Microsoft is retiring SMS authentication, so I'm reviewing our environment and finding users who still rely on it. I've been with the organization for a little over a year and have approval authority for most technical changes.
We currently have a hybrid setup. Devices are joined only to on-premises Active Directory, while users are synchronized to Entra ID through the connector. We prefer to retain a significant on-premises footprint, so moving fully to Intune or a cloud-only model is not currently the plan.
Duo is installed on endpoints for desktop logon, and Microsoft Authenticator is used for Entra ID and several other services. Ideally, I'd like to eliminate Duo Authenticator and move toward passwordless authentication.
Assuming budget is not a major concern, what would you choose for a secure, user-friendly, phishing-resistant solution that will hold up well during security audits? I've been looking at Secret Double Octopus as a possible all-in-one platform. Would it typically need to be paired with hardware security keys such as YubiKeys?
If this were your environment, how would you phase out SMS, handle desktop logon, and build a future-proof authentication strategy without immediately abandoning the on-premises infrastructure?
5 Answers
I’d treat this as a phased migration rather than replacing everything at once: remove SMS by moving users to Authenticator, pilot Windows Hello for Business or FIDO2 keys with a small group, document recovery and break-glass procedures, then expand the rollout. Keep a second registered method for every user and test scenarios such as a lost phone, unavailable network, expired credentials, and a compromised workstation.
The strongest design is usually a combination: passwordless Windows sign-in for ordinary users, FIDO2 keys for privileged or high-risk accounts, and tightly controlled recovery methods. The product matters, but the enrollment, recovery, monitoring, and operational procedures matter just as much.
Given the current constraints, I’d first move everyone away from SMS to Microsoft Authenticator with number matching. That addresses the immediate deadline while giving you time to design the passwordless rollout properly.
For the longer-term target, Windows Hello for Business with Cloud Kerberos Trust is worth evaluating. It can provide passwordless Windows sign-in while still allowing access to on-premises resources, without requiring the more complicated certificate-trust model. Hardware security keys are also a strong option, particularly for administrators, high-risk users, and anyone who cannot use a phone. Register two keys per user so a lost key does not become a helpdesk emergency.
Before removing Duo from desktop logon, make sure you have a tested break-glass account, recovery process, and offline sign-in plan. Passwordless authentication is only useful if recovery is secure and practical.
I’d question the assumption that Duo needs to be removed. If it is already deployed and working reliably, it may be simpler to keep it and use it for Entra MFA or passwordless authentication rather than replacing a functioning control. The important questions are whether it meets your phishing-resistance requirements, integrates cleanly with your applications, and is worth the ongoing licensing cost.
If you are willing to change the architecture later, Entra-joined devices combined with Cloud Kerberos Trust can still provide access to on-premises file shares and other resources. That can reduce endpoint dependence on traditional domain joining without requiring an immediate move of every server or workload to the cloud.
For users who cannot or will not use an authenticator app, physical FIDO2 security keys are preferable to SMS or basic hardware OTP tokens because they provide stronger phishing resistance. Keep app-based authentication as a transition or recovery method where appropriate, but use security keys for privileged accounts and other sensitive roles.
Secret Double Octopus can be a reasonable all-in-one option, especially if you want to cover workstation logon and other authentication scenarios with one platform. Whether you need YubiKeys depends on the exact deployment and assurance level you want. A software-based passwordless method may be sufficient for many users, while FIDO2 keys provide an independent phishing-resistant factor and are a good fit for administrators, executives, and emergency access.
I would compare it directly against the capabilities you already have with Duo, Entra ID, Windows Hello for Business, and FIDO2 keys. Pay close attention to offline workstation logon, account recovery, directory integration, application compatibility, and how lost devices or keys are handled.
That is the main comparison I’d make before changing platforms. A replacement should provide a clear security or operational benefit, not just a different user experience.