ABOUT THIS EPISODE
Attackers have become very good at getting past traditional multifactor authentication. SMS codes and voice calls are now regular targets of SIM swapping, social engineering, and session interception. Microsoft is responding by retiring Microsoft-provided SMS and voice MFA in Microsoft Entra ID and making passkeys the default authentication experience across Microsoft 365, Azure, and connected business applications.
In this solo episode of Demystifying Microsoft, host Austin Kelly of the Sourcepass Center of Excellence for Microsoft covers the milestones IT leaders need on their calendars, how passkeys use cryptographic, device-bound authentication to remove whole categories of phishing attacks, and how identity threat detection and response (ITDR) adds containment and remediation inside your Microsoft 365 environment, alongside Microsoft’s native controls rather than in place of them.
What You’ll Learn:
- The three key dates in Microsoft’s SMS and voice MFA retirement timeline, and who each one affects
- Why phone-based authentication is no longer a sufficient security control
- How passkeys work with Microsoft Authenticator, Windows Hello for Business, and FIDO2 security keys
- What happens to users who reach a retirement milestone with only SMS or voice registered
- A four-phase approach for moving to passkeys
- How identity threat detection and response complements Microsoft Defender and Microsoft Purview
About the Host:
Austin Kelly is a Client Success Manager at Sourcepass MCOE, a company focused on helping organizations simplify, secure, and optimize their Microsoft environments. He works closely with businesses to evaluate licensing, improve security posture, and align Microsoft investments with real operational needs.
- 00:58 Microsoft Makes Passkeys the Default in Microsoft Entra ID
Microsoft is moving away from SMS and voice as secure authentication methods. This changes how users authenticate to Microsoft 365, Azure, and business applications.
- 01:48 The Three Retirement Dates IT Leaders Need to Know
- September 1, 2026: SMS and voice users became candidates for passkey registration.
- February 1, 2027: Microsoft-provided SMS and voice MFA retires for all users.
- July 1, 2027: The final milestone for global administrators and external users who received an extended timeline.
- 03:27 Why SMS and Voice MFA No Longer Hold Up
Phone-based authentication is exposed to SIM swapping, social engineering, message interception, and token capture. This is why Microsoft is pushing organizations toward authentication that is phishing-resistant by design.
- 04:35 How Passkeys Actually Work
Passkeys replace shared secrets with cryptographic keys tied to a trusted device. The private key never leaves the device, and users verify with a biometric or device PIN. The result is stronger security and a simpler sign-in experience.
- 05:58 What Users Will Experience During the Transition
Microsoft is already prompting users to register passkeys during sign-in, and registration usually takes a couple of minutes. After the retirement dates, users with only SMS or voice registration can be required to register a passkey before they can sign in again.
- 07:28 A Four-Phase Passkey Rollout Plan
- Discover which users rely on SMS and voice.
- Pilot with IT administrators, executives, and high-risk users.
- Expand department by department while monitoring help desk volume.
- Remove the risk by making sure every employee has at least one phishing-resistant method before the deadlines.
- 08:44 Bring your own Telephony Provider for SMS and Voice Exceptions
Organizations with a legitimate business, regulatory, or operational need for phone-based MFA can buy those services through approved providers. At launch, those providers are Soprano and Telesign. SMS and voice now become exceptions rather than the default.
- 09:40 Adding Identity Threat Detection and Response to Microsoft 365
Microsoft’s controls protect the front door. Petra monitors what happens inside, acting when it finds a compromise: it revokes sessions, locks compromised accounts, removes malicious inbox and forwarding rules, and removes MFA methods an attacker added. It also produces detailed forensic reporting.
- 13:23 Three Takeaways for your Passkey Strategy
- Passkeys are the future of authentication in Microsoft Entra ID.
- Microsoft-provided SMS and voice MFA are being retired.
- Organizations that adopt passkeys early reduce phishing risk and avoid user disruption.
Facing a February 2027 deadline with users still relying on SMS or voice MFA? Connect with the Sourcepass MCOE team to identify at-risk users, pilot passkeys with your administrators and leadership, and build a phased rollout plan before Microsoft’s retirement dates arrive: https://sourcepassmcoe.com/demystifying-microsoft-contact
Austin Kelly on LinkedIn
- “From a security perspective, this is probably the most important identity improvement Microsoft has made since the introduction of modern MFA.”
- “Better security and a better user experience is a rare combination, but that’s exactly what passkeys are providing.”
- “Microsoft helps protect the front door, whereas Petra helps us monitor what happens inside the building.”
- “Attackers have become extremely effective at bypassing traditional multifactor authentication and targeting phone-based authentication methods.”
- “Organizations should be proactive rather than waiting for the user experience to become disruptive.”
Demystifying Microsoft is handcrafted by our friends over at: fame.so
English
United States
TRANSCRIPT 🔗
Are you the producer of this podcast?
Add a podcast transcript
Need Audio-to-Text?
Transcribe with Listen411 in Just 60 Seconds
SEARCH PAST EPISODES
Search past episodes of Demystifying Microsoft.
OTHER EPISODES IN THIS PODCAST
Modern security teams are not short on alerts. The bigger challenge is knowing what deserves attention first and responding before an incident spreads.
In this episode of Demystifying Microsoft, Austin Kelly from Sourcepass MCOE explains how Microsoft Defender has evolved beyond traditional antivir…
Organizations tend to approach AI risk from one of two directions: restrict it heavily or encourage adoption quickly. Gabriel Friedlander, Founder and CEO of Wizer and former founder of ObserveIT, sees problems with both.
In this episode of Demystifying Microsoft, Nathan and Gabriel discuss why org…
GoDaddy can make Microsoft 365 easy to adopt when a company is small. The friction tends to appear later, when IT needs access to controls that sit outside GoDaddy’s managed experience.
In this episode of Demystifying Microsoft, Nathan Taylor sits down with Lindsay Cowan, Senior Sales and Business …
Microsoft has a habit of dropping new capabilities into subscriptions without much noise. Business Premium is no longer just a "basic" option for small teams and Austin Kelly highlights why. The most immediate gain is the increase to a 100GB mailbox, which removes a long-standing frustration for he…
For years, the AVD decision was closely tied to an Azure infrastructure decision. If you wanted Microsoft’s brokered remote desktop experience, the assumption was usually that the session hosts would live in Azure too.
AVD Hybrid changes that equation.
In this episode of Demystifying Microsoft, Nat…
Disclaimer: The podcast and artwork embedded on this page are from Sourcepass Center of Excellence for Microsoft, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.
EDIT
Thank you for helping to keep the podcast database up to date.
