Attackers have become very good at getting past traditional multifactor authentication. SMS codes and voice calls are now regular targets of SIM swapping, social engineering, and session interception. Microsoft is responding by retiring Microsoft-provided SMS and voice MFA in Microsoft Entra ID and making passkeys the default authentication experience across Microsoft 365, Azure, and connected business applications.

In this solo episode of Demystifying Microsoft, host Austin Kelly of the Sourcepass Center of Excellence for Microsoft covers the milestones IT leaders need on their calendars, how passkeys use cryptographic, device-bound authentication to remove whole categories of phishing attacks, and how identity threat detection and response (ITDR) adds containment and remediation inside your Microsoft 365 environment, alongside Microsoft’s native controls rather than in place of them.

What You’ll Learn:

The three key dates in Microsoft’s SMS and voice MFA retirement timeline, and who each one affects
Why phone-based authentication is no longer a sufficient security control
How passkeys work with Microsoft Authenticator, Windows Hello for Business, and FIDO2 security keys
What happens to users who reach a retirement milestone with only SMS or voice registered
A four-phase approach for moving to passkeys
How identity threat detection and response complements Microsoft Defender and Microsoft Purview

About the Host:

Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.

Episode Highlights:

00:58 Microsoft Makes Passkeys the Default in Microsoft Entra ID

Microsoft is moving away from SMS and voice as secure authentication methods. This changes how users authenticate to Microsoft 365, Azure, and business applications.

01:48 The Three Retirement Dates IT Leaders Need to Know
- September 1, 2026: SMS and voice users became candidates for passkey registration.
- February 1, 2027: Microsoft-provided SMS and voice MFA retires for all users.
- July 1, 2027: The final milestone for global administrators and external users who received an extended timeline.

03:27 Why SMS and Voice MFA No Longer Hold Up

Phone-based authentication is exposed to SIM swapping, social engineering, message interception, and token capture. This is why Microsoft is pushing organizations toward authentication that is phishing-resistant by design.

04:35 How Passkeys Actually Work

Passkeys replace shared secrets with cryptographic keys tied to a trusted device. The private key never leaves the device, and users verify with a biometric or device PIN. The result is stronger security and a simpler sign-in experience.

05:58 What Users Will Experience During the Transition

Microsoft is already prompting users to register passkeys during sign-in, and registration usually takes a couple of minutes. After the retirement dates, users with only SMS or voice registration can be required to register a passkey before they can sign in again.

07:28 A Four-Phase Passkey Rollout Plan

Discover which users rely on SMS and voice.
Pilot with IT administrators, executives, and high-risk users.
Expand department by department while monitoring help desk volume.
Remove the risk by making sure every employee has at least one phishing-resistant method before the deadlines.

08:44 Bring your own Telephony Provider for SMS and Voice Exceptions

Organizations with a legitimate business, regulatory, or operational need for phone-based MFA can buy those services through approved providers. At launch, those providers are Soprano and Telesign. SMS and voice now become exceptions rather than the default.

09:40 Adding Identity Threat Detection and Response to Microsoft 365

Microsoft’s controls protect the front door. Petra monitors what happens inside, acting when it finds a compromise: it revokes sessions, locks compromised accounts, removes malicious inbox and forwarding rules, and removes MFA methods an attacker added. It also produces detailed forensic reporting.

13:23 Three Takeaways for your Passkey Strategy
- Passkeys are the future of authentication in Microsoft Entra ID.
- Microsoft-provided SMS and voice MFA are being retired.
- Organizations that adopt passkeys early reduce phishing risk and avoid user disruption.

Episode Resources:

Facing a February 2027 deadline with users still relying on SMS or voice MFA? Connect with the Sourcepass MCOE team to identify at-risk users, pilot passkeys with your administrators and leadership, and build a phased rollout plan before Microsoft’s retirement dates arrive: https://sourcepassmcoe.com/demystifying-microsoft-contact

Austin Kelly on LinkedIn

Quotes:

“From a security perspective, this is probably the most important identity improvement Microsoft has made since the introduction of modern MFA.”
“Better security and a better user experience is a rare combination, but that’s exactly what passkeys are providing.”
“Microsoft helps protect the front door, whereas Petra helps us monitor what happens inside the building.”
“Attackers have become extremely effective at bypassing traditional multifactor authentication and targeting phone-based authentication methods.”
“Organizations should be proactive rather than waiting for the user experience to become disruptive.”