6a, 57 Miller Street Murarrie QLD 4172
In brief
- Microsoft will make passkeys the default authentication method in Entra ID from 1 September 2026.
- Microsoft-provided SMS and voice authentication will be retired on 1 February 2027.
- Australian businesses should audit current MFA use, enable passkeys and allow around six months for a staged transition.
Farewell, SMS and voice authentication. We had a good run, but it’s finally coming to an end.
From 1 September 2026, Microsoft will use passkeys as its default authentication method in Entra ID, and voice authentication and SMS will be fully retired by 1 February 2027.
This means your 2022 MFA rollout may have just become a liability. Here’s what is about to change—and what your organisation needs to do.
Why is Microsoft doing this?
The move, like so much else these days, has its roots in AI. Microsoft Threat Intelligence has observed AI-driven phishing campaigns getting click-through rates as high as 54%, compared with about 12% for traditional phishing.
In other words, AI is getting seriously good at phishing, and authentication methods based on voice and SMS are much easier to target.
About one in every three business security incidents now starts with email—making phishable MFA a risk organisations can no longer ignore.
What does this mean for Australian businesses?
Phishing is a major problem in Australia. It was recorded in 60% of incidents reported to the ASD in 2024–25, while compromised accounts or credentials featured in about 42% of significant incidents.
Business email compromise now makes up about 15% of business-related cybercrime, and email compromise without direct loss adds another 19%.
What’s changing practically?
Here’s the timeline you need to be aware of:
- 1 September 2026 Passkeys become Microsoft’s default. SMS and voice users are prompted to adopt the new method.
- 1 February 2027 Microsoft-provided SMS and voice authentication is switched off across all tenants.
- After 1 February 2027 Remaining voice or SMS users must register a passkey to access their accounts.
The steps you need to take
To make sure you transition properly and in time:
- Audit who is still using SMS and voice MFA across your organisation.
- Enable passkey support in Entra ID and run a phased registration campaign.
- Train staff on device enrolment, biometrics and security keys.
- Identify any compliance-driven need for SMS or voice authentication.
Ideally, budget around six months for the full phase-out. This provides time to address roadblocks without creating unnecessary pressure.
