09/09/2026
Microsoft is retiring SMS MFA — Arkansas municipalities need to prepare
Microsoft has announced a major change to Microsoft 365 authentication that municipalities need to begin preparing for now.
As of September 1, 2026, Microsoft has transitioned to passkeys as the default authentication experience for users currently enabled for SMS or voice authentication. On February 1, 2027, Microsoft-provided SMS and voice authentication will be retired. Microsoft is recommending that organizations move users to phishing-resistant authentication methods such as passkeys and FIDO2 security keys.
Microsoft's announcement:
https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/
At Blue Guys IT, we decided not to wait. Our staff has transitioned our administrative accounts to YubiKey hardware security keys across all of the services we administer that support them. For privileged/admin accounts in particular, we believe phishing-resistant authentication should be the standard.
Municipal governments are moving in this direction as well. Earlier this year, New York announced $9 million in cybersecurity grant funding to provide MFA hardware tokens to 161 government entities, including counties, municipalities, school districts, and public authorities.
New York's $9 million announcement:
https://www.governor.ny.gov/news/governor-hochul-announces-9-million-awarded-through-state-and-local-cybersecurity-grant
Free Municipal Webinar
We're covering this Microsoft change, passkeys, YubiKeys, and what municipalities should be doing now during our upcoming municipal cybersecurity webinar.
We'll discuss:
• What Microsoft is changing with SMS and voice MFA
• The February 1, 2027 deadline
• Passkeys vs. Microsoft Authenticator vs. YubiKeys
• Why we're using YubiKeys for administrator accounts
• Practical options for municipal employees who can't use personal phones
• How to begin transitioning without disrupting users
Plus, we're giving away two $100 Amazon gift cards to attendees.
Register here:
74ca1f7b-ee7c-4cd6-886a-226fc3f9edb0@d3be0034-1993-48f4-8fd3-8a5b9ce72ad3?source=copyLinkLegacyShareEventDialog" rel="ugc" target="_blank">https://events.teams.microsoft.com/event/74ca1f7b-ee7c-4cd6-886a-226fc3f9edb0@d3be0034-1993-48f4-8fd3-8a5b9ce72ad3?source=copyLinkLegacyShareEventDialog
Even if your municipality isn't ready to make changes today, I strongly recommend understanding Microsoft's timeline and identifying which users are still dependent on SMS authentication.
https://youtu.be/-lAd_fXh2AM
Blue Guys IT delivers managed IT services, cybersecurity, cloud solutions, and strategic technology guidance for municipalities, healthcare organizations, law firms, and growing businesses. Helping clients stay secure, compliant, and productive since 2018