The shift will affect organisations whose employees still rely on text messages or telephone calls for multifactor authentication. As Microsoft’s rollout reaches individual organisations, users enabled for SMS or voice authentication will automatically become eligible for passkeys. They will then be prompted to register a passkey when they next complete an MFA challenge.
Microsoft is not eliminating every possibility of using SMS or voice authentication after the February deadline. Instead, it will stop providing telecom delivery for those methods as a native Entra ID capability. Organisations that have operational, regulatory or accessibility reasons for retaining them will need to use customer-managed telecom providers available through the Microsoft Security Store.
The distinction is significant for administrators planning the migration. Existing authentication policies may continue to permit SMS or voice, but Microsoft will no longer deliver the codes or calls itself after February 1. Customers choosing external providers will also become responsible for the associated telecom charges.
Microsoft plans to provide further information on customer-managed telecommunications options from September 18, giving administrators several months to identify affected accounts, evaluate alternatives and revise authentication policies before the native service is withdrawn.
Passkeys use public-key cryptography rather than transmitting a reusable password or temporary code. A private credential remains protected on a user’s device or credential manager, while the service retains a corresponding public key. Authentication can typically be authorised using a fingerprint, facial recognition or the device’s PIN.
The architecture makes passkeys resistant to conventional phishing because the credential is cryptographically associated with the legitimate website or application. A fraudulent website cannot simply capture a passkey and replay it against the authentic service, a weakness that continues to affect passwords and some forms of traditional MFA.
SMS and voice authentication remain substantially safer than using a password alone, but attackers have developed increasingly effective techniques for defeating them. These include SIM swapping, social engineering of mobile operators, interception of messages and phishing systems capable of collecting one-time codes and immediately relaying them to genuine login pages.
Artificial intelligence has added another dimension by allowing attackers to produce personalised phishing messages at scale. Microsoft has observed markedly higher interaction rates for AI-assisted phishing campaigns than for conventional campaigns, strengthening the company’s argument that enterprises need authentication mechanisms that do not depend on users recognising fraudulent prompts or websites.
The Entra ID change forms part of a broader industry movement towards passwordless authentication. Apple, Google and Microsoft have promoted passkeys through standards based on FIDO2 and WebAuthn, while browsers, mobile operating systems, password managers and hardware security keys increasingly support the technology.
Microsoft has already been expanding passkey deployment across its consumer and enterprise products. New Microsoft consumer accounts became passwordless by default in 2025, while Entra administrators gained additional tools for encouraging workforce users to register passkeys.
Usage data from Microsoft’s consumer services has also pointed to usability advantages. Passkey sign-ins have achieved success rates of about 98%, compared with roughly 32% for password-based attempts, and have been measured as considerably faster than workflows requiring a password followed by a separate MFA challenge.
For enterprises, however, migration involves more than enabling a new authentication button. Administrators need to identify users dependent on SMS and voice, confirm that compatible devices are available, establish account-recovery procedures and address circumstances involving shared devices, contractors or employees who cannot use biometric authentication.
Passkeys do not require biometric information to be transmitted to Microsoft. Fingerprint or facial recognition normally occurs locally on the user’s device and unlocks the cryptographic credential. A device PIN can also perform that role, depending on the platform and configuration.
Organisations can also retain other phishing-resistant authentication technologies. Windows Hello for Business and FIDO2-compatible hardware security keys remain available alongside passkeys, allowing enterprises to design authentication policies around different workforce and security requirements.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
