Gartner®, Deepfake Identity Threats: Mitigate Risk in Identity Verification and Face Biometrics, Akif Khan, Nayara Sangiorgio, James Hoover, 11 May 2026
Gartner® is a trademark of Gartner, Inc. and/or its affiliates.
Share
Share
Microsoft is changing how millions of employees prove they can access their accounts—and the implications extend well beyond replacing one authentication method with another.
This guide explains what is changing, why it matters beyond sign-in, and how identity teams can prepare.
What's Changing: Microsoft Entra is Moving Beyond SMS and Voice Authentication
Microsoft is moving away from SMS and voice authentication in favor of passkeys, marking a significant shift toward phishing-resistant security. As of September 1, 2026, users who rely on SMS or voice may be prompted to register a passkey. Microsoft-provided SMS and voice authentication is scheduled to retire for most users on February 1, 2027, with Global Administrators and external users following on July 1, 2027. Learn more about Microsoft's transition away from SMS and voice authentication.
Why Microsoft is Making the Change
The case for this change is strong: SMS and voice authentication can be compromised through phishing, SIM swapping, and social engineering. Passkeys offer a stronger alternative, using cryptographic credentials that protect against many of the vulnerabilities associated with traditional authentication.
This is an important evolution in workforce security, but it also brings a longstanding challenge into sharper focus. Passkeys can establish that someone controls an approved credential, but they don't inherently establish whether that credential was issued to the right person in the first place.
Why Authentication is Only Part of the Picture
For years, workforce security has centered on protecting credentials, securing devices, and controlling access. Organizations have invested heavily in multi-factor authentication, conditional access policies, and increasingly sophisticated identity and access management (IAM) infrastructure. These controls are essential, yet identity verification addresses an equally important question: who is the person using, enrolling, or recovering the credential?
Microsoft frames the identity lifecycle in three terms: prove, preserve, recover.
- Prove identity at enrollment before issuing a credential.
- Preserve trust over time with ongoing, risk-based controls.
- Recover access securely through strong, multi-layered identity assurance—not SMS or OTP alone.
Passkeys strengthen sign-in security, but organizations also need confidence in the person behind the credential.
Consider an employee who loses their phone and can no longer use their passkey. To regain access, they may need to contact the IT help desk, answer security questions, or complete an alternative authentication process, which stalls a legitimate employee's work.
It also creates an opening for impersonation. Rather than trying to defeat a phishing-resistant credential, an attacker might target the process used to replace it. Research from RSA reflects that concern: 51% of surveyed organizations consider service desk bypass attacks their most significant risk.
The same challenge exists during initial enrollment. If an organization issues a credential without sufficient confidence in the person receiving it, even the strongest authentication technology can't address that underlying weakness.
This is where identity assurance becomes critical. By confirming who a person is before issuing credentials or restoring access, organizations can secure the lifecycle around authentication—not just the sign-in moment.
What Identity Teams Can Do: Use Multi-Layered Identity Verification
The Role of Multi-Layered Identity Verification
A device, password, phone number, or government-issued ID can each provide useful information, but no single signal tells the complete story of who someone is. Establishing greater confidence in a person's identity requires evaluating multiple signals and corroborating them against one another.
Instead of relying on a single credential or document, a multi-layered approach to identity combines biometrics, document authenticity, device security signals, and verified data sources to establish a more complete understanding of the person requesting access.
Each layer serves a distinct purpose:
- Biometric verification helps confirm that a live person is present and matches the identity being presented.
- Document checks help determine whether a government-issued ID is authentic.
- Device security signals help detects anomalies and suspicious device patterns.
- Source validation corroborates identity attributes against credible and authoritative records, while device security evaluates signals that may indicate suspicious activity.
Together, these checks provide stronger identity assurance without introducing additional friction.
Once identity is established through a comprehensive verification process, employees can use that verified identity across critical moments, from onboarding and authenticator enrollment to account recovery and sensitive system access. This reduces repeated checks while helping organizations maintain confidence throughout the employee lifecycle.
For enterprises, this means extending security beyond the credential to the person behind it, while making it easier for legitimate employees to access the systems they need.
Building a More Secure Authentication Strategy with CLEAR1
CLEAR1 brings this multi-layered approach directly into Microsoft Entra, helping organizations strengthen account recovery within their existing identity infrastructure. Organizations can activate CLEAR1 directly through the Microsoft Security Store—without custom development—bringing high-assurance identity verification into a workflow where a user no longer has access to their primary credential.
When an employee needs to recover access, CLEAR1 helps confirm their identity with a process that's as simple as taking a selfie. The recovery flow then continues in Microsoft Entra, including Microsoft Authenticator and Verified ID steps, before a Temporary Access Pass is issued.
