IT's time to call the experts.
Discover leading Managed IT Service Providers across USA, Canada & the United Kingdom.
- 100s of leading MSPs
- Find a MSP near you
- Latest IT news for SMBs
Microsoft is Retiring SMS MFA and Moving to Passkeys | Sourcepass MCOE
What happens to a user whose only sign-in method is a text message code on the day Microsoft stops supporting it? Without a plan, they will be stuck at a registration prompt instead of doing their work. Microsoft is retiring Microsoft-hosted SMS and voice multifactor authentication in Microsoft Entra ID and making passkeys the default way to sign in. The change affects how users authenticate to Microsoft 365, Azure and other business applications, and it sets firm 2027 deadlines for moving away from phone based methods. For IT teams, this means tracking the retirement dates, understanding ho
What happens to a user whose only sign-in method is a text message code on the day Microsoft stops supporting it? Without a plan, they will be stuck at a registration prompt instead of doing their work. Microsoft is retiring Microsoft-hosted SMS and voice multifactor authentication in Microsoft Entra ID and making passkeys the default way to sign in. The change affects how users authenticate to Microsoft 365, Azure and other business applications, and it sets firm 2027 deadlines for moving away from phone based methods. For IT teams, this means tracking the retirement dates, understanding how passkeys work, and moving every user off SMS and voice MFA before Microsoft does it for them. Why Microsoft Entra ID is Replacing SMS and Voice MFA with Passkeys Microsoft is replacing SMS and voice MFA because one time code can be intercepted or stolen, while passkeys use cryptographic keys that cannot be phished. On this episode of the Demystifying Microsoft podcast, Austin Kelly, Client Success Manager at Sourcepass MCOE, walks through the dates every IT team should have on their calendar and why phone based authentication no longer holds up against modern phishing. He also shares the phased approach his team uses to move users to passkeys before Microsoft makes the switch for them. Microsoft Entra ID SMS and Voice MFA Retirement Dates Microsoft hosted SMS and voice MFA in Entra ID retires for all users on February 1, 2027. Global administrators and external users with an extended timeline have until July 1, 2027. The rollout started earlier, though, and the first milestone has already passed. Date What Happens September 1, 2026 Users enabled for SMS or voice MFA became candidates for passkey registration and started seeing prompts to register during sign in February 1, 2027 Microsoft-hosted SMS and voice MFA is retired for all users July 1, 2027 Final retirement milestone for global administrators and external users who received an extended timeline If you start planning now, the change can happen on your schedule and not at the deadline. Why SMS and Voice MFA No Longer Stop Phishing Attacks SMS and voice MFA no longer stop phishing because the code itself can be stolen. Modern phishing attacks routinely intercept authentication sessions, capture tokens and bypass traditional MFA, even though organizations treated these methods as a strong control for years. Phone-based authentication has three main weaknesses. In SIM swapping, an attacker takes over a user's phone number. In social engineering, users are tricked into handing over codes. Message interception lets attackers capture codes in transit. Microsoft's position is that authentication must be phishing resistant by design. Passkeys remove the code that attackers try to steal, which shrinks the attack surface and shuts down entire categories of phishing attacks. This may be the most important identity improvement Microsoft has made since modern MFA was introduced. What is a Passkey in Microsoft Entra ID? A passkey is a phishing resistant sign in method that replaces passwords, SMS codes and voice verification with cryptographic keys tied to a trusted device. Users can register a passkey on Microsoft Authenticator, Windows Hello for Business, a mobile device or a FIDO2 security key. How does Passkey Sign-In Work? When a user signs in, Microsoft sends a challenge to the registered device. The user confirms their identity with a fingerprint, face recognition or the device PIN. The private key never leaves the device, so there is nothing for an attacker to intercept or phish. Are Passkeys Easier for Users than SMS Codes? Yes. Users no longer have to type a password, wait for a text, switch apps and copy a code. It is uncommon for a security upgrade to also make life easier for users, but passkeys do both. What Will Users See When Microsoft Prompts Them to Register a Passkey? Users who complete MFA will see a prompt asking them to register a passkey during their normal sign-in. These prompts started in September, and the registration process is simple and usually takes a couple of minutes. Microsoft is handling most of this experience, which helps the user adoption, usually the biggest worry with any authentication change. The prompts become harder to ignore once the deadline pass. If a user reaches a retirement milestone and SMS or voice is their only registered method, Microsoft can require them to register a passkey before they can continue signing in. Users who skip the prompt now will get stopped at the worst possible moment later, so talk with them early. How Should you Move Users from SMS MFA to Passkeys? Move users in four phases: discover, pilot, expand and remove the risk. Discover. Identify which users are actively using SMS and voice authentication today. Pilot. Start with IT administrators, executives and high risk users. These groups benefit most from phishing resistant authentication, and security assessments typically prioritize FIDO2 and passkey adoption for them. Expand. Roll out passkeys department by department while you monitor adoption and help desk requests. Remove the risk. Before the deadlines arrive, make sure every employee has at least one phishing resistant method registered. What if your Organization Still Needs SMS or Voice MFA? Organizations that still need SMS or voice MFA can use Microsoft's Bring Your Own Telephony Provider model. It is designed for organizations with legitimate business, regulatory or operational requirements, and it lets them buy SMS and voice delivery through an approved telephony provider instead of relying on Microsoft hosted delivery. During the initial rollout, Soprano and Telesign are the only approved providers, and Microsoft expects to add more over time. Either way, Microsoft now treats SMS and voice as exceptions, not as a primary authentication method. Plan your Passkey Rollout Before SMS MFA Retires in 2027 Microsoft's direction is clear. Passkeys are the future of authentication in Entra ID, and organizations that start early will improve security, reduce phishing risk and avoid disrupting users. Every week before February 2027 is time to work through the rollout on your terms instead of under a deadline. If you need help planning your transition or reviewing your authentication methods, contact our Microsoft experts. Subscribe to Demystifying Microsoft to stay current on Microsoft security, licensing and Entra ID changes.
