The requirements for IT security are constantly evolving. Especially when it comes to protecting user accounts, it is becoming clear that traditional passwords and SMS codes are no longer sufficient in the long term.<\/p>\n\n\n\n
Microsoft is therefore taking another step towards modern and phishing-resistant authentication.<\/p>\n\n\n\n
Since 1 September 2026<\/strong> passkeys are becoming more firmly established as a standard authentication method in Microsoft Entra ID. Users who have previously used SMS or voice calls for authentication are gradually being prompted to set up a passkey.<\/p>\n\n\n\n From the 1 February 2027<\/strong> Microsoft is to discontinue its own provision of SMS and voice calls for authentication. Organisations that still require these methods must use alternative solutions or supported telecommunications providers.<\/p>\n\n\n\n A passkey is a modern sign-in method that can replace traditional passwords.<\/p>\n\n\n\n Instead of having to enter a password every time and then confirm an SMS code, logging in can be done, for example, via:<\/p>\n\n\n\n take place.<\/p>\n\n\n\n In the background, this method is based on cryptographic keys. As a result, the actual login secret is not transmitted to the website or application like a classic password.<\/p>\n\n\n\n This is precisely what makes passkeys significantly more resilient to many classic phishing attacks. Microsoft explicitly describes passkeys as a phishing-resistant authentication method.<\/p>\n\n\n\n Many businesses use Microsoft 365 daily for core business processes:<\/p>\n\n\n\n This simultaneously makes the Microsoft account an important access point to the entire corporate IT.<\/p>\n\n\n\n If a user account is compromised, attackers may be able to access emails, files, internal information or other corporate resources, depending on the permissions available.<\/p>\n\n\n\n Modern authentication is therefore an important component of a comprehensive IT security strategy.<\/p>\n\n\n\n Although classic two-factor authentication via SMS offers additional protection compared to a single password, it is also vulnerable.<\/p>\n\n\n\n Microsoft now classifies SMS and voice calls as significantly weaker authentication methods compared to passkeys.<\/p>\n\n\n\n Companies should therefore review which authentication methods are currently in use and whether users are still solely reliant on passwords and SMS.<\/p>\n\n\n\n A meaningful security check can include the following points, amongst others:<\/p>\n\n\n\n Because IT security does not consist of a single measure. What matters is the interplay of identity protection, access control, backup, monitoring and regular system reviews<\/strong>.<\/p>\n\n\n\n The transition does not have to be complicated, but it should be carried out in a planned manner.<\/p>\n\n\n\n Which users are affected? This is precisely where we come in.<\/p>\n\n\n\n K&S NexTech analyses your existing IT environment together with you and develops a suitable solution for your company.<\/strong><\/p>","protected":false},"excerpt":{"rendered":" Die Anforderungen an die IT-Sicherheit entwickeln sich st\u00e4ndig weiter. Besonders beim Schutz von Benutzerkonten zeigt sich, dass klassische Passw\u00f6rter und SMS-Codes langfristig nicht mehr ausreichen. Microsoft geht deshalb einen weiteren Schritt in Richtung moderner und phishing-resistenter Authentifizierung. Seit dem 1. September 2026 werden Passkeys in Microsoft Entra ID st\u00e4rker als Standard-Authentifizierungsmethode etabliert. Benutzer, die bisher…<\/p>","protected":false},"author":2,"featured_media":16448,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-allgemein","vs-blog blog-single"],"yoast_head":"\nWhat actually is a passkey?<\/h2>\n\n\n\n
\n
Why should businesses act now?<\/h2>\n\n\n\n
\n
Password + SMS does not automatically mean maximum security<\/h2>\n\n\n\n
What businesses should check now<\/h2>\n\n\n\n
\n
Now check your own Microsoft 365 environment<\/h2>\n\n\n\n
Which authentication methods are currently used?
Which devices already support passkeys?
And what additional security measures should be implemented?<\/p>\n\n\n\n