Avoiding Sign-In Disruptions Before Microsoft’s February 1, 2027 Deadline
Did you know that in some recent AI-enabled phishing campaigns, more than half of recipients clicked a malicious link? Microsoft Threat Intelligence observed click-through rates as high as 54% compared with only 12% for more traditional campaigns.
To put it more simply, cybercriminals are using AI to make phishing messages much more convincing. Hackers can use AI to imitate familiar communications or create a fake Microsoft sign-in page. The risk arises when your business’s employees believe the AI-generated page is legitimate and hand over their password and the code sent to their phones.
This new risk matters particularly if you still use text messages or calls as the multifactor authentication step for Microsoft 365. While these methods can help improve password protection, unfortunately, employees can still accidentally enter a code into an unknowingly fraudulent page.
Microsoft is responding to this growing risk by moving Entra ID users towards passkeys, which are a passwordless sign-in method designed to resist phishing attacks. Beginning September 1, 2026, users enabled for SMS or voice authentication will be automatically enabled for passkeys and prompted to register one after completing multifactor authentication (MFA). Microsoft-provided SMS and voice delivery will then retire on February 1, 2027.
It’s critical that you identify affected users, select appropriate sign-in methods, and complete the transition before unfinished registrations disrupt access.
What’s Changing in Your Microsoft Entra ID Environment?
If users are enabled for SMS or voice, Microsoft will begin moving them toward phishing-resistant MFA methods. It’s important to note that this timeline applies to Microsoft’s public cloud, and other environments will follow separately.
| Date | What Changes | What Should You Do? |
|---|---|---|
| September 1, 2026 | Users enabled for SMS or voice are automatically enabled for passkeys and may receive a registration prompt after MFA. | Review policies, notify users, and monitor registration. |
| September 18, 2026 | Microsoft plans to publish a list of supported telecom providers, pricing, and guidance. | Review options if you have a documented need for SMS or voice. |
| October 30, 2026 | Customer-managed telecom configuration is now available through the Microsoft Security Store. | Configure and pilot a provider for approved exceptions. |
| February 1, 2027 | Microsoft-provided SMS and voice delivery retires. | Make sure affected users have registered an approved authentication method. |
| After February 1, 2027 | Users limited to SMS or voice receive a blocking passkey-registration prompt. | They must register before continuing. |
It’s possible to temporarily opt out of automatic passkey enablement during the transition. This choice is not recommended, as it doesn’t enforce the February 1, 2027 enforcement, which has no opt-out.
Why Do You Need To Move Beyond SMS and Voice Authentication?
When you use SMS or voice authentication, your protection depends on a one-time code an attacker may capture through real-time phishing. SIM swapping can also give a criminal control of the phone number receiving it.
With a passkey, Microsoft Entra stores a public key while the private key remains protected by your provider. A device-bound passkey stays on one device; a synced passkey is encrypted across supported devices—your employee signs in without transmitting the private key or entering a reusable code.
Because your passkey is tied to the legitimate website or application, a fraudulent page cannot capture and reuse it as it would a password or SMS code.
How Can Microsoft Entra Passkeys Protect Your Business?
Microsoft Entra passkeys give your users passwordless, FIDO-based credentials that they unlock with a device PIN or biometric.
Your synced options include iCloud Keychain and Google Password Manager. Device-bound options include Microsoft Authenticator, Entra passkeys on Windows, and FIDO2 security keys.
You can enable passkeys across Entra ID editions without an additional passkey license. Requiring them via Conditional Access requires Entra ID P1, which is included with plans such as Microsoft 365 Business Premium.
Your best option depends on how your employees work:
How Should Your Business Prepare for Microsoft Entra Passkeys?
1. Identify Users Enabled for SMS or Voice
Review your Authentication Methods Policy and legacy MFA settings. You can use Microsoft’s SMS and voice usage analyzer to see who is enabled and who still depends on these methods.
2. Select an Approved Authentication Method
Choose methods that fit your devices, employee workflows, compliance requirements, and recovery process. Document your standard for new employees and how existing users will migrate.
Your automatically migrated users will initially enter a profile allowing all passkey types. Review that profile if you need to limit which passkeys your employees can use.
Don’t forget to include contractors with member accounts and infrequent users. Your guest or B2B users can’t currently register passkeys in your resource tenant, so review their home-organization authentication.
3. Pilot the Sign-In Experience
Test the devices and work settings your employees use. Confirm that pilot users can register, access required applications, replace a credential, and reach support.
If you operate a health care practice, test both clinical workstations and administrative laptops. One enrollment may not represent every environment your team uses.
4. Run a Registration Campaign and Communicate Clearly
Use an Entra registration campaign to prompt targeted users after MFA. Tell your employees when it will appear, what to choose, and where to get help.
Under Microsoft-managed settings, your users can currently snooze the prompt without a fixed limit. Track completed registrations rather than assuming the prompt will move everyone before your deadline.
5. Plan for Recovery and Finish Before February 1, 2027
Passkeys do not give your employees self-service password reset or account recovery in Entra. Plan how your help desk will verify identity and restore access after someone loses a credential. A controlled Temporary Access Pass can let an authorized user register a replacement.
Keep your emergency administrative access separate and protected. Monitor adoption while you still have time to resolve exceptions.
We Make Things Easier.
A controlled migration lets you test workflows, address exceptions, and build a recovery process before an unfinished registration blocks someone from Microsoft 365.
If you need help reviewing your Microsoft 365 licensing and Entra settings, our team at High Touch can identify your affected users and help you plan a practical transition. Contact our team to discuss Managed Office 365 and Microsoft licensing support before the February 1 deadline.