Microsoft and Google push passkeys deeper into workplace authentication

Microsoft and Google announced Monday separate steps to expand passkey and hardware security key use in workplace authentication. Microsoft said it will make passkeys the default authentication experience in the public-cloud version of Microsoft Entra ID starting September 1. As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys and prompted to register one at their next multifactor authentication. Microsoft will retire its native telecom delivery service for SMS and voice authentication on February 1, 2027. Organizations needing to retain those methods can contract with supported telecommunications providers through the Microsoft Security Store, with customers responsible for carrier and delivery charges. Microsoft plans to identify participating providers and release pricing on September 18, with administrators able to configure a provider beginning October 30. After the native service ends, users relying on SMS or voice will be required to register a passkey before signing in. Microsoft said passkey registration prompts will eventually be enforced for all users in affected organizations with no option for administrators to disable them. The dates apply only to Entra ID in the public cloud. Google said its Credential Provider for Windows now supports FIDO2-compliant physical security keys as a second factor at the Windows login screen for Google Workspace users. Users can also approve the second factor with a passkey stored on a nearby Bluetooth-connected mobile device. The capability adds a phishing-resistant option for administrators enforcing Google's two-step verification requirements at the Windows login screen.