This transition will culminate on February 1, 2027, when Microsoft retires its native SMS and voice authentication service, promoting the use of more secure authentication methods better equipped to deal with today’s threat landscape.
The reason for this change is clear: identity-based attacks have become one of the primary entry points used by cybercriminals. In addition, the rise of artificial intelligence is increasing the speed, scale, and sophistication of phishing and social engineering campaigns.
According to Microsoft Threat Intelligence, AI-powered phishing campaigns can achieve interaction rates of up to 54%, compared to approximately 12% for traditional campaigns. This evolving threat landscape makes digital identity protection a strategic priority for any organization.
What Are Passkeys?
Passkeys are an authentication method based on public-key cryptography that allows users to sign in without relying on passwords or SMS codes.
Unlike traditional authentication methods, Passkeys are designed to be phishing-resistant by default because they do not rely on shared secrets that can be stolen, intercepted, or reused by attackers.
Instead of entering a password or a code received via SMS, users verify their identity using biometrics, a PIN, or a compatible physical security key.
Why Is Microsoft Promoting Passkeys?
1. They Are Phishing-Resistant
Passkeys use public-key cryptography instead of passwords or temporary codes. This means attackers cannot capture or reuse credentials through fake websites or fraudulent emails.
2. They Eliminate Dependence on SMS
SMS-based authentication has been widely used as a second factor for years, but it has also become one of the most targeted methods. Passkeys completely remove this dependency.
3. They Reduce Credential Theft
Because there are no passwords or reusable codes involved, the risk of credential theft, account compromise, and social engineering attacks is dramatically reduced.
4. They Improve User Experience
In addition to being more secure, Passkeys provide a faster and simpler authentication experience, reducing user friction during sign-in.
Key Dates You Need to Know
- September 1, 2026
Microsoft will begin enabling Passkeys as the default authentication method for users who currently rely on SMS or voice-based MFA. Organizations will also be encouraged to launch internal adoption campaigns. - September 18, 2026
Microsoft will publish information about supported telecommunications providers for organizations that still need to maintain SMS or voice authentication. - October 30, 2026
Target date for organizations wishing to continue using SMS or voice calls to configure an externally managed telecommunications provider. - February 1, 2027
Microsoft will permanently retire native SMS and voice authentication provided through Entra ID. - From February 2, 2027
Users whose only MFA option is SMS or voice authentication will be required to register a Passkey in order to continue accessing their accounts. This requirement will be mandatory with no opt-out option.
What About Physical Security Keys?
Organizations with advanced security requirements can complement or deploy FIDO2 security keys, such as YubiKey and similar technologies.
These solutions use advanced cryptography and are immune to phishing attacks, SIM swapping, and temporary code theft. They are particularly valuable in regulated industries and environments where employees are not permitted to use personal mobile devices during working hours.
Ready to Leave SMS Behind?
Discover how to implement Passkeys securely and easily.