Passkeys are now the default authentication method in Entra ID. If you’re responsible for Entra ID identity, the question you face is not “Should I care about passkeys?” but “How do I move forward without breaking the user experience—or the business?”
This episode features Nathan McNulty, Principal Security Solutions Architect at Patriot Consulting, and Eric Woodruff, Chief Identity Architect at Semperis, who explain Microsoft's September 1 change and the looming retirement of SMS and voice in February 2027. They uncover the quirks of registration campaigns, debate the tradeoffs between device-bound and synced passkeys, and emphasize that passkeys only protect users once weaker fallback methods are removed. They close with a new risk: attackers registering their own passkeys to keep access to an account.
The takeaway: Passkey shift is a planning problem to start now, not when SMS officially goes away.
Nathan is a Microsoft MVP who has consulted hundreds of organizations. Before that, he built a security program from scratch at a school district of roughly 50,000 users. Eric is a Microsoft MVP for Security with over 25 years in IT and cybersecurity, including time at Microsoft—and he led the passkey rollout at Semperis.
Guest Bios
Nathan McNulty
Nathan McNulty is a Microsoft MVP and Principal Security Solutions Architect for Patriot Consulting where he helps clients securely implement Azure, Entra, Defender, and Intune. He started his career on helpdesk for a civil engineering firm before becoming their Enterprise Desktop Administrator. He later took a role as the Client Architect for a large school district of roughly 50K users where he became their cloud architect and security architect, spending several years building their security program from scratch. He has also worked with industrial control systems and several non-profits and consulted for hundreds of organizations across many sectors.
Eric Woodruff
With over 25 years in IT and cybersecurity, Eric Woodruff has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Senior Premier Field Engineer, and spent almost 15 years in the public sector, 10 of them as a technical manager.
Eric is a Microsoft MVP for security, recognized for his expertise in the Microsoft identity ecosystem. His security research has also been recognized by Microsoft, most notably for his findings dubbed “UnOAuthorized.” Eric is a strong proponent of knowledge sharing and spends a good deal of time sharing his insights and expertise at conferences as well as through blogging. Eric further supports the professional security and identity community as an IDPro member, working as part of the IDPro Body of Knowledge committee.
Guest Quotes
“Instead of looking at how do I postpone this or how do I still make this work for some of my users, try to focus on the ones that we know we can fix and try to get them over to using passkeys.” - Nathan McNulty
“In the end, the tech bit is always the easy part, right? It's turn a few knobs and dials. It's the people part that is the challenge.” - Eric Woodruff
Time stamps
01:44 Meet Nathan McNulty and Eric Woodruff
02:49 Microsoft Makes Passkeys the Entra ID Default
06:01 Why Retaining Weaker Methods Undermines Passkeys
08:36 The Cost and Risk of SMS Authentication
12:12 What Changes for Existing Tenants
14:52 Device-Bound vs. Synced Passkeys
19:40 Taking Control of Registration Campaigns
22:19 Communicating a Passkey Rollout
24:36 What Passkey Sign-In Looks Like for Users
28:16 Conclusion and Final Thoughts
Sponsor
The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.
Links
Connect with Nathan on LinkedIn
Connect with Eric on LinkedIn
Connect with Sean on LinkedIn
Don't miss future episodes
Learn more about Semperis
