Phishing-Resistant MFA in Microsoft 365: Passkeys Before SMS Ends

Microsoft began making passkeys the default sign-in method in Microsoft Entra ID on 1 September 2026, and from 1 February 2027 the SMS and voice codes Microsoft provides stop working for most users. For Microsoft 365 customers, phishing-resistant multifactor authentication (MFA) has moved from best practice to a deadline. This guide explains how passkeys work, which sign-in methods actually resist phishing, and how to move users across without locking anyone out.

‍

What Is Phishing-Resistant MFA?

Phishing-resistant MFA is sign-in that cannot be tricked into working on a fake website, because the credential is cryptographically tied to the real site’s address. Passkeys (FIDO2), Windows Hello for Business and certificate-based authentication meet this bar. SMS codes, phone calls, authenticator app codes and push approvals do not.

Ordinary MFA fails against phishing for a simple reason. A fake login page collects the user’s password and code, or waits for their push approval, and passes it to the real site in real time. The attacker gets in even though MFA was switched on. CyberQuell has covered how attackers get past standard MFA in detail, and this is the pattern behind a phishing-led Microsoft 365 account compromise we investigated.

The US Cybersecurity and Infrastructure Security Agency (CISA) is direct about the options. Its fact sheet on implementing phishing-resistant MFA names FIDO/WebAuthn as the only widely available phishing-resistant authentication.

The pressure is rising. Citing the Microsoft Digital Defense Report 2025, Microsoft reports that AI-enabled phishing campaigns reached click-through rates as high as 54%, compared with about 12% for traditional campaigns.

‍

How Do Passkeys Work?

A passkey is a pair of cryptographic keys. The private key stays on the user’s device or in their passkey manager, the public key is stored by Microsoft Entra ID, and signing in means the device proves it holds the private key after the user unlocks it with a fingerprint, face or PIN.

Microsoft’s passkey documentation sets out the sign-in flow in detail. In plain terms, it works in four steps:

1. The user starts to sign in and picks a passkey, either on the same device or on a phone or security key nearby.
2. Microsoft Entra ID sends a one-time challenge to that device.
3. The user unlocks the passkey with a fingerprint, face scan or PIN.
4. The device signs the challenge with the private key, and Entra ID checks the signature against the public key before letting the user in.

Passkeys are safer than passwords because nothing reusable is ever sent to or stored by the website. Each passkey only works on the site it was created for, so a look-alike login page gets nothing it can use, and the fingerprint or face data never leaves the device.

Most accounts still keep a password for now. Once Conditional Access requires phishing-resistant MFA, though, a password on its own can no longer complete a sign-in.

‍

What Is Microsoft Changing in Entra ID, and When?

Microsoft is replacing its own SMS and voice MFA with passkeys. Passkeys became the default on 1 September 2026, Microsoft-provided SMS and voice codes retire for most users on 1 February 2027, and Global Administrators and external users follow on 1 July 2027.

Microsoft’s retirement guidance allows a temporary opt-out from the auto-enablement until 1 February 2027, but there is no opt-out from the enforcement itself. Only Microsoft-provided SMS and voice are retiring. According to the retirement FAQ, organisations with a documented need can keep SMS through a paid telephony provider instead.

Microsoft’s reason is security. In its announcement, Microsoft says passkeys use public-key cryptography instead of shared secrets, while SMS and voice depend on codes and channels attackers can intercept or manipulate.

Knowing which users still rely on SMS is the first job. Book a call with CyberQuell to review your Microsoft 365 sign-in methods and Conditional Access, then move users to passkeys before 1 February 2027.

‍

Which Microsoft 365 Sign-In Methods Are Phishing-Resistant?

In Microsoft 365, only passkeys (FIDO2, including passkeys in Microsoft Authenticator), Windows Hello for Business and certificate-based authentication count as phishing-resistant. Microsoft Authenticator push approvals, app codes, SMS and voice calls are MFA, but they can be phished.

The table maps each method to the three built-in authentication strengths Microsoft uses in Conditional Access.

The difference between the two stronger levels matters. Microsoft’s authentication strengths show that the built-in Passwordless MFA strength still allows Authenticator phone sign-in, while the Phishing-resistant MFA strength does not, so admin accounts should require the phishing-resistant one. Authenticator only reaches that level when it holds a passkey, which Microsoft describes in its guide to passkey sign-in with Microsoft Authenticator.

You enforce these strengths through Conditional Access policies, which is a core building block of any Zero Trust rollout in Microsoft 365.

‍

Device-Bound vs Synced Passkeys: Which Should Your Users Get?

Synced passkeys suit most users because they back up to the user’s Apple or Google account and are easy to recover. Device-bound passkeys and FIDO2 security keys suit administrators and regulated roles, because the key never leaves one device and can be checked with attestation.

• Device-bound passkeys are created and stored on a single physical device. Examples include passkeys in Microsoft Authenticator, Entra passkeys on Windows and FIDO2 security keys.
• Synced passkeys are stored in a cloud passkey manager, such as Apple iCloud Keychain or Google Password Manager, and work on any device signed in to that account.

