For a law firm, that matters. Your Microsoft account may open the door to client correspondence, confidential documents, and financial instructions. That door deserves something stronger than a secret an attacker can persuade someone to hand over.
Enter the passkey.
Let’s get into it!
Why are text messages and verification calls being shown the door?
SMS-based multifactor authentication, or MFA, gave accounts an extra layer of protection beyond a password. But an extra layer is not necessarily a phishing-resistant layer.
An attacker can create a convincing fake sign-in page and ask for both your password and the verification code. Phone-based authentication also introduces risks such as SIM swapping, where someone fraudulently takes control of your phone number. Microsoft
The problem is that a code is something you can disclose. A fake Microsoft page, a persuasive caller, or an urgent message from “IT” can convince someone to provide it.
Passkeys change that arrangement. Instead of asking you to type a reusable secret or relay a code, they let an approved device prove that you are authorized to sign in. The credential is tied to the legitimate service, which is what makes it resistant to lookalike-site phishing. Microsoft Learn
Less “please tell us the secret.”
More “prove you hold the right credential.”
Think of a passkey as a very particular courthouse credential
Imagine a courthouse that admits anyone who knows a secret phrase.
That is roughly the password model. Learn the phrase, and you can impersonate the person who is supposed to know it.
Now imagine a special digital signing seal. You keep the seal protected. The courthouse holds information that lets it verify your seal’s work, but that information cannot recreate the seal.
There is another important safeguard: your browser checks which courthouse is asking. A fake courthouse with a convincing sign cannot use your credential to authenticate you to the real one.
That is the basic idea behind a passkey’s public-key cryptography and website binding. Apple Support
In practical terms, the service keeps a public key, while your device or approved credential provider protects the private key. During sign-in, your device uses the private key to sign a fresh request. The service verifies the response without receiving your private key. Apple Support
You authorize that process with something familiar, such as Face ID, a fingerprint, or your device PIN. Your face is not the passkey. It simply unlocks permission to use it. FIDO Alliance
Think of it as checking your credentials without asking you to announce the office alarm code in the courthouse lobby.
When is Microsoft making the change?
For Microsoft Entra ID, the identity system behind many
Microsoft 365 business accounts, here’s the schedule:
registration for users using SMS or voice authentication.
for most users, including internal guest users.
and external users.
These dates apply to Microsoft Entra ID public-cloud
environments. Other Microsoft clouds and personal
Microsoft accounts have separate schedules.
Microsoft’s official guidance.
For most law firms, February 1, 2027 is the date to
circle on the calendar.
Preferably without discovering the problem at 8:57 a.m.
before a 9:00 a.m. hearing.
Does this mean everyone must use a passkey?
Not quite. The details matter, which should be comforting news to anyone who reads contracts for a living.
After the applicable retirement date, affected users whose only available MFA method is SMS or voice will face a blocking passkey-registration prompt unless their organization has arranged continued telephony service through a supported provider. They will need to complete registration before proceeding. Microsoft Learn
People already using Windows Hello for Business, passkeys, or another phishing-resistant method can continue using those methods. This is not an announcement that every Microsoft password stops working in February. learn.microsoft.com
Organizations with a continuing need for SMS or voice can arrange a supported third-party telephony provider through the Microsoft Security Store, with associated charges. That is a continuation option, not a security upgrade to the underlying authentication method. Microsoft
Your firm may also adopt its own policy requiring phishing-resistant authentication earlier or more broadly. Microsoft’s retirement schedule and your firm’s security policy are related, but they are not the same thing. learn.microsoft.com
Are we getting rid of MFA?
No. We are improving how it works.
A passkey used with a device PIN or biometric verification can satisfy MFA by combining possession of the credential with proof that you can unlock it. You do not necessarily need a separate text message to achieve multifactor protection. Microsoft Learn
Fewer visible steps do not automatically mean less security.
Sometimes they simply mean the system has stopped making you do its paperwork.
Where does the passkey live?
There are two important arrangements.
Device-bound passkeys stay with a particular device or security key. Microsoft Authenticator passkeys and Microsoft Entra passkeys stored in Windows Hello are examples.
Synced passkeys can become available on multiple devices through an approved provider, such as Apple Passwords/iCloud Keychain or Google Password Manager. The private key is protected and synchronized through that provider. Microsoft Learn
Your firm should decide which options it permits. Do not assume that because your personal password manager offers to save a work passkey, your firm has approved that arrangement.
