Passkeys Won’t Fix a Broken Front Door: Why MFA and Conditional Access Still Matter
Microsoft’s pivot away from offering SMS and phone call options as part of their standard MFA methods has caught many organisations by surprise. From 1 February 2027, Microsoft-provided SMS and voice authentication will be retired for most users in Microsoft Entra ID, with organisations wishing to continue using these methods needing to use a supported third-party telephony provider.
In the meantime, users with either method enabled, will be prompted to register a passkey when signing in; even if they already have other authentication methods configured. Yes, it is possible to waive this prompt at the tenant level until the expiry deadline in February, but it’s important to have a plan for this retirement in place now. Users limited to SMS or phone calls must have a new method set by that deadline or will not be able to pass MFA prompts.
Considering the phone-related options are already the weakest available factors for protecting accounts due to the ease with which SIM swapping or cloning can be performed, this move may be a blessing in disguise. Passkeys can take several forms, giving organisations greater flexibility across different users, devices and working environments.
So too the change is prompting larger discussions on how organisations configure and use MFA to protect their security perimeter. In 2023, Microsoft announced a move to deprecate the existing per-user MFA settings page in favour of the new unified Authentication Methods setup. However, because many organisations configured these settings years ago and had little reason to revisit them, a surprising number have yet to complete the migration. The new system allows for far more options such as the integration of external MFA systems (e.g. for RSA tokens), and temporary access passes (TAPs) – perfect for setting up new starters in a secure fashion from day one.
A move away from the legacy MFA settings page reveals other security considerations – it offers an IP address allow list for networks where users will not be prompted for MFA. This kind of static allow list is increasingly at odds with modern Zero Trust principles, which evaluate the context and risk of every sign-in rather than assuming trust based on network location alone.
Modern Zero Trust means that being inside the corporate network should not automatically make a sign-in trusted. A recognised IP address says where a request appears to come from but says little about whether the account has been compromised or if the device is secure. If such an exception is needed, it should be part of a coherent Conditional Access policy strategy and not left languishing on a legacy configuration page.
The arrival of passkeys is undoubtedly a positive step, but organisations should adopt them as part of a broader identity and access strategy around MFA, Conditional Access and Zero Trust. Strong authentication can verify who is signing in, but it does not decide what that user should be allowed to access, under what conditions, or from which devices. Without a modern Conditional Access strategy grounded in Zero Trust principles, passkeys risk becoming merely a stronger lock fitted to a structurally vulnerable front door.
