Preparing for Passkeys in Microsoft Entra: What Small Businesses Need to Know

Microsoft Entra is moving towards a more secure sign-in experience by making passkeys the default authentication method on September 1, 2026, and retiring Microsoft-provided SMS and voice multi-factor authentication (MFA) on February 1, 2027. These changes will affect how your staff access Microsoft 365 and related services. Small businesses need to understand what this means, make decisions about authentication options, and prepare employees before these changes arrive.

Why This Matters to Small Businesses

Authentication methods are a critical part of your business's security posture. Passkeys offer stronger protection than text-message or voice call codes, which are increasingly targeted by phishing and interception attacks. The upcoming changes from Microsoft will require organizations to update their sign-in processes and ensure all staff are ready for a new way to log in. Planning ahead will help avoid confusion, reduce support issues, and maintain secure access to business data.

What Are Passkeys and Why Are They Replacing SMS/Voice MFA?

Passkeys are a modern, phishing-resistant authentication method that uses device-based credentials (such as biometrics or device PINs) instead of relying on codes sent by text or voice. Unlike SMS or voice MFA, passkeys cannot be easily intercepted or tricked by attackers. Microsoft is making this change to improve security for all users. After February 1, 2027, Microsoft-provided SMS and voice codes will no longer be available for sign-in, so businesses need to transition to passkeys or other supported MFA methods before that date.

Recommended Steps for Small Businesses

• Review your current MFA setup: Identify which users rely on SMS or voice codes and which already use app-based or hardware authentication.
• Decide on your authentication strategy: Determine if you will use passkeys only, or a combination of supported MFA options (such as app-based notifications or hardware security keys).
• Communicate early with staff: Let employees know about the upcoming changes and what to expect, especially those who may be less comfortable with technology.
• Plan for training: Schedule time to demonstrate how to register and use passkeys, and provide simple step-by-step guides.
• Update internal documentation: Make sure your sign-in instructions reflect the new authentication process before September 2026.
• Test the process: Have a small group of users try registering passkeys early and gather feedback to improve your rollout plan.
• Monitor for issues: Be ready to support staff who encounter challenges and adjust your approach as needed.

How NIS Helps Manage the Transition

NIS stays current with Microsoft security changes and helps small businesses plan for smooth transitions. We assist with reviewing your existing authentication setup, recommending the best mix of MFA options for your organization, and providing clear communication and training resources for your staff. Our team can guide you through the technical steps of enabling passkeys, updating policies, and supporting users as they adapt to the new sign-in experience. By preparing early, your business can avoid disruptions and maintain strong security as Microsoft phases out SMS and voice MFA.

Change is easier with the right support. If you have questions about Microsoft Entra passkeys or want help planning your transition, NIS is here to assist your business every step of the way.