Important Security Update for M365 Users
Microsoft has announced significant changes to how users authenticate to Microsoft 365 and other applications that rely on Microsoft Entra ID (formerly Azure Active Directory). These changes are designed to improve security and reduce the risks associated with phishing and account compromise.
What Is Changing?
Beginning September 1, 2026 Microsoft will begin making passkeys the default authentication method for users currently relying on SMS text messages or phone calls for multifactor authentication (MFA). Users may be prompted to register a passkey the next time they complete an MFA challenge.
Beginning February 1, 2027 Microsoft will retire its native SMS and voice-based authentication services within Microsoft Entra ID. Organizations that wish to continue using SMS or voice authentication after this date will need to contract with a third-party telecom provider through Microsoft's Security Store and may incur additional costs.
Why Is Microsoft Making This Change?
Cyberattacks targeting user identities continue to increase in sophistication. Traditional authentication methods such as text messages and phone calls are vulnerable to phishing attacks, social engineering, and SIM-swapping scams. Passkeys provide stronger protection by using cryptographic authentication that is resistant to phishing and credential theft.
What Should Your Organization Do?
We recommend that organizations begin preparing now by:
- Identifying users who currently rely on SMS or voice-based MFA.
- Evaluating and deploying passkeys or other phishing-resistant authentication methods.
- Communicating upcoming changes to staff and volunteers.
- Reviewing authentication policies and security procedures.
- Working with your IT team to develop a migration plan before the February 2027 deadline.
Tech Impact can help! For all current clients, your Account Manager will be reaching out to help make a plan. For all non-client nonprofits, reach out to see if and how we can help.
