Passwordless identity and MFA changes are reshaping enterprise access management

Vendors are steadily shifting away from SMS and older second factors toward passkeys and hardware-backed authentication. Microsoft announced passkeys as the default sign-in experience for Entra ID and described future deadlines for users still relying on SMS or voice. Google expanded FIDO2 support for Windows login through GCPW, giving Workspace users another phishing-resistant option. Even companies like GM generated backlash by recommending SMS over app-based authentication, showing how confusing and inconsistent the market still is. This matters because authentication policy is now changing faster than many organizations can update their user experience and support processes. The operational challenge is not whether stronger authentication is desirable, but how to migrate millions of users without breaking workflows.

Sources

• Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID — Microsoft Security Blog
• Google adds FIDO2 keys and phone passkeys to Windows login via GCPW — Help Net Security
• According to GM, we are all doing MFA wrong… — /r/cybersecurity
• Microsoft makes Windows SSO prompts easier to manage — Help Net Security