Why Organisations Should Start Planning for Passkeys Now
Microsoft’s decision to retire its SMS and voice authentication services for Entra ID marks another significant milestone in the move towards phishing-resistant authentication.
From February 2027, Microsoft-provided SMS and voice authentication will no longer be available, with passkeys becoming the recommended default authentication method.
For many organisations, this is a positive step. Passkeys offer stronger protection against phishing attacks, credential theft and SIM-swap fraud while also improving the user experience.
However, despite Microsoft’s messaging around passkey adoption, the reality is that implementation is not always straightforward.
More Than Just a Security Upgrade
Many organisations still rely on SMS authentication for a portion of their workforce. While enabling passkeys may be technically simple, a successful rollout often requires a wider review of identity and access processes.
Areas that may need consideration include:
- User onboarding and provisioning
- Device deployment strategies
- Authentication policies
- Shared and service account management
- User communication and training
- Support team processes
Without proper planning, organisations risk encountering user adoption challenges and increased support demands during migration.
Why Early Planning Matters
Since September 2026, eligible users have been receiving prompts encouraging them to register passkeys. While Microsoft is providing a transition period, organisations that have yet to start planning risk leaving themselves with a much larger migration project as the February 2027 retirement of Microsoft-provided SMS and voice authentication approaches.
Starting now allows security and IT teams to:
- Identify users currently relying on SMS authentication
- Establish a passkey adoption strategy
- Review authentication policies
- Update onboarding and joiner/mover/leaver processes
- Communicate changes to employees in a controlled manner
Without clear planning and communication, users could suddenly find themselves prompted to set up a new MFA method or discover that the SMS or voice authentication method they have historically relied on no longer works. This could lead to confusion, increased support requests and avoidable disruption, creating a notable productivity risk for organisations as well as an authentication challenge.
An Opportunity to Modernise Identity Security
Rather than viewing this change as a compliance exercise, organisations should see it as an opportunity to strengthen their overall identity security strategy.
Passkeys are part of a broader move towards passwordless, phishing-resistant authentication and can play an important role in reducing the risk of account compromise.
For many organisations, however, achieving that outcome requires more than simply enabling a new feature.
It requires planning, process review and user adoption support.
How ElysianIT Can Help
At ElysianIT, we’re already helping organisations assess the impact of Microsoft’s authentication changes and develop practical migration roadmaps.
Whether you’re looking to understand your current exposure, identify affected users or plan a phased move to passkeys, our team can help you navigate the transition with minimal disruption.
Want to discuss what Microsoft’s passkey-by-default approach means for your organisation?
Get in touch with our team today.