Synced passkeys are also the easiest for users. Based on consumer Microsoft account data, Microsoft reports that 99% of users register a synced passkey successfully, and that sign-in takes 3 seconds instead of 69 with a password and traditional MFA.

Attestation is the deciding control for sensitive accounts. Entra ID can enforce it in a passkey profile, and when it is on, only device-bound passkeys are allowed because synced passkeys cannot be attested.

Stronger methods do not solve every identity attack. In a business email compromise where token theft bypassed app-based MFA, the attacker kept access through stolen session tokens, and the hardening that followed included FIDO2 hardware keys alongside Conditional Access. Passkeys close off the fake-login-page route, but session monitoring still matters.

‍

How to Roll Out Passkeys in Microsoft 365, Step by Step

Start with administrators, enable passkeys in the Authentication methods policy, run a registration campaign, then require phishing-resistant MFA with Conditional Access and remove SMS once adoption is high. Microsoft’s passkey deployment guide covers the detail, and the plan below puts it in order.

1. Find who still uses SMS or voice. Run Microsoft’s Entra SMS/Voice Usage Analyzer, a PowerShell script on GitHub, and put those users in a security group.
2. Check your tenant first. If your Microsoft 365 domain is still federated through GoDaddy, sign-in is handled by GoDaddy rather than Microsoft Entra ID. Move your tenant off GoDaddy federation before relying on passkeys or Conditional Access.
3. Enable passkeys. Turn on Passkey (FIDO2) under Entra ID > Authentication methods, and set passkey profiles: synced passkeys allowed for staff, attested device-bound passkeys for admins.
4. Protect administrators first. Have admins register a phishing-resistant method, then require phishing-resistant MFA for administrators with a Conditional Access policy. Exclude your emergency access accounts so a mistake cannot lock everyone out. Conditional Access needs Entra ID P1, which Microsoft 365 Business Premium and E3 include.
5. Plan onboarding and recovery. Use a Temporary Access Pass, a time-limited passcode, so new starters and users with lost devices can register a passkey without SMS.
6. Run a registration campaign. Set it to Microsoft Managed and target your SMS and voice group, so users are prompted to register at their next sign-in.
7. Communicate. Use Microsoft’s end-user communication templates for email and Teams. Slow down if help desk tickets climb.
8. Tighten. Require phishing-resistant MFA on sensitive apps, then disable SMS and voice in the Authentication methods policy. Track progress in the authentication methods activity report.
9. Handle exceptions. Document anyone with a genuine need for SMS and decide on a paid telephony provider before 1 February 2027.

Windows Hello for Business is often the smoothest option for office staff, but it depends on managed Windows devices with Intune.

‍

What Happens If a User Loses Their Phone or Security Key?

A lost synced passkey comes back when the user signs in to their Apple or Google account on a new device. A lost device-bound passkey or security key has to be replaced, usually by the help desk issuing a Temporary Access Pass after checking the user’s identity.

The simplest protection is to register at least two phishing-resistant methods per user. For most staff, that means a synced passkey plus Windows Hello for Business. For admins, it means two FIDO2 security keys kept in different places.

Passkeys also move the weak point to the help desk. Attackers phone in pretending to be a locked-out employee and ask for a reset, so recovery needs a strict process, and help desk identity checks are now part of ransomware prevention too.

Passkeys have other limits. Some older apps and protocols cannot use them, and shared or kiosk devices need planning, often with FIDO2 security keys instead of phones.

‍

Passkeys and Compliance in the UK and UAE

UK and UAE frameworks both expect strong MFA, and passkeys are the most direct way to meet that bar. In the UK, Cyber Essentials requires MFA on every cloud service, and in the UAE, privileged accounts without MFA are a recurring audit finding.

UK. Cyber Essentials Requirements for IT Infrastructure v3.3, in force from 27 April 2026, states that authentication to cloud services must always use MFA, and cloud services can no longer be left out of scope. The NCSC has also moved to recommend passkeys as the default login choice wherever they are supported, after research showing them at least as secure as the strongest password and two-step verification combination.

UAE. For organisations in Dubai, Abu Dhabi and across the Emirates, the UAE Information Assurance Standards, the framework behind National Electronic Security Authority (NESA) compliance, include an access control domain that covers MFA and privileged access. Auditors regularly flag privileged accounts without MFA enforcement, a gap covered in CyberQuell’s guide to NESA identity and access requirements. Our security assessments for UAE organisations check this alongside your Conditional Access set-up.

‍

Final Thoughts

Microsoft’s deadline is fixed: Microsoft-provided SMS and voice codes stop working for most users on 1 February 2027, and the prompts to register passkeys are already reaching your staff. Passkeys are faster for users as well as safer, so the switch is easier than most teams expect when admins move first and users hear about it early. Book a call with CyberQuell to review your Microsoft 365 sign-in methods and Conditional Access, plan the rollout, and keep watch on sign-ins for anything that still slips through. UAE organisations can start with our security assessments for the UAE.