Microsoft plans to retire its built-in SMS and voice authentication services beginning February 1, 2027. Organizations that want to keep using those methods will need to configure and pay for their own telecommunications provider. We're looking for an alternative that doesn't require employees to use personal phones, purchase hardware security keys, or license paid software.
We have a hybrid Active Directory and Microsoft Entra environment, with company-managed Windows computers. Would Windows Hello for Business provide the best Entra-native approach? If so, how should we handle users who need access from mobile devices, shared computers, or other devices where Windows Hello isn't available? We'd appreciate recommendations and deployment experiences, including any practical limitations.
4 Answers
There isn’t really a free option that covers every scenario in your requirements. If users can access work resources from phones, they’ll generally need an authenticator app or a passkey on that device. If personal phones are prohibited, Conditional Access can block mobile access and you can rely on Windows Hello for company-managed PCs. Otherwise, the organization needs to provide something such as security keys or hardware TOTP tokens.
Certificate-based authentication is another possible route, especially for managed Windows devices, but it is more complicated to design and operate than Windows Hello. You have to manage certificate issuance, renewal, revocation, device recovery, and access from devices that don’t have the certificate. Hardware TOTP tokens or FIDO2 keys are usually simpler for users who cannot or will not use a phone, even though they add a purchase cost.
Passkeys are the direction Microsoft and the wider industry are moving toward. Synced passkeys can work well for most users, while device-bound passkeys are a stronger option for administrators and other high-value accounts. However, synced passkeys generally depend on a phone, browser profile, or platform credential, so they don’t fully satisfy a strict phone-free requirement.
Passkeys look promising, but we would need a separate process for employees who won’t enroll a personal phone and for access from shared devices.
Windows Hello for Business is probably the closest fit if access is limited to company-managed Windows devices. It can provide passwordless authentication without requiring a phone or extra hardware. The trade-off is that each new device needs to be registered, commonly using a Temporary Access Pass, and users still need a fallback for situations where Hello is unavailable or the device is lost or damaged.
That’s the main concern for us: supporting device failures and people who need occasional access from a phone or shared computer without quietly making personal phones mandatory.
Exactly. The requirements force a choice: either restrict work access to managed devices, allow an authenticator on a phone, or provide an authentication device at company expense.