Microsoft Is Changing How Businesses Sign In
To combat the growing increase in identity attacks through the further sophistication of AI, Microsoft is bringing an update to its authentication experience. As of September 1, Microsoft began making passkeys the default authentication method in Microsoft Entra ID, encouraging users to adopt a more phishing-resistant way to sign in. This will greatly reduce the likelihood of phishing threats through the common SMS and voice verifications. Now users will automatically be prompted to enter a passkey when verifying through multi-factor authentication.
Beginning February 1, 2027, Microsoft will no longer provide SMS text messages or voice calls as a built-in authentication method for Microsoft Entra ID. Organizations that still need to use SMS or voice authentication will need to select a supported third-party telecom provider through the Microsoft Security Store and will be responsible for any associated costs. Microsoft recommends that businesses transition users to passkeys or another phishing-resistant authentication method before the deadline to help avoid sign-in disruptions.
What Is a Passkey?
Passkeys are becoming increasingly important by providing a simpler and faster way to sign in to everyday websites. But what exactly is a passkey and why does it matter? In simple terms, a passkey eliminates the need for a long, complicated password by using a secure method such as your face, fingerprint, PIN, or device to confirm your identity. That means fewer passwords to remember or type when signing in. Even more important, they are resistant to phishing attempts, making them much more secure than passwords.
Why Is Microsoft Moving Away From SMS and Voice MFA?
SMS and voice authentication are becoming increasingly vulnerable to phishing, SIM swapping, and MFA bypass attacks. Passkeys provide stronger protection by using public-key cryptography instead of shared secrets that attackers can steal or intercept. As AI makes phishing attacks faster and more convincing, Microsoft is encouraging organizations to adopt phishing-resistant authentication methods like passkeys to better protect user identities and reduce the risk of compromised credentials.
Learn more about how AI is changing phishing attacks and what businesses should watch for.
Are Passkeys More Secure Than Traditional MFA?
Yes. Passkeys offer stronger protection against many of the attacks that can compromise traditional authentication methods. While SMS codes, voice calls, and some other forms of multi-factor authentication (MFA) can be intercepted or manipulated through phishing and social engineering, passkeys are designed to be phishing-resistant.
Passkeys use public-key cryptography and are tied to the legitimate website or application they were created for. This makes it much more difficult for an attacker to trick a user into providing credentials through a fake login page. They also eliminate the need to type or share a one-time security code that could potentially be stolen.
For businesses, this provides an additional layer of protection against credential theft while also creating a faster and more convenient sign-in experience for employees.
What Does This Mean for Microsoft 365 Business Users?
For organizations using Microsoft 365 and Microsoft Entra ID, the shift toward passkeys means businesses should begin reviewing how employees currently authenticate their accounts.
Organizations that rely heavily on SMS or voice calls for MFA will be particularly affected. With Microsoft’s February 2027 deadline approaching, businesses that currently depend on these methods should begin evaluating their alternatives now.
Rather than waiting for the deadline, Microsoft 365 administrators can use this transition as an opportunity to evaluate their organization’s authentication policies and begin moving users toward stronger, phishing-resistant methods.
The change does not mean businesses need to transition every employee overnight. However, organizations should have a plan in place well before 2027 to minimize disruption and ensure employees can continue accessing Microsoft 365 applications and company resources securely.
What Should Your IT Team Do Now?
Businesses do not need to wait until Microsoft’s 2027 deadline to begin preparing. IT teams can start taking several steps now:
- Identify users relying on SMS or voice authentication. Determine how many employees currently use text messages or phone calls as part of their Microsoft 365 sign-in process.
- Review Microsoft Entra ID authentication policies. Evaluate which authentication methods are currently enabled and whether existing policies align with current security best practices.
- Evaluate passkey readiness. Determine which users, devices, and applications can support passkeys and identify any compatibility issues that may need to be addressed.
- Prepare employees for the change. Provide clear instructions and communication before introducing a new sign-in method. A planned rollout can help reduce confusion and support requests.
- Review account recovery procedures. Strong authentication should be paired with a reliable process for users who lose a device, replace a phone, or otherwise lose access to their credentials.
- Don’t wait until the deadline. Beginning the transition early gives organizations time to test new authentication methods, resolve compatibility issues, and gradually move employees away from SMS and voice authentication.
How Bailey Systems Can Help
Changes to Microsoft 365 security can be difficult to manage without the right IT resources, particularly when authentication policies affect every employee in an organization.
Bailey Systems can help businesses evaluate their Microsoft 365 and Microsoft Entra environments, review existing authentication and security policies, and develop a practical strategy for adopting stronger authentication methods. Our managed IT services can also help organizations address security beyond authentication, including user management, endpoint protection, monitoring, Microsoft 365 administration, and ongoing IT support.
As Microsoft continues to strengthen its identity security requirements, taking a proactive approach can help businesses reduce risk while avoiding unnecessary disruption for employees.
Need help reviewing your Microsoft 365 security? Contact Bailey Systems to talk with our IT team.
