Microsoft’s SMS Cutoff Starts Tomorrow — and It’s Pulling Passkeys Into the Enterprise Mainstream

On September 1, 2026, Microsoft made passkeys the default sign-in method in Entra ID. Tomorrow, October 30, the next phase begins: administrators who still need SMS or voice authentication have to configure a third-party telecom provider through the Microsoft Security Store and pay the carrier directly.

On February 1, 2027, Microsoft-provided SMS and voice authentication shuts off altogether. There is no opt-out. Organizations on Entra ID will either move users to passkeys — which are included in every Entra plan — or pay per message through a third-party telecom integration.

Why Legacy MFA Stopped Holding Up:

Microsoft Threat Intelligence has reported click-through rates of up to 54% on AI-written phishing campaigns, up from roughly 12% for traditional lures. Once a user clicks, adversary-in-the-middle (AiTM) toolkits proxy the login session in real time, capturing both the password and the six-digit code from an SMS, voice call, or authenticator app.

Passkeys break that relay because there is no shared secret for the user to type. Because a passkey is cryptographically bound to the legitimate website's domain, a spoofed domain cannot request or receive a valid signature. Given that more than 99% of the identity attacks recorded in Microsoft's 2024 Digital Defense Report targeted passwords, removing the typed credential removes the primary point of failure.

It also cuts support overhead. Industry benchmarks consistently attribute 30% to 50% of IT help desk tickets to password resets, while reused credentials remain one of the most common entry points in enterprise breaches.

Adoption Is Outpacing Daily Habits:

According to the FIDO Alliance's State of Passkeys 2026 report, passkeys have moved well past early trials:

• 5 billion passkeys are active worldwide.
• 90% of consumers know what passkeys are (up from 75% in 2025), and 75% have enabled one on at least one account.
• 68% of organizations are piloting, rolling out, or fully deploying workforce passkeys.
• 49% of users actually sign in with a passkey regularly when given the option.

That 41-point drop between awareness (90%) and habitual use (49%) shows where most deployments stall. The infrastructure is live, but users still default to familiar prompts unless policies and login flows nudge them over.

How Major Platforms Are Forcing the Shift:

Microsoft has taken the hardest line in the enterprise, making new Microsoft accounts passwordless by default and opening Windows 11 passkey APIs to third-party vaults like 1Password and Bitwarden. Okta followed suit in September 2026 by enabling FIDO2 passkey authenticators by default in Okta Identity Engine. (Editor's note: verify your specific OIE tenant release notes before publishing.) On the consumer side, the push has been driven as much by checkout speed as by security. Amazon says more than 175 million customers have set up passkeys — signing in six times faster — and now defaults to passkeys on mobile whenever one is configured, cutting down on abandoned carts. Google made passkeys the default for personal accounts back in 2023, noting that 64% of users found them easier than passwords plus two-step verification.

For years, CISO resistance centered on ecosystem lock-in: a passkey created in iCloud Keychain couldn't easily move to Google Password Manager or an enterprise vault. To fix that, the FIDO Alliance introduced its Credential Exchange Format (CXF) and Credential Exchange Protocol (CXP), with Apple, Google, Microsoft, 1Password, and Dashlane building support for secure cross-manager transfers. Cross-platform migration still has rough edges, as ongoing API work among Apple, Google, and Microsoft shows, but a single-vendor trap is much less of a risk than it was two years ago.

Simpler Evidence for Auditors:

Moving to phishing-resistant MFA also cleans up compliance and audit prep:

• NIST SP 800–63B Rev. 4 recognizes syncable passkeys as multi-factor cryptographic authenticators at AAL2, restricts SMS-based out-of-band authentication, and drops mandatory periodic password rotation.
• CISA and federal zero-trust baselines require FIDO2/WebAuthn as the standard for phishing-resistant MFA, aligning directly with CMMC and FedRAMP requirements.
• SOC 2 (CC6.1) and ISO 27001 (Annex A 5.17, 8.5) audits get simpler when phishing-resistant MFA is enforced centrally at the identity provider, replacing folders of per-application password-policy screenshots with a single policy export.

Auditors will still look at how credentials are scoped. Synced passkeys (stored in iCloud, Google, or an enterprise password manager) fit general workforce accounts, while privileged and production access should stay on device-bound authenticators such as Windows Hello for Business, hardware security keys, or Secure Enclave.

Where Passkeys Still Fall Short:

Turning on passkeys does not secure an account if legacy fallbacks stay open. FIDO data indicates that 57% of organizations still allow phishable sign-in methods; as long as an attacker can click "Try another way" and trigger an SMS code or password prompt, the passkey is optional for the adversary too. Passkeys also only protect the authentication step — infostealer malware on an infected endpoint or a stolen post-login session cookie will bypass the login prompt entirely.

What to Do This Week:

1. Audit your tenant for every user and service account still registered for SMS or voice MFA.
2. Isolate regulatory exceptions — if a specific user group legally requires telephony authentication, select and contract a third-party telecom provider through the Microsoft Security Store now.
3. Deploy passkeys by risk tier, rolling out Microsoft Authenticator or synced passkeys to general staff and requiring Windows Hello for Business or hardware FIDO2 keys for admins.
4. Disable password and SMS fallbacks group by group as soon as users have registered a primary and backup passkey.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — -

Let me know how do you feel about our content. If you have any questions or need any assistance, you can contact us at admin@vendortrustindex.com.