AI-Powered Security Awareness Training can help organizations prepare employees for Microsoft’s move toward passkeys in Microsoft Entra ID. On October 28, 2026, BleepingComputer reported that Microsoft had reminded administrators to migrate users to phishing-resistant authentication methods before Microsoft-provided SMS and voice authentication services begin retiring in February 2027. The change has implications for identity security, employee onboarding, authentication policies, and the way organizations prepare users for new sign-in procedures.<\/p>\n
Microsoft is moving Entra ID toward passkeys as the default authentication experience, reducing dependence on phone-based authentication methods that can be vulnerable to phishing and SIM-swapping attacks.<\/p>\n
According to Microsoft’s official announcement<\/a>, the rollout began on September 1, 2026. Users previously enabled for SMS or voice authentication are being enabled for passkeys and prompted to register one during a subsequent multifactor authentication sign-in. Microsoft-provided SMS and voice authentication is scheduled to retire for most users on February 1, 2027, with separate arrangements for Global Administrators and external users.<\/p>\n The change applies to Microsoft Entra ID workforce identity scenarios. Organizations should review Microsoft’s current guidance to determine how the timeline affects their particular users and authentication configurations.<\/p>\n For administrators, the priority is to identify affected accounts, prepare compatible authentication methods, and communicate the transition before users encounter unexpected sign-in requirements.<\/p>\n Traditional passwords can be stolen through fake login pages, reused across services, or exposed through data breaches. SMS and voice authentication provide an additional verification step, but they are not immune to social engineering, phone-number takeover, or telecommunications-related attacks.<\/p>\n Passkeys use public-key cryptography rather than relying on a password that users enter into a website. Authentication typically involves a device-based action, such as a biometric check, PIN, or security-key interaction. The private key remains protected by the authenticator, while the service verifies authentication using the corresponding public key.<\/p>\n A key security advantage is phishing resistance. Properly implemented passkeys are tied to the legitimate service’s identity, making them substantially harder to use on an impostor website than conventional passwords or one-time codes.<\/p>\n However, passkeys do not eliminate every identity risk. Compromised devices, weak account-recovery processes, malicious consent grants, session theft, and poorly configured access policies can still create opportunities for attackers. Organizations should treat passkeys as a strong authentication control within a broader identity-security strategy.<\/p>\n Organizations that rely exclusively on Microsoft-provided SMS or voice authentication for affected multifactor authentication workflows may face sign-in disruption if they do not prepare before the applicable retirement date.<\/p>\n Microsoft’s guidance identifies several practical priorities:<\/p>\n Microsoft Entra ID supports both synced passkeys and device-bound passkeys. Synced passkeys can be available across compatible devices through a credential provider, while device-bound passkeys remain associated with a particular device or authenticator. The appropriate choice depends on organizational security requirements, device management, and user workflows.<\/p>\n Microsoft Security Blog+1<\/p>\n Administrators should also plan for exceptions. Some users may have older devices, accessibility requirements, shared-workstation workflows, or limited access to approved authenticators. These situations should be addressed before enforcement rather than left until users encounter a blocked sign-in.<\/p>\n Technical configuration is only one part of an authentication migration. Employees need to understand what is changing, how to register their passkeys, and how to distinguish legitimate authentication prompts from attempts to steal their credentials.<\/p>\n A well-planned rollout should include the following steps.<\/p>\n Use Microsoft Entra administrative tools to identify accounts enabled for SMS or voice authentication. Segment users by role, device type, business unit, and access requirements where appropriate.<\/p>\n Prioritize privileged accounts and other sensitive access paths, while ensuring that frontline workers, remote employees, contractors, and other affected users receive suitable migration support.<\/p>\n Pilot the process with a representative group of employees. Confirm that users can register an approved passkey, authenticate successfully, and recover access through the organization’s established procedures.<\/p>\n Document common issues and provide clear instructions. A successful technical pilot should test both the authentication configuration and the employee experience.<\/p>\n Employees should know why the organization is introducing passkeys, when registration is expected, which devices or authenticators are supported, and where to obtain help.<\/p>\n Communications should also explain that legitimate registration prompts may appear during sign-in. Employees should never be encouraged to approve unexpected authentication requests or disclose verification codes to someone claiming to be IT support.<\/p>\n Passkeys reduce exposure to several credential-phishing techniques, but employees still need to recognize suspicious requests, impersonation attempts, and fraudulent account-recovery messages.<\/p>\n Security Awareness Courses<\/a> can explain the difference between an approved authentication workflow and a suspicious request that uses urgency or authority to pressure an employee into taking action.<\/p>\n Passkeys strengthen authentication, but attackers can still target the people and processes surrounding account access. An employee might receive a fraudulent IT message requesting that they scan a QR code, install an unapproved application, call a supposed help desk, or follow a link to resolve an account problem.<\/p>\n The migration itself can become a subject for social engineering. Attackers may exploit uncertainty about new login procedures by impersonating administrators or sending fake registration instructions. This is a potential risk to prepare for, not evidence that the current Microsoft rollout has caused a confirmed phishing campaign.<\/p>\n Organizations should teach employees to:<\/p>\n Security awareness should complement technical safeguards, including Conditional Access policies, appropriate privileged-access controls, device security, monitoring, and tested account-recovery procedures.<\/p>\n AI-Powered Security Awareness Training<\/a> can help organizations turn authentication changes into practical learning opportunities. Instead of relying only on a policy announcement or a one-time course, security teams can reinforce the behaviors employees need throughout the migration.<\/p>\n For example, a training program could explain how to verify unexpected IT support requests, recognize fraudulent passkey registration instructions, and report suspicious login communications. Content should reflect the organization’s actual authentication procedures and the threats employees are likely to encounter.<\/p>\n Cyberfrog provides an AI-powered security awareness and human risk management platform that combines training, simulations, and reporting. Its 3D Security Awareness Training<\/a> offers interactive scenarios in which employees can practice security decisions in a controlled environment.<\/p>\n Organizations can use relevant security awareness lessons about phishing and social engineering to reinforce verification habits without implying that training alone can prevent every identity attack.<\/p>\n A migration plan should measure more than the number of employees who have completed registration instructions or attended training.<\/p>\n Useful indicators include:<\/p>\n These indicators measure different outcomes. Training completion does not prove that employees will recognize every fraudulent message, while successful passkey registration does not establish that an organization’s entire identity environment is secure.<\/p>\nWhy Microsoft Is Encouraging Passkey Adoption<\/strong><\/h2>\n
What Happens If Organizations Delay the Migration?<\/strong><\/h2>\n
\n
How to Prepare Employees for Passkey Adoption<\/strong><\/h2>\n
\n
\n
\n
\n
Why Passkeys Still Require Security Awareness Training<\/strong><\/h2>\n
\n
How AI-Powered Security Awareness Training Supports the Transition<\/strong><\/h2>\n
Measuring Whether Employees Are Ready<\/strong><\/h2>\n
\n