Since September 1, people in offices across Montreal have been getting a new screen when they sign in to Microsoft 365. It asks them to set up a passkey. A "Remind me later" button makes it easy to wave off, and for now Microsoft lets people snooze it as often as they like.
That grace period ends. On February 1, 2027, most employees whose only second sign-in step is a text or phone call from Microsoft will hit a prompt with no snooze button. They register a passkey, or they don't get into Outlook. Picture it landing on your controller at 8:40 on a Monday, with a client call at nine.
Do you have to use Microsoft passkeys? Not if your employees already sign in with Windows Hello for Business or another phishing-resistant method, and not if you arrange SMS or voice delivery through a supported third-party provider. Anyone whose only available second factor is still Microsoft's own text or call will face a registration prompt they can't skip once their retirement date arrives.
A passkey is a sign-in credential stored on a device you already carry. You unlock it the way you unlock your phone: face, fingerprint or PIN. There is nothing to type and nothing to forget.
Under the hood it's a pair of cryptographic keys. The private key is held by your device or your credential provider; Microsoft holds the matching public key. When you sign in, your device proves it holds the matching key, and it will only do that for the real Microsoft sign-in page. A lookalike at micros0ft-secure-login.com gets nothing, because the passkey was never registered there.
Entra ID supports synced passkeys (stored in iCloud Keychain or Google Password Manager), device-bound passkeys kept in Microsoft Authenticator or Windows, and FIDO2 security keys, the small USB or NFC fobs. Which ones your staff may use depends on who owns the devices, and it decides how people get back in when a device goes missing.
Text-message codes had a good run. For years they stopped most account takeovers. Attackers caught up.
SIM swapping, where someone talks a mobile carrier into moving your number to their SIM card, sends your codes straight to the attacker. Modern phishing kits sit between the employee and the real login page, relay the password and the six-digit code in real time, and keep the session token that comes back. The employee sees a normal sign-in. The attacker gets the mailbox.
AI has made the bait better, too. Microsoft reports that some AI-enabled phishing campaigns it observed reached click-through rates as high as 54%, against roughly 12% for traditional campaigns. Sooner or later somebody clicks, so the sign-in method has to hold up after the click. Microsoft has decided to make that call for every tenant at once.
Plenty of businesses will relax here because MFA is already switched on. "MFA enabled" describes a policy. It doesn't tell you whether employees are typing a phishable text code or using something stronger, and an audit of the methods people actually use beats a green checkmark in the admin centre.
Sign-in method | Stops | Still gets beaten by |
|---|---|---|
| Password only | Lazy guessing | Phishing, reused passwords from old breaches |
| Password + SMS or voice code | Most attacks using stolen passwords | SIM swaps, real-time phishing proxies |
| Password + Authenticator approval | Stolen passwords, SIM swaps | Real-time proxies, people approving prompts they didn't start |
| Passkey | Phishing, SIM swaps, stolen password lists | A stolen phone that's already unlocked, sloppy account recovery |
A passkey still counts as multi-factor authentication: something you have (the device) plus something you are or know (your face or PIN). What changes is that nothing reusable crosses the wire. Traditional MFA relies on the employee noticing the fake page. A passkey simply refuses to work on one.
Now until January 31, 2027. Users enabled for SMS or voice get a prompt at sign-in to set up a passkey. Microsoft allows unlimited snoozes by default, though admins can cap them. Setup takes a couple of minutes: open Authenticator (or the phone's built-in passkey storage, if allowed), scan a QR code, confirm with a fingerprint.
From February 1, 2027. If Microsoft's own text or call is someone's only available second factor, the prompt becomes mandatory (Global Administrators and external users get until July 1). No passkey, no sign-in. Microsoft is careful to say nobody gets "locked out," which is technically true in the way a door with no handle is technically unlocked.
A short note to staff answers the questions your help desk would otherwise hear one at a time:
Two side effects catch people off guard:
Passkeys are a real upgrade, with their own headaches.
A device-bound passkey leaves with the device. When an employee drops their phone off the Jacques-Cartier Bridge (or just upgrades it), someone has to confirm who they are, remove the missing credential and enrol the replacement. Synced passkeys may survive on another device, subject to Apple's or Google's own recovery rules, and a spare security key helps too.
Decide in advance who verifies identity, and test it with a pilot user. A help desk that resets credentials for anyone who sounds stressed has rebuilt the exact hole passkeys were meant to close. Departures need the same care: removing a leaver's registered passkeys belongs on the offboarding checklist, right next to collecting the laptop.
Shared and older devices are where most small businesses will stall.
Shared workstations. Reception PCs, clinic exam rooms, warehouse terminals, the boardroom laptop everyone borrows. Registering one person's passkey and letting the whole front desk use that session erases any record of who did what. Microsoft's Entra passkey on Windows can store passkeys for several accounts on one PC, even one that isn't company-registered. FIDO2 security keys also fit: each person taps their own key, kept on a lanyard. Buy spares, and pilot either option on the actual hardware.
Staff without company phones. Plenty of Quebec employers don't issue phones, and some employees reasonably refuse to put work apps on a personal device. Security keys handle this too. Windows Hello for Business covers people who always sign in from the same assigned computer.
Older hardware. Passkeys in Authenticator need a reasonably current phone (iOS 17 or Android 14 and up). If a few Windows 10 machines or aging Android handsets are still in rotation, find out now, not on February 1.
The worst possible inventory is an employee calling at 8:40 on a Monday because they can't finish signing in. February 1 is just over four months away, plenty of time for a 20-person office if someone owns the project. If your internal IT person is already stretched, or nobody's sure which accounts still depend on texts, Syslogic can run the audit, set the policy and walk your team through setup. Because device-bound passkeys live on phones and laptops, this also becomes a device-management question, which our mobile device management service is built for. If you are still deciding whether outside help makes sense, our comparison of managed IT and break/fix support is a good place to start.
