Microsoft plans to retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations that want to keep using those methods will need to configure and pay for their own telecommunications provider. We're looking for an MFA approach that doesn't require employees to use personal phones, purchase hardware security keys, or use paid software such as an enterprise password manager.
Our environment includes hybrid Active Directory and Microsoft Entra ID, with company-managed Windows computers. Could Windows Hello for Business provide a practical Entra-native solution for most users? If so, how should we handle employees who need access from mobile devices, shared computers, or other devices where Windows Hello isn't available? We'd appreciate recommendations and deployment experiences, especially for users who refuse to use personal phones for work authentication.
4 Answers
Windows Hello for Business is probably the closest fit for company-managed Windows devices. It can provide strong, passwordless sign-in without requiring a personal phone or separate hardware. However, you’ll need a temporary access pass or another bootstrap method when enrolling a new device, and you’ll need a recovery plan for cases where Hello stops working, a device is replaced, or a user needs access from somewhere else.
Certificates may also be worth evaluating, although they generally require more planning and operational support than Hello.
Passkeys are where the ecosystem is heading. Synced passkeys can work well for most users, while device-bound passkeys are a stronger choice for administrators and other high-value accounts. They can be quick to deploy, but mobile compatibility and credential-manager behavior can vary by device, so test the experience across your supported phones and platforms before making it the only option.
If the requirement is truly no personal phones and no purchased hardware, the practical design is to use Windows Hello for Business and restrict access to enrolled, managed Windows devices. Users who need mobile access will require a different authentication method, such as an organization-provided passkey device, authenticator app, certificate-based authentication, or a hardware token.
A temporary access pass can help with initial Hello enrollment, but it shouldn’t be treated as the long-term recovery solution. Document device replacement, lost credentials, and break-glass procedures before rollout.
There isn’t really a free option that covers every scenario while also avoiding phones and extra hardware. Windows Hello can protect access from the managed Windows computers, but it won’t authenticate users accessing work resources from their phones or unrelated shared devices.
You’ll need to choose a compromise: require users to use an authenticator or passkey on a phone, issue security keys or TOTP tokens, or use Conditional Access to block mobile access and limit users to managed devices with Windows Hello.
The main concern is that some employees won’t agree to use personal phones for work. In that case, passkeys on phones won’t solve the policy problem, even if the technical experience is good.