Read full post on blog.sourcepass.com
MSPdb™ News
IT Managed Services in Columbus, Ohio: A Manufacturer's Guide to Choosing One
When Staff Tap Approve Without Reading: How MFA Gets Beaten
Direct Answer: An attacker who already has a password spams repeated login approval prompts until a tired employee taps approve. The password still worked. The second factor got answered by the wrong person. Your insurance renewal asked whether you had multifactor authentication turned on. You said yes, because you do. That was the right answer
Direct Answer: An attacker who already has a password spams repeated login approval prompts until a tired employee taps approve. The password still worked. The second factor got answered by the wrong person. Your insurance renewal asked whether you had multifactor authentication turned on. You said yes, because you do. That was the right answer
Read full post on adaptiveis.net
Prepare Your Tech Infrastructure to Capture Every Business Opportunity
Winning every single play in business is mathematically impossible. Prospects change their minds, market conditions shift, and unexpected operational hiccups have a habit of showing up right after a solid quarter. Because you cannot win every situation, squeezing maximum value out of the situations you do win is critical to staying profitable.When momentum swings in your favor, you need to capitalize on it immediately. Pushing high traffic or high lead volumes through broken, manual processes wastes the exact advantage you worked hard to build. Technology is what bridges the gap between tempor
Winning every single play in business is mathematically impossible. Prospects change their minds, market conditions shift, and unexpected operational hiccups have a habit of showing up right after a solid quarter. Because you cannot win every situation, squeezing maximum value out of the situations you do win is critical to staying profitable.When momentum swings in your favor, you need to capitalize on it immediately. Pushing high traffic or high lead volumes through broken, manual processes wastes the exact advantage you worked hard to build. Technology is what bridges the gap between temporary good fortune and actual, sustained revenue.
Read full post on coretechllc.com
Why Florida Backups Fail Against Ransomware: How Immutable Cloud Recovery Saves Your Business
Let us face the truth about running a business along the Florida Gulf Coast. When hurricane season rolls around, our business batted down the hatches, secured its assets, and made sure its emergency power generators were fueled up and ready ...
Let us face the truth about running a business along the Florida Gulf Coast. When hurricane season rolls around, our business batted down the hatches, secured its assets, and made sure its emergency power generators were fueled up and ready ...
Read full post on blpc.com
Stop Tech Problems Early with Regular IT Maintenance in Valley Springs
Learn how IT maintenance services help Valley Springs businesses prevent downtime, protect data, strengthen security, and reduce repair costs with RJ PRO Tech Group.
Learn how IT maintenance services help Valley Springs businesses prevent downtime, protect data, strengthen security, and reduce repair costs with RJ PRO Tech Group.
Read full post on rj-pro.net
AI Document Processing: A Small Business Guide
What AI document processing does, what it costs, where it goes wrong with sensitive data, and how to start a pilot without exposing client records.
What AI document processing does, what it costs, where it goes wrong with sensitive data, and how to start a pilot without exposing client records.
Read full post on mytekrescue.com
How to Budget Annual Technology Expenses
Learn how to budget annual technology expenses for security, support, software, and replacement planning while keeping costs predictable and controlled.
Learn how to budget annual technology expenses for security, support, software, and replacement planning while keeping costs predictable and controlled.
Read full post on priscanova.com
Are Browser-Saved Passwords Enough to Protect Your Business?
Saving a password in your browser takes one click. When you’re moving between email, accounting software, customer portals, and other tools throughout the day, that convenience adds up.
Saving a password in your browser takes one click. When you’re moving between email, accounting software, customer portals, and other tools throughout the day, that convenience adds up.
Read full post on blog.bizco.com
Cybersecurity Awareness Month 2026: A Four-Week Plan For Charter Schools
# Cybersecurity Awareness Month 2026: A Four-Week Plan for Charter Schools ## Table of contents - [Why cybersecurity awareness matters for New York ...
# Cybersecurity Awareness Month 2026: A Four-Week Plan for Charter Schools ## Table of contents - [Why cybersecurity awareness matters for New York ...
Read full post on charterts.com
Five Years as the Most-Attacked Industry: Securing Manufacturers
For the fifth straight year, manufacturing was the most attacked industry in the world. And that’s not a coincidence; it’s
For the fifth straight year, manufacturing was the most attacked industry in the world. And that’s not a coincidence; it’s
Read full post on netrio.com
Just Added to MSPdb™
MSP Jobs
All Jobs
MSP Marketplace
View All
Popular MSPs
View All
