Microsoft has announced a major shift in authentication security. By February 1, 2027, Microsoft-provided SMS and voice authentication for Entra ID will be fully retired, and passkeys will become the default authentication experience.
For Caribbean businesses using Microsoft Entra ID (formerly Azure Active Directory), this change demands immediate attention. Here is what you need to know and the steps you must take to ensure your organisation remains secure and operational.
The AI era demands stronger, phishing-resistant authentication. SMS and voice are among the most vulnerable authentication methods available today; they provide significantly weaker protection against phishing, SIM-swap, and replay attacks than modern alternatives. Passkeys, built on FIDO standards, use origin-bound public key cryptography, ensuring credentials cannot be replayed or shared with malicious actors.
The result: Microsoft is making passkeys the default sign-in method for Entra ID, replacing traditional methods like passwords, SMS, and email codes that are susceptible to phishing.
| Date | What Happens |
|---|---|
| September 1, 2026 | Users currently enabled for SMS or voice are automatically enabled for passkeys and will be nudged to register a passkey when they next complete MFA. |
| February 1, 2027 | Microsoft-provided SMS and voice authentication delivery is fully retired in Entra ID. Customer-managed telecom providers are unaffected. |
| After February 1, 2027 | Users whose only available MFA method is SMS or voice will receive a blocking prompt to register a passkey before they can continue signing in. There is no opt-out; this applies to all tenants. |
If no users in your tenant are enabled for SMS or voice, no action is required.
However, if you have users relying on SMS or voice for multi-factor authentication, you must move every one of those users off SMS and voice before February 1, 2027.
Determine who in your tenant is still enabled for SMS or voice authentication.
Enable passkeys and run a registration campaign to drive adoption at scale before the auto-enablement on September 1, 2026. Acting before this date allows you to move users on your own schedule and avoid blocking prompts.
Notify your users of what is changing, when, and the action they need to take. Clear communication reduces confusion and resistance.
If you have a regulatory or operational need to keep SMS or voice, you may configure a customer-managed provider through the Microsoft Security Store. Provider options and pricing will be published beginning September 18, 2026, with configuration available from October 30, 2026.
Microsoft recommends passkeys as the default phishing-resistant credential in Entra ID. Here is why:
Transitioning your organisation to passkeys requires planning, communication, and technical execution. BG Cyber Connect can assist Caribbean businesses with:
User Discovery and Assessment
We help identify all users still relying on SMS or voice authentication and assess your current authentication methods policy.
Passkey Deployment and Registration Campaigns
We design and execute registration campaigns to drive passkey adoption at scale, minimising disruption to your operations.
User Communication and Change Management
We provide templated communications and change management support to ensure your users understand the transition and complete their registration.
Ongoing Security Monitoring
We ensure your authentication posture remains secure and compliant with evolving best practices.
Every SMS and voice user must be on a phishing-resistant method, passkeys are recommended, before Microsoft-provided SMS and voice retire on February 1, 2027. Acting before September 1, 2026, lets you move users on your own schedule and avoid blocking prompts.
The deadline is firm. There is no opt-out.
BG Cyber Connect specialises in helping Caribbean businesses navigate critical technology transitions. Contact us today to ensure your organisation is ready.
Contact BGCC for a Free Authentication Security Assessment
Explore our comprehensive IT and security services: BGCC Cybersecurity Solutions
A critical security vulnerability in Elementor Pro, the popular WordPress page builder plugin with over 6 million active installations, is currently being actively exploited. The vulnerability (CVE-2026-32475) allows unauthenticated attackers to upload malicious PHP files and achieve complete site takeover. Over 190,000 exploit attempts have already been blocked. Update to version 4.2.2 immediately.
On July 17, 2026, the WordPress Security Team released urgent security updates addressing a critical vulnerability chain in WordPress core affecting versions 6.8 through 7.0.1. Two flaws, CVE-2026-60137 (SQL Injection) and CVE-2026-63030 (Remote Code Execution), can be chained to allow unauthenticated attackers to take complete control of vulnerable sites. No plugins required. No authentication needed. Update to 6.8.6, 6.9.5, or 7.0.2 immediately.
DuckDuckGo now blocks most YouTube video ads by default. For businesses relying on YouTube advertising, this shift demands attention. This article explores the growing ad-blocking trend, what it means for your reach, and how to adapt with content marketing, SEO, influencer partnerships, and a diversified strategy. Future-proof your digital marketing.
Book Now!
