Conditional Access and passkeys: how to move to phishing-resistant sign-in

Passkeys are becoming the default sign-in in Microsoft Entra ID, and Microsoft will stop delivering SMS and voice codes itself. The published timeline is as follows: since 1 September 2026, users enabled for SMS or voice are automatically enabled for passkeys and prompted to register one, unless the tenant has used the temporary opt-out. From 1 February 2027, Microsoft-provided delivery ends for all users except Global Administrators and external users, for whom it ends on 1 July 2027. Anyone who still only has SMS registered by then must register a passkey at the next sign-in before they can continue.

For management, this means the change will happen either way. Planning decides whether staff switch over in waves or whether the switch lands on the help desk.

What is a passkey?

A passkey replaces the password with a key pair. The private key stays on the employee’s device, for example a smartphone or a small USB security key, and is unlocked with a fingerprint, face recognition or a PIN. At sign-in, the device checks whether it is really talking to the genuine Microsoft sign-in page. On a copied page, it does not release the key.

Why can SMS and app codes be relayed?

Because a code does not know where it is being entered. In an adversary-in-the-middle attack, a fake page sits between the user and Microsoft. The user enters password and code, the page forwards both in real time and receives the signed-in session. This works with SMS, with codes from an authenticator app and, in principle, with push approvals as well. Our webinar recording shows how such attacks play out in Microsoft 365 and what helps against them.

Phishing-resistant methods break this chain because the sign-in is cryptographically bound to the address where it happens.

Which phishing-resistant methods does Microsoft Entra ID offer?

Entra ID supports four phishing-resistant methods. The choice depends on your devices and on the role.

• Passkeys in Microsoft Authenticator. Device-bound passkeys on the company phone. The obvious starting point for most staff.
• FIDO2 security keys. Hardware keys via USB or NFC. Suitable for administrators, emergency access accounts and people without a company phone.
• Windows Hello for Business. Sign-in to the Windows device by face, fingerprint or PIN, which also serves as phishing-resistant proof for Entra ID. Deployed through Microsoft Intune.
• Certificate-based authentication. Useful if a public key infrastructure and smart cards are already in place.

Passkeys can be used in all Entra ID editions without an additional licence. Enforcement through Conditional Access and the reporting require Entra ID P1. Passkey profiles in the authentication methods policy let you control which passkey types are allowed for which group, for example only device-bound passkeys for administrators.

How do you enforce passkeys with Conditional Access?

Through authentication strengths. Instead of “Require multifactor authentication”, you select “Require authentication strength” in the policy and choose the built-in “Phishing-resistant MFA” strength. It covers Windows Hello for Business, FIDO2 passkeys and certificate-based authentication. The two grant controls cannot be combined in the same policy.

Create a report-only policy with this strength for all users (excluding emergency access accounts) early on. The sign-in log then shows who would already pass and who would not. Enforcement follows group by group, separated by platform: first for Windows users who are ready, then for iOS, Android and macOS. We describe how to introduce Conditional Access without lockouts in Rolling out Conditional Access without locking out your staff.

How do employees register their first passkey?

Existing users register the passkey under “Security info” using their current MFA. For new staff and for people who have lost their device, there is the Temporary Access Pass (TAP), a time-limited code issued by IT after identity verification. With a TAP, new employees set up their first passkey or Windows Hello for Business without having to know a password first. You define validity and single use in the TAP policy.

The registration campaign in Entra ID prompts users to set up a passkey after their next MFA sign-in. Combine it with communication in waves: announcement, instructions per device type, reminder before enforcement.

In what order should you migrate?

1. Emergency access accounts get FIDO2 security keys and are excluded from the policies.
2. Administrators move to phishing-resistant methods and are required to use them through an authentication strength.
3. Pilot group drawn from different departments and device types.
4. All staff in waves by platform, guided by the report-only analysis.

If help desk tickets rise, slow down.

What about shared devices and frontline workers?

Windows Hello for Business is intended for devices where each person signs in with their own account, not for kiosk devices with a shared account. For shift workstations, warehouses and production, FIDO2 security keys are usually the better choice: the person carries the key and signs in on any approved device. Decide early who issues keys and how loss is handled.

What happens to the password afterwards?

The password does not disappear immediately, but it loses its importance. Once a policy requires phishing-resistant MFA, a stolen password alone no longer grants access. For the transition we recommend self-service password reset (SSPR), so forgotten passwords do not end up at the help desk, and a clear process for lost devices using the TAP.

Is Token Protection a useful complement?

Yes, as a next step. Once credentials can no longer be intercepted, attackers turn to stealing issued session tokens. Token Protection, a session control in Conditional Access, only accepts tokens that are bound to the device they were issued to. It is generally available for native applications such as Outlook, Teams and OneDrive on Windows. Support for browser-based applications is in preview (as of October 2026).

What evidence does the auditor need?

The “Authentication methods activity” report in Entra ID shows how many users have registered which method and which methods are actually used. Add the export of your Conditional Access policies with authentication strengths and extracts from the sign-in logs. Entra ID retains most audit data for only 30 days. For audits, forward the logs to a Log Analytics workspace or Microsoft Sentinel.

Frequently Asked Questions

Does moving to passkeys require additional licences?

Registration and sign-in with passkeys are included in all Entra ID editions. Enforcement through Conditional Access and the reports require Entra ID P1, for example through Microsoft 365 Business Premium. Costs may arise for FIDO2 security keys.

What happens on 1 February 2027 to users who only have SMS?

They can no longer use SMS or voice to sign in unless the organisation has connected its own telephony provider. At the next sign-in they must register a passkey before they can continue. For Global Administrators and external users, the date is 1 July 2027.

Are synced passkeys suitable for businesses?

For regular users they can be a good choice, because they are available on several of the user’s own devices. For administrators and particularly sensitive roles, we recommend device-bound passkeys or security keys. Passkey profiles let you control this per group.

How long does the migration take?

That depends on your devices, sites and shift patterns. A reliable schedule emerges from the report-only analysis, which shows how many users and devices are already ready.

The next step

In our fixed-price Gap Assessment, we review which authentication methods are registered in your tenant, who still depends on SMS and which policies are missing. If you wish, we take over day-to-day operation, sign-in log analysis and the response to suspicious sign-ins as part of Managed Security.

Book an introductory call