Passwordless Login: Preparing Infrastructure for the Phase-Out of SMS MFA and Transition to Passkeys
From 1 September 2026, Microsoft Entra ID will set Passkeys as the default authentication method, and from 1 February 2027, it will completely phase out direct support for SMS and voice authentication. For CIOs and security officers, this means an immediate review of access strategies is required. The transition to passwordless access requires a redesign of the account lifecycle, where biometrics serve merely as a local factor to unlock the private key, rather than a network identifier.
Passwordless authentication requires a clear distinction between synced and hardware keys in accordance with NIST SP 800-63B requirements to protect critical systems.
Analysis of Regulatory Pressure and Vendor Deadlines
The rapid adoption of passwordless technologies is driven by the vulnerability of traditional multi-factor authentication (MFA) methods. SMS messages and voice calls are vulnerable to SIM-swapping and phishing attacks. This is why Microsoft is setting strict timelines for its Entra ID infrastructure.
For organisations relying on cloud services, this means an inventory of access methods is necessary. After 1 February 2027, direct support for SMS and voice from Microsoft will cease. Organisations that choose to retain these channels will be forced to integrate services from third-party authentication providers. The rational path is to migrate users to standardised passwordless methods.
This migration requires careful planning, compatibility testing with existing corporate applications, and user training. A lack of preparation could lead to widespread access lockouts and helpdesk overload. Transitioning to Passkeys increases user resilience to phishing attacks, although it does not guarantee absolute protection against all types of threats.
Technical Distinction Between Synced and Device-Bound Passkeys
According to the FIDO Alliance classification, Passkeys technology is divided into two types based on how private keys are stored. Understanding this difference is critical for designing corporate security and allocating access levels.
Synced Passkeys are copied between user devices using cloud services. This provides convenience for everyday tasks, as losing one device does not result in a loss of access. However, for critical infrastructure, this method carries risks associated with the security of the platform provider's cloud account.
Device-Bound Passkeys are physically tied to a specific device or hardware token and cannot be exported or synced. They provide a higher level of protection against key compromise and are intended for administrators and access to critical systems.
The choice between these two types depends on the organisation's threat model and usability requirements. For most employees, synced keys will be sufficient, whereas for privileged users, hardware tokens are mandatory.
Classification of Factors Under the NIST SP 800-63B Standard
\nWhen designing a passwordless architecture, biometric data must not be equated with an independent authentication factor. According to the NIST SP 800-63B standard, biometrics are merely a local activation factor. They are not transmitted over the network and are not verified by the authentication server.
A local activation factor serves to unlock a private cryptographic key stored in the device's secure module. It is this private key that signs the challenge from the server using the WebAuthn protocol.
-
AAL1 Level
Allows single-factor authentication without mandatory protection against phishing.
-
AAL2 Level
Requires multi-factor authentication with phishing protection (e.g. Synced Passkeys).
-
AAL3 Level
Requires the mandatory use of hardware cryptographic modules (Device-Bound).
-
Local Biometrics
Treated exclusively as a local activation factor for the private key on the device.
Understanding these Authenticator Assurance Levels (AAL) is the foundation for building an access control system that meets modern security requirements and regulatory standards.
Designing Backup Scenarios and Preventing Loss of Access
As legacy access recovery methods via SMS are phased out, developing recovery scenarios is a critical phase of the migration. The FIDO Alliance recommends that users register at least two passkeys. This minimises the risk of complete loss of access to corporate resources in the event of damage to or loss of a work device.
Building a reliable passwordless architecture in the Ukrainian context requires a flexible access management platform. The UnityBase low-code platform from IQusion supports integration with various authentication methods and provides an audit trail of user actions. This enables organisations to integrate modern passwordless methods into corporate systems while complying with comprehensive information protection system requirements.
-
Analysis and Classification
Segmenting accounts into groups by criticality level and determining the required AAL level.
-
Primary Key Registration
Configuring security policies for users to register their primary passwordless factor.
-
Creating Backups
Mandatory registration of a second (backup) passkey to prevent lockouts.
-
Phasing Out SMS
Systematic disabling of legacy MFA methods after verifying the functionality of new factors.
Having a clear migration plan and backup scenarios reduces the risk of business disruption during the transition to new authentication standards.
Auditing and Managing the Passwordless Access Lifecycle
From a security audit perspective, the transition to Passkeys shifts the focus of control. Instead of checking password complexity and rotation frequency, auditors must focus on controlling the lifecycle of cryptographic keys. This includes verifying new device registration processes, monitoring usage, and key revocation procedures in the event of employee termination or token loss.
Calculating the Total Cost of Ownership (TCO) when transitioning to a passwordless architecture is a conceptual model for internal evaluation. It is based on comparing the costs of supporting legacy methods with investments in new hardware tokens. Quantifying the exact reduction in compromise risk is difficult, so the focus should be on compliance with standards and reducing the load on the Helpdesk.
-
Registration Control
Verifying compliance of registered keys with corporate policies and security requirements.
-
Usage Monitoring
Tracking authentication sessions and detecting anomalous login attempts from new devices.
-
Revocation Procedure
Having a clear policy for blocking and deleting keys in the event of device loss.
-
Access Log Analysis
Regular auditing of security events using the built-in tools of the identity management platform.
Effective key lifecycle management is key to the long-term security and stability of corporate infrastructure.
Frequently Asked Questions
How do I configure hybrid authentication for external contractors?
For external users, it is advisable to allow the use of their own Synced Passkeys (for example, via Apple or Google ID) if this complies with the organisation's security policies for the AAL2 level, without the need to issue hardware tokens.
What actions are required if a single hardware key (Device-Bound Passkey) is lost?
If a single key is lost, it is necessary to initiate an administrative identity recovery procedure through the Helpdesk. To minimise downtime, it is recommended to register at least two keys for each account in advance.
How do I retain SMS authentication after 1 February 2027?
Since direct support from Microsoft is ending, organisations will have to independently integrate and pay for the services of third-party SMS authentication providers via appropriate APIs.
