{"id":1248,"date":"2026-10-03T14:00:00","date_gmt":"2026-10-03T19:00:00","guid":{"rendered":"https:\/\/valhalla-computers.com\/?p=1248"},"modified":"2026-09-29T02:26:11","modified_gmt":"2026-09-29T07:26:11","slug":"passkeys-default-small-business-stop-relying-on-sms-mfa","status":"publish","type":"post","link":"https:\/\/valhalla-computers.com\/index.php\/2026\/10\/03\/passkeys-default-small-business-stop-relying-on-sms-mfa\/","title":{"rendered":"Passkeys Are Becoming the Default \u2014 Why Small Businesses Should Stop Treating SMS Codes as Strong Security"},"content":{"rendered":"

<\/p>\n\n\n

\"Passkeys<\/figure>\n\n\n\n

For years, businesses were told to turn on two-factor authentication, and many did exactly that by adding a six-digit SMS code. That was a major improvement over passwords alone, but attackers adapted. They learned to steal codes through phishing pages, SIM attacks, social engineering, adversary-in-the-middle kits, and convincing \u201csecurity verification\u201d calls. In September 2026, Microsoft began making passkeys<\/strong> the default authentication experience for eligible Entra ID users, another sign that the industry is moving away from authentication methods people can be tricked into handing over.<\/p>\n\n\n\n

What Microsoft Changed<\/h2>\n\n\n\n

Microsoft\u2019s Entra documentation<\/a> says users enabled for SMS or voice authentication began being nudged toward passkey registration on September 1, 2026. Microsoft plans to retire its own native SMS and voice delivery for most Entra users in 2027, while organizations with specific requirements can use other providers. The company\u2019s stated goal is to move organizations toward phishing-resistant authentication methods such as passkeys, Windows Hello for Business, and FIDO2 security keys.<\/p>\n\n\n\n

Why Passkeys Resist Ordinary Phishing<\/h2>\n\n\n\n

A passkey is based on public-key cryptography and is associated with the legitimate website or service. Microsoft\u2019s consumer guidance notes that a passkey created for one domain is not presented to a look-alike phishing domain. That removes one of the attacker\u2019s favorite tricks: convincing a user to type a secret into the wrong page. There is no reusable password or six-digit code for the fake site to collect and immediately replay.<\/p>\n\n\n\n

Attackers Are Already Adapting to the Passkey Transition<\/h2>\n\n\n\n

Security improvements do not make social engineering disappear. Microsoft published September research describing attackers using passkey-themed lures and account-recovery tactics in real cloud compromises. The lesson is important: an attacker may not be able to steal the cryptographic passkey itself, so they may instead trick a victim into registering an attacker-controlled authentication method, approving a device flow, or surrendering access through another route. Employees still need a trusted way to verify unexpected security prompts.<\/p>\n\n\n\n

Start With the Accounts That Could Ruin Your Week<\/h2>\n\n\n\n

A small business does not have to convert every login in one afternoon. Start with email administrators, domain registrars, website hosting, banking and payment systems, password managers, cloud storage, accounting, social-media administration, and any account capable of resetting other accounts. Those are the keys to the kingdom. If passkeys or hardware security keys are available, use them and keep recovery options documented rather than relying on one employee\u2019s phone.<\/p>\n\n\n\n

Keep Recovery From Becoming the Weakest Link<\/h2>\n\n\n\n

Strong primary authentication is useless if account recovery only requires answering a weak question or convincing support to change the phone number. Review recovery email addresses, backup codes, secondary administrators, old phone numbers, departed employees, and emergency procedures. Store recovery codes securely offline or in an approved password manager. Test the process before an emergency so the first time anyone discovers it is not while the business email account is under attack.<\/p>\n\n\n\n

Do Not Confuse Convenience With Carelessness<\/h2>\n\n\n\n

Passkeys are designed to be easier as well as safer, but businesses still need device security. Lock computers and phones, keep operating systems updated, use disk encryption, protect biometric unlock, and remove access promptly when a device is lost or an employee leaves. The authentication system may be phishing-resistant while the unlocked laptop sitting in a truck is not.<\/p>\n\n\n\n

Bottom Line<\/h2>\n\n\n\n

SMS two-factor authentication is still better than a password alone, but it should no longer be the finish line. Microsoft\u2019s September passkey rollout reflects a broader move toward authentication that cannot simply be typed into a fake login page. Small businesses should use the transition as an excuse to inventory their most important accounts, enable phishing-resistant sign-in where available, and fix recovery procedures before an attacker tests them first.<\/p>\n\n\n

<\/p>\n

\"Valhalla<\/a><\/div>\n

<\/p>","protected":false},"excerpt":{"rendered":"

Microsoft began making passkeys the default authentication experience in Entra ID this September. Small businesses should understand why phishing-resistant sign-in is replacing SMS and voice codes.<\/p>\n","protected":false},"author":1,"featured_media":1272,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pgc_sgb_lightbox_settings":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[1041,68,506,741,595,33,14],"class_list":["post-1248","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-small-business-websites","tag-ai-for-business","tag-artificial-intelligence","tag-consumer-protection","tag-consumer-technology","tag-responsible-ai","tag-small-business-technology","tag-valhalla-computers"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t