Microsoft Security is Changing with Passkeys: What Your Business Needs to Know

From 1 September 2026, Microsoft will begin moving users away from SMS and voice-based authentication and towards passkeys, a more secure and phishing-resistant way to verify identity. 

For businesses, this is more than another Microsoft update. It is a good opportunity to review how employees access business systems, how credentials are managed and whether your current approach provides the right level of protection against modern cyber threats. 

What is Microsoft changing?

Many businesses currently use SMS codes or telephone calls as part of Multi-Factor Authentication (MFA). While these methods provide considerably more protection than relying on a password alone, they can still be vulnerable to attacks such as phishing and SIM swapping. 

Microsoft is therefore moving towards stronger, phishing-resistant authentication, with passkeys becoming an increasingly important part of its authentication experience. 

From 1 September 2026, users currently enabled for SMS or voice authentication will automatically be enabled for passkeys. When affected users sign in and complete MFA, Microsoft may prompt them to register a passkey. 

This is the first stage of a wider transition. From 1 February 2027, Microsoft-provided SMS and voice authentication will be retired from Microsoft Entra ID. 

Businesses should use the time available to identify affected users, review their current authentication setup and prepare employees for the change.

What is a passkey?

A passkey uses cryptographic authentication rather than relying on a traditional password or one-time security code. 

Users can authenticate through trusted methods such as Windows Hello, Microsoft Authenticator or a FIDO2 security key. 

The key security benefit is that there isn’t a reusable password or authentication code that an attacker can simply trick a user into handing over. Microsoft states that passkeys are resistant to phishing, SIM-swap and replay attacks, providing much stronger protection against common methods used to compromise business accounts. 

For users, passkeys can also make signing in easier by reducing the need to remember passwords or manually enter security codes.

What about your other business accounts?

What should businesses do now and how can AMJ Help?

With Microsoft’s first changes arriving on 1 September 2026, businesses should start preparing now. 

Organisations should identify employees who currently depend on SMS or voice MFA, review their Microsoft Entra authentication configuration and establish how those users will transition to passkeys or another appropriate authentication method. 

It is also a good opportunity to review credential security across the wider business. Consider how employees currently create, store and share passwords for other systems. 

AMJ IT can help you review your Microsoft 365 and Entra ID authentication configuration, identify users affected by Microsoft’s upcoming changes and prepare your organisation for the move towards passkeys. 

We can also help you implement Keeper Enterprise Password Manager, providing employees with a straightforward and secure way to manage the passwords and credentials they still need across other business systems.