Microsoft is taking another major step toward a passwordless future. The company has announced that Microsoft Entra customers will be required to adopt passkeys starting in February 2027, marking the beginning of the end for traditional SMS and voice-based Multi-Factor Authentication (MFA).
The move reflects Microsoft’s growing concern that SMS codes and voice-based authentication are no longer sufficient against today’s increasingly sophisticated cyberattacks, especially those powered by artificial intelligence.
As AI tools make phishing campaigns faster, more convincing, and easier to scale, Microsoft believes that passkeys offer a significantly stronger and more user-friendly alternative.
Why Microsoft Is Moving Away from SMS and Voice MFA
For years, SMS verification codes and phone call authentication have served as the most common forms of MFA. While they provide an extra layer of protection over passwords alone, attackers have become increasingly successful at bypassing them.
Some of the most common attack methods include:
- SIM swapping attacks
- Real-time phishing kits
- MFA fatigue attacks
- Social engineering
- AI-generated phishing websites and messages
- Voice cloning attacks targeting phone verification
According to Microsoft, these threats have become increasingly effective because AI enables attackers to automate and personalize phishing campaigns at an unprecedented scale.
Passkeys Are the Future of Authentication
Instead of relying on passwords or one-time codes, passkeys use public-key cryptography combined with device-based authentication.
Users simply authenticate with:
- Fingerprint
- Face recognition
- Device PIN
- Security key
The private authentication key never leaves the user’s device, making passkeys resistant to phishing and credential theft.
Unlike SMS codes, attackers cannot trick users into sharing a passkey because there is no reusable authentication code to steal.
Microsoft Entra Customers Must Prepare Before February 2027
Beginning February 2027, Microsoft Entra organizations will need to transition away from SMS and voice authentication toward passkeys.
This affects organizations using Microsoft Entra for:
- Employee authentication
- Enterprise identity management
- Conditional Access
- Zero Trust security
- Microsoft 365 authentication
- Azure-based identity services
IT administrators should begin planning migrations well before the deadline to ensure users are enrolled with supported passkey providers and compatible devices.
Why AI Has Changed Microsoft’s Security Strategy
The rise of generative AI has fundamentally changed the cybersecurity landscape.
Attackers can now create:
- Highly personalized phishing emails
- Fake login pages
- Convincing voice calls
- AI chatbots impersonating IT support
- Automated credential harvesting campaigns
Traditional authentication methods were not designed to defend against these AI-powered attacks.
Microsoft believes phishing-resistant authentication methods such as passkeys are now essential for enterprise security.
Benefits of Passkeys
Microsoft says organizations adopting passkeys can expect several security and usability improvements.
Stronger Security
- Resistant to phishing attacks
- No passwords to steal
- No SMS interception
- Reduced credential theft
Better User Experience
- Faster sign-in
- No OTP codes
- Biometric authentication
- Less password fatigue
Lower IT Costs
Organizations may also benefit from:
- Fewer password reset requests
- Reduced help desk workload
- Improved user satisfaction
- Better compliance with Zero Trust initiatives
What Organizations Should Do Now
With the February 2027 deadline approaching, Microsoft recommends organizations begin their transition as early as possible.
Key preparation steps include:
- Enable passkey support in Microsoft Entra.
- Educate employees about passwordless authentication.
- Verify that user devices support passkeys.
- Update Conditional Access policies.
- Reduce reliance on SMS and voice authentication.
- Test enterprise applications for passkey compatibility.
Starting early will help organizations avoid disruptions while improving overall security.
The Bigger Industry Shift
Microsoft is not alone in moving toward passkeys.
Major technology companies including Apple, Google, and many enterprise security vendors have embraced passkeys through the FIDO Alliance standards, promoting passwordless authentication as the long-term replacement for passwords and legacy MFA methods.
The latest Microsoft announcement reinforces the industry’s broader transition toward phishing-resistant authentication.
Final Thoughts
Microsoft’s decision to require passkeys for Microsoft Entra customers beginning in February 2027 represents one of the company’s most significant authentication changes in years.
As AI-assisted cyberattacks become more advanced, relying on SMS messages or voice calls for account protection is no longer considered sufficient for enterprise environments.
Organizations that begin adopting passkeys now will be better positioned to improve security, reduce phishing risks, and align with Microsoft’s long-term passwordless vision.
Frequently Asked Questions (FAQ)
When will Microsoft require passkeys?
Microsoft plans to require passkeys for Microsoft Entra customers beginning in February 2027.
Why is Microsoft replacing SMS MFA?
SMS and voice authentication are increasingly vulnerable to phishing, SIM-swapping, social engineering, and AI-assisted attacks.
What is a passkey?
A passkey is a phishing-resistant authentication method based on public-key cryptography that uses biometrics, a device PIN, or a hardware security key instead of passwords or SMS codes.
Will passwords disappear immediately?
No. The transition will happen over time, but Microsoft is encouraging organizations to adopt passwordless authentication well before the 2027 requirement.
