bigger than another authentication feature.

It’s a shift from asking users to prove their identity with secrets to using cryptographically protected credentials that are designed to resist the way modern attacks actually work.

But passkeys aren’t a magic switch. An organisation can deploy passkeys and still have weak recovery, excessive authentication exceptions, poorly protected administrators or legacy authentication pathways.

The real objective should therefore be broader:

Build an identity environment where phishing-resistant authentication is the normal way people access your organisation, and where the weaker alternatives are progressively removed.

This is the direction we’re already helping organisations move towards. From our experience, the organisations that get the most value from this change will be those that use passkeys as an opportunity to rethink their authentication model, rather than simply adding another authentication method to it.

If your organisation is still relying heavily on passwords, SMS or traditional MFA, now is a good time to understand what a move to phishing-resistant authentication would look like.

We can help you assess your current Microsoft Entra environment, identify the gaps, design your target authentication model and roll out passkeys in a way that balances security, user experience and operational resilience.