The Latest Microsoft Updates and What They Mean for Your Business
Microsoft is changing how users sign in to Microsoft 365 and other Entra ID connected services. From 1 September 2026, passkeys will become the default authentication method, and from 1 February 2027, Microsoft's SMS and voice authentication services will be retired.
While the change may sound technical, its goal is simple, to make sign-ins more secure and easier for users. Passkeys are designed to protect against common cyber attacks and provide a smoother sign in experience using a fingerprint, face recognition, PIN or security key.
For businesses though, the biggest consideration will be ensuring users are ready for the transition.
What is actually changing?
From 1 September 2026, users who currently use SMS or voice authentication will start seeing prompts to register a passkey when they complete multifactor authentication.
Then, on 1 February 2027, Microsoft will stop providing SMS and voice authentication. Businesses that still need these methods will need to use a third party telecom provider instead.
Users who rely solely on SMS or voice authentication will eventually be required to register a passkey before they can continue signing in.
Why does it matter?
Many organisations still use SMS based MFA because it’s quick and easy to deploy. However, cyber criminals are increasingly targeting these methods through phishing and social engineering attacks.
Moving to passkeys helps to reduce this risk while also creating a simpler sign-in experience for users.
What should businesses do now?
The good news is there's plenty of time to prepare.
We recommend:
Reviewing which users still rely on SMS or voice authentication
Assessing which passkey option best suits your organisation
Running a pilot before rolling out to all users
Communicating the changes clearly to staff
Identifying any users or systems that may still need SMS or voice authentication
Starting early will help avoid disruption and reduce pressure on internal IT teams as the deadlines approach.
Key dates to remember:
1 September 2026
Passkeys begin rolling out as the default authentication method in Entra ID.
18 September 2026
Microsoft will release details of approved telecom providers and pricing.
30 October 2026
Businesses can begin selecting and configuring telecom providers if required.
1 February 2027
Microsoft provided SMS and voice authentication ends.
This is one of the biggest authentication changes Microsoft has announced in recent years, but that doesn’t mean it needs to be difficult. With some planning, businesses can strengthen security, reduce reliance on outdated authentication methods and ensure users transition smoothly.
As an accredited Microsoft partner, our expert team at ACS can help review your current setup, identify affected users and put a plan in place well before the 2027 deadline.