Microsoft 365 Passkeys: Prepare Your Team for the SMS MFA Changes

What should your business do now?

Find the people who still use SMS or voice calls to sign in, then test a phishing-resistant replacement with a small group. Microsoft is changing the authentication experience in Entra ID, the identity service behind Microsoft 365 work accounts. A successful rollout needs working devices, clear instructions, and a recovery route for someone who loses their phone or security key.

Picture a colleague travelling to a client meeting. They replace a phone over the weekend and arrive on Monday unable to open Outlook. The office may have enabled a stronger sign-in method, but nobody explained how to recover it. That is the kind of interruption worth preventing while you still have time to test.

Which dates matter, and who is affected?

Microsoft's current retirement guidance separates ordinary users from Global Administrators and external users. The change concerns Microsoft-provided SMS and voice delivery, so avoid treating it as a ban on every authentication option other than passkeys.

Guidance checked on 24 September 2026. Confirm the current Microsoft documentation and your tenant notices before setting a change window. Where there is a genuine need to retain telephony, assess Microsoft's provider options separately rather than assuming existing text-message sign-ins will carry on unchanged.

What is a passkey, in plain English?

A passkey uses a cryptographic credential to prove that you are signing in. You unlock it with an approved device or security key instead of typing a text-message code into a website. The credential is tied to the legitimate service, which helps resist the fake sign-in pages used in phishing.

That does not make the whole account invulnerable. Device security, access permissions, recovery checks, and session protection still matter. Treat the rollout as one part of your identity security controls, with a clear owner after launch.

Choose a method people can actually use

Start with the work people do. A finance employee using one managed laptop has a different day from a warehouse supervisor moving between shared terminals. Buying the same key for everyone before checking those situations can create avoidable support work.

Use Microsoft's passkey configuration guidance to check supported devices, authentication policies, and registration requirements. A familiar product name on a purchase order is not a compatibility test.

Run a small pilot before changing everyone's sign-in

For teams split between the US and UK, assign support cover for each rollout window. A helpdesk that has finished for the day cannot rescue a colleague whose sign-in method has just changed. Record local times in the communication, along with the name of the person coordinating the rollout.

Make account recovery part of the plan

An urgent request to replace an authentication method deserves a reliable identity check. Do not let a convincing phone call become the easiest route around the new controls. The service desk needs a written recovery process, a way to escalate unusual requests, and a record of the decision.

Administrative recovery needs its own preparation. Microsoft recommends at least two emergency access accounts, protected and tested for use when normal administrator access fails. Follow that guidance with your identity administrator. Do not improvise broad policy exemptions during a busy rollout.

• Affected account groups have a named owner.
• The pilot covers the devices and applications people actually use.
• Lost-device and lost-key recovery has been tested.
• Administrators have a separately tested emergency access route.
• Users know when the change happens and where to get help.
• Exceptions have a reason, an owner, and a review date.

If those checks are still unanswered, start with a focused Entra ID and identity review. It gives the rollout a workable scope before it becomes a stream of support tickets. Businesses already reviewing Microsoft 365 support can include authentication, device management, and account recovery in the same conversation.