Passwords have a fundamental weakness: if a person can type one into a legitimate website, they can also be tricked into typing it into a convincing fake website.

Microsoft is accelerating its move toward passkeys in Microsoft Entra ID. Beginning September 1, 2026, Microsoft says users enabled for SMS or voice authentication will begin being enabled for passkeys and prompted to register as the rollout reaches their organization. Microsoft also plans to retire Microsoft-provided SMS and voice authentication delivery on February 1, 2027.

This does not mean SMS MFA suddenly stops working on September 1.The change is a transition toward stronger authentication. Businesses should use the time to understand their current authentication methods and plan the migration properly.

What is a passkey?

A passkey replaces a shared password with cryptographic credentials tied to a legitimate service. Instead of giving a website a reusable secret, your device proves that it holds the correct credential. The user can typically unlock that credential with a device PIN, fingerprint or face recognition.

Because the credential is associated with the legitimate service, passkeys are designed to resist common phishing techniques that steal passwords and one-time codes.

Why should a small business care?

Microsoft 365 accounts can provide access to email, files, Teams and other business systems. A stolen account can therefore become an entry point for invoice fraud, data theft, impersonation and further attacks.

Moving users toward phishing-resistant authentication reduces dependence on passwords and SMS codes that attackers can intercept or socially engineer from users.

What should Microsoft 365 administrators do?

1. Know what you use today. Identify users still relying on SMS or voice authentication.

2. Prepare users. Explain what a legitimate passkey-registration prompt looks like before people start seeing it.

3. Test first. Consider shared computers, mobile-device policies, break-glass accounts and account-recovery procedures before broad changes.

4. Protect privileged accounts first. Administrator accounts deserve the strongest authentication available.

5. Keep recovery secure. Strong sign-in loses value if an attacker can bypass it through a weak account-recovery process.

The goal is not simply “more MFA.” The goal is authentication that is much harder to phish.

For most businesses, this is a good opportunity to review Microsoft 365 identity security rather than treating the new prompt as another user-interface change.

Source: Microsoft Learn, official guidance on SMS and voice authentication retirement and passkey transition.

Simple IT. Strong Security. — CyberEase

Need help reviewing Microsoft 365 security?

CyberEase can help simplify identity, MFA and Microsoft 365 security for your business.

Free consultation