Resources

Home / Resources / Your MFA Has an Expiry Date: What Microsoft’s Passkey Mandate Means for Australian Businesses

Your MFA Has an Expiry Date: What Microsoft’s Passkey Mandate Means for Australian Businesses

on

Farewell, SMS and voice authentication. We had a good run, but it’s finally coming to an end.

From 1 September 2026, Microsoft will be using passkeys as its default authentication method in Entra ID (its access management and identity service), and voice authentication and SMS will be fully retired by 1 February 2027.

This means your 2022 MFA rollout may have just become a liability. In this post, we’ll take a look at what’s about to happen here and what you need to do.

Why is Microsoft doing this?

The move, like so much else these days, has its roots in AI. Microsoft Threat Intelligence has observed AI-driven phishing campaigns getting click-through rates as high as 54%, compared to about 12% for traditional phishing.

In other words, AI is getting seriously good at phishing, and authentication methods based on voice and SMS are much easier to target via phishing.

What does this mean for Australian businesses?

Phishing is a big problem in Australia. It was recorded in 60% of incidents reported to the ASD in 2024-5, and compromised accounts or credentials featured in about 42% of significant incidents.

Plus, business email compromise now makes up about 15% of business-related cybercrime, and email compromise without direct loss adds another 19%.

That means about one in every three security incidents now starts with email.

These are the failure modes that are most vulnerable to phishable MFA.

What’s changing practically?

Here’s the timeline you need to be aware of:

  1. 1 September 2026 On September 1, 2026, passkeys become the default for Microsoft, and any SMS and voice users are told they need to adopt this method
  2. 1 February 2027 On 1 February, 2027, any Microsoft-provided SMS or voice authentication will be switched off entirely and enforced across all tenants
  3. After 1 February 2027 After 1 February, 2027, any remaining voice or SMS users will be forced to register a passkey to access their accounts

Source: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement (opens in a new tab)

The steps you need to take

To make sure you transition properly and in time:

  • Audit who is still using SMS and voice MFA across your organisation.
  • Enable passkey support in Entra ID and run a phased registration campaign.
  • Train staff on device enrolment, biometrics and security keys.
  • Identify any compliance-driven need for SMS or voice authentication.

Ideally, budget around six months for the full phase-out. This provides time to address roadblocks without creating unnecessary pressure.