“Technically possible” and “authorized by the firm” are not interchangeable phrases. Ask anyone who has reviewed an expense report.
Passkey questions, answered without requiring a computer science degree
“I already use Microsoft Authenticator. Am I finished?”
Not necessarily.
Authenticator supports several methods, including approval notifications, verification codes, and passkeys. Having the app installed, or approving a number-matching prompt, does not mean you have registered a passkey.
Ordinary codes and push approvals are not equivalent to phishing-resistant passkey authentication.
Check your account’s registered methods with IT rather than assuming the app icon means the project is complete.
“Is Microsoft receiving my face or fingerprint?”
No. Biometric verification happens locally on your device. The service receives cryptographic proof, not your fingerprint or a photograph of your face.
Your Monday-morning expression remains your business.
“Why is a device PIN different from a password?”
A device PIN unlocks the protected credential locally. It is not a replacement Microsoft password that someone can simply type into a remote sign-in page.
An attacker would still need access to the credential and the ability to unlock it.
Protect your device and choose its PIN carefully. “Local” does not mean “unimportant.”
“What happens when I replace my phone?”
The answer depends on where the passkey is stored.
A synced passkey may become available through your approved credential provider. Microsoft Authenticator passkeys do not sync to a replacement phone. You must register a new one.
When replacing a working phone, complete and test the new setup before erasing or trading in the old device.
Restoring the Authenticator app is not the same as restoring its device-bound passkeys.
“What happens if my phone is lost or stolen?”
Report it to IT immediately so affected credentials can be removed and recovery can begin.
Plan an approved alternative beforehand, such as a second registered passkey or a hardware security key.
Where configured, IT can issue a time-limited Temporary Access Pass after verifying your identity, allowing you to register a replacement authentication method.
“I think it is somewhere in the rideshare” should not be your disaster-recovery plan.
“Do I need a smartphone or facial recognition?”
Not necessarily.
Depending on your firm’s setup, you may use Windows Hello, a hardware security key, or another approved passkey provider.
A PIN can provide local verification without requiring a fingerprint or facial scan.
Ask IT for an approved option rather than assuming a personal phone is mandatory.
“Do I have to create a passkey on every device?”
Not always.
Synced passkeys can work across devices within an approved provider’s system. A phone-based passkey can also authorize a sign-in on a nearby computer through a supported cross-device flow.
For Microsoft Authenticator cross-device sign-in, both devices need Bluetooth and internet access.
However, a passkey stored only in one computer’s Windows Hello container does not automatically appear on another computer.
“Will this replace every password at the firm?”
No. Each service must support passkeys, and your organization must permit the relevant method. Some applications or workflows may still require passwords.
Keep using your approved password manager and existing controls until IT confirms what can be retired.
A passkey for Microsoft does not automatically create one for your practice-management software, bank, or court-filing account.
“Does a passkey make my account impossible to compromise?”
No. Phishing-resistant does not mean breach-proof.
Attackers can still target devices, recovery processes, existing sessions, or users through other social-engineering tactics.
Microsoft has documented attacks in which criminals impersonate IT and use supposed passkey upgrades as the excuse.
Use your firm’s known setup instructions. Verify unexpected calls through an established support channel.
Do not follow an unsolicited “register your passkey immediately” link just because the message has acquired a Microsoft logo.
The irony would be impressive. The incident response would be less enjoyable.
“Does this cost extra?”
Microsoft says passkeys are included across Entra plans.
However, hardware security keys, implementation support, and some advanced policy features can involve additional costs.
Continuing SMS or voice through a third-party provider also brings provider charges.
What should your firm do now?
Start with an inventory of who still relies on SMS or voice. Choose approved passkey methods, pilot them with a small group, and test the applications people actually use.
Include recovery, replacement devices, and staff training in the rollout. Registering a stronger method is only part of the job; IT also needs to decide when and how to restrict weaker alternatives. Microsoft’s deployment guidance recommends staged enforcement and monitoring rather than a surprise all-staff cutover. Microsoft Learn
Use the appropriate iPhone, Android, Windows, or Mac guide below once your firm has confirmed the approved setup.
- How to Set Up a Microsoft 365 Passkey on an iPhone
- How to Set Up a Microsoft 365 Passkey on Android
- How to Set Up a Microsoft 365 Passkey on Windows
- How to Set Up a Microsoft 365 Passkey on a Mac
Talk to 2b1 Inc. about your Microsoft 365 authentication setup and a migration plan that fits your firm.
Your next emergency motion should involve a client, not your login screen.