A password alone is no longer enough to protect a Microsoft 365 account, but even traditional multifactor authentication can leave users exposed to sophisticated phishing attacks. As attackers become better at stealing passwords, codes, and authentication approvals, businesses need a stronger approach to identity security. KIS Technologies Inc. offers Microsoft 365 and cybersecurity solutions that can help businesses adopt stronger, phishing-resistant authentication.
For Microsoft 365 administrators, the question in 2026 is not whether MFA should be enabled, but which authentication methods provide the strongest protection. Passkeys are emerging as a key part of the solution, offering phishing-resistant security while making the sign-in process easier for employees.
What Is the Difference Between Passkeys and MFA?
Multifactor authentication, or MFA, protects accounts by requiring users to provide more than one authentication factor. A common example is entering a password and then approving a notification through Microsoft Authenticator or entering a verification code sent by SMS.
Passkeys use a different approach. They rely on public-key cryptography and are designed to prevent attackers from stealing and reusing authentication credentials through phishing. Microsoft describes passkeys as phishing-resistant credentials that can also satisfy MFA requirements when combined with a PIN or biometric authentication.
For businesses reviewing their Microsoft 365 and cloud services, this distinction is becoming increasingly important. MFA is still an important security control, but administrators should consider the specific authentication method being used rather than treating every form of MFA as equally secure.
Why Traditional MFA Is No Longer Enough
Traditional MFA provides significantly more protection than password-only authentication, but some methods can still be targeted by attackers. Phishing websites can trick employees into entering passwords and one-time codes, while repeated push notifications can be used to pressure users into approving fraudulent sign-in requests.
Microsoft’s current Entra ID guidance recommends phishing-resistant authentication methods such as passkeys, Windows Hello for Business, and FIDO2 security keys.
The Problem With SMS-Based MFA
SMS authentication sends a temporary verification code to a user’s phone. While this adds another layer of security, the code can still be obtained through phishing, social engineering, SIM-swapping attacks, or other techniques.
Microsoft is now moving away from its own SMS and voice authentication services. Starting September 1, 2026, passkeys become the default authentication experience for users currently enabled for Microsoft-provided SMS or voice authentication, and Microsoft-provided SMS and voice delivery is scheduled to be retired on February 1, 2027.
Businesses should therefore begin reviewing their cybersecurity services and authentication policies before these changes create unnecessary sign-in disruptions.
Why Passkeys Are More Resistant to Phishing
Passkeys use a cryptographic key pair instead of relying on a password or one-time verification code. The private key remains protected by the user’s device or credential provider, while the corresponding public key is registered with the service.
Because the passkey is tied to the legitimate website or application, a fake login page cannot simply collect the credential and reuse it elsewhere. Microsoft notes that passkeys use origin-bound public-key cryptography, making them resistant to remote phishing and credential replay.
What Should Microsoft 365 Administrators Deploy in 2026?
The answer is not necessarily to replace every authentication method overnight. Instead, organizations should create a phased strategy based on user roles, device capabilities, business requirements, and the sensitivity of the resources employees can access.
Start With High-Risk Accounts
Privileged accounts should be among the first users moved to phishing-resistant authentication. This includes Global Administrators, security administrators, finance users, executives, and employees with access to sensitive information.
Microsoft recommends phishing-resistant options including passkeys and FIDO2 security keys for stronger account protection.
Starting with high-risk accounts also allows administrators to test the deployment before expanding it across the organization.
Use Conditional Access to Enforce Strong Authentication
Microsoft Entra Conditional Access can help administrators determine which authentication methods users must use when accessing particular applications or resources.
Administrators can create authentication-strength policies that require phishing-resistant methods such as passkeys for sensitive resources. Microsoft provides specific guidance for enabling and enforcing passkeys in Microsoft Entra ID, including the use of Conditional Access policies.
This should be considered part of a broader managed IT services strategy rather than a standalone security configuration.
Should Businesses Completely Abandon MFA?
No. Passkeys and MFA should not necessarily be viewed as competing technologies.
Passkeys can satisfy MFA requirements when they combine something the user possesses, such as a device, with something the user knows or is, such as a PIN or biometric. This provides strong authentication without requiring users to enter a password and a separate verification code.
Organizations should still maintain appropriate recovery procedures for situations such as lost devices, new hardware, or employees who need to register another authentication method.
Microsoft Entra ID supports both synced and device-bound passkeys. Synced passkeys can work across supported devices through credential managers, while device-bound passkeys keep the private credential tied to a specific device.
How to Plan a Passkey Deployment
A successful passkey rollout should begin with an assessment of the organization’s existing Microsoft 365 environment.
Administrators should identify which users currently rely on passwords, SMS codes, voice authentication, or other potentially phishable methods. They should also review the devices employees use and determine whether those devices support the passkey options the organization intends to deploy.
Start With a Pilot Group
Rather than immediately requiring passkeys for every employee, organizations can begin with IT administrators and other high-risk users.
The pilot should test registration, sign-in, device compatibility, account recovery, and the employee experience. Once the process is working reliably, administrators can gradually expand deployment to other departments.
Microsoft also recommends identifying users currently using SMS or voice authentication and moving them toward phishing-resistant methods ahead of the upcoming retirement timeline.
Passkeys Are Part of a Larger Security Strategy
Passkeys can significantly improve identity security, but they should not be treated as the entire cybersecurity strategy.
Microsoft 365 environments also require protection for email, endpoints, cloud applications, user devices, sensitive data, and backups. Strong authentication reduces the risk of account compromise, but businesses still need controls that protect information if an endpoint or application is compromised.
Organizations should therefore combine phishing-resistant authentication with access controls, endpoint protection, security monitoring, employee awareness, and reliable data recovery and backup solutions.
The NIST Digital Identity Guidelines also provide broader guidance for digital identity and authentication, making them a useful reference for organizations developing a long-term identity security strategy.
What Microsoft 365 Administrators Should Do in 2026
Microsoft 365 administrators should begin treating passkeys as the next stage of their authentication strategy rather than simply another MFA option.
The immediate priority should be identifying users who still depend on passwords, SMS, or other phishable authentication methods. From there, organizations can introduce passkeys to privileged users, establish recovery procedures, test Conditional Access policies, and gradually expand deployment.
Microsoft’s move toward passkeys makes this especially important. Organizations that still depend heavily on Microsoft-provided SMS and voice authentication should prepare well before the February 1, 2027 retirement date to avoid unnecessary disruption.
For businesses planning a Microsoft 365 security upgrade, the goal should not simply be to have MFA enabled. The goal should be to use authentication methods that provide strong protection against the threats employees are actually facing today.
Passkeys provide a practical path toward that goal, combining stronger phishing resistance with a faster and simpler sign-in experience. By starting the transition in 2026, Microsoft 365 administrators can strengthen account security now while preparing their organization for the next generation of authentication.