For employees, this provides a seamless path back to work. For security and IT teams, it adds another layer of protection against impersonation and unauthorized access without requiring a separate integration or disrupting existing IAM infrastructure. The result is stronger assurance at a critical point in the employee lifecycle, with a recovery experience designed to balance security and efficiency.
Preparing for the Next Era of Authentication
Microsoft's transition away from SMS and voice creates an immediate priority for enterprise security teams: preparing employees for passkeys and ensuring authentication policies are ready for the change.
It's also an opportunity to look more closely at the processes surrounding authentication, addressing questions such as: How are identities established before credentials are issued? What happens when an employee loses access to a device? How can organizations securely restore access without introducing new vulnerabilities or unnecessary friction?
Phishing-resistant credentials provide stronger protection at sign-in, while multi-layered identity assurance helps establish confidence in the person receiving or recovering access. With CLEAR1 integrated into Microsoft Entra, organizations can bring these capabilities together within the infrastructure they already use.
Microsoft is changing how millions of employees prove they can access their accounts—and the implications extend well beyond replacing one authentication method with another.
This guide explains what is changing, why it matters beyond sign-in, and how identity teams can prepare.
What's Changing: Microsoft Entra is Moving Beyond SMS and Voice Authentication
Microsoft is moving away from SMS and voice authentication in favor of passkeys, marking a significant shift toward phishing-resistant security. As of September 1, 2026, users who rely on SMS or voice may be prompted to register a passkey. Microsoft-provided SMS and voice authentication is scheduled to retire for most users on February 1, 2027, with Global Administrators and external users following on July 1, 2027. Learn more about Microsoft's transition away from SMS and voice authentication.
Why Microsoft is Making the Change
The case for this change is strong: SMS and voice authentication can be compromised through phishing, SIM swapping, and social engineering. Passkeys offer a stronger alternative, using cryptographic credentials that protect against many of the vulnerabilities associated with traditional authentication.
This is an important evolution in workforce security, but it also brings a longstanding challenge into sharper focus. Passkeys can establish that someone controls an approved credential, but they don't inherently establish whether that credential was issued to the right person in the first place.
Why Authentication is Only Part of the Picture
For years, workforce security has centered on protecting credentials, securing devices, and controlling access. Organizations have invested heavily in multi-factor authentication, conditional access policies, and increasingly sophisticated identity and access management (IAM) infrastructure. These controls are essential, yet identity verification addresses an equally important question: who is the person using, enrolling, or recovering the credential?
Microsoft frames the identity lifecycle in three terms: prove, preserve, recover.
- Prove identity at enrollment before issuing a credential.
- Preserve trust over time with ongoing, risk-based controls.
- Recover access securely through strong, multi-layered identity assurance—not SMS or OTP alone.
Passkeys strengthen sign-in security, but organizations also need confidence in the person behind the credential.
Consider an employee who loses their phone and can no longer use their passkey. To regain access, they may need to contact the IT help desk, answer security questions, or complete an alternative authentication process, which stalls a legitimate employee's work.
It also creates an opening for impersonation. Rather than trying to defeat a phishing-resistant credential, an attacker might target the process used to replace it. Research from RSA reflects that concern: 51% of surveyed organizations consider service desk bypass attacks their most significant risk.
The same challenge exists during initial enrollment. If an organization issues a credential without sufficient confidence in the person receiving it, even the strongest authentication technology can't address that underlying weakness.
This is where identity assurance becomes critical. By confirming who a person is before issuing credentials or restoring access, organizations can secure the lifecycle around authentication—not just the sign-in moment.
What Identity Teams Can Do: Use Multi-Layered Identity Verification
The Role of Multi-Layered Identity Verification
A device, password, phone number, or government-issued ID can each provide useful information, but no single signal tells the complete story of who someone is. Establishing greater confidence in a person's identity requires evaluating multiple signals and corroborating them against one another.
Instead of relying on a single credential or document, a multi-layered approach to identity combines biometrics, document authenticity, device security signals, and verified data sources to establish a more complete understanding of the person requesting access.
Each layer serves a distinct purpose:
- Biometric verification helps confirm that a live person is present and matches the identity being presented.
- Document checks help determine whether a government-issued ID is authentic.
- Device security signals help detects anomalies and suspicious device patterns.
- Source validation corroborates identity attributes against credible and authoritative records, while device security evaluates signals that may indicate suspicious activity.
Together, these checks provide stronger identity assurance without introducing additional friction.
Once identity is established through a comprehensive verification process, employees can use that verified identity across critical moments, from onboarding and authenticator enrollment to account recovery and sensitive system access. This reduces repeated checks while helping organizations maintain confidence throughout the employee lifecycle.
For enterprises, this means extending security beyond the credential to the person behind it, while making it easier for legitimate employees to access the systems they need.
Building a More Secure Authentication Strategy with CLEAR1
CLEAR1 brings this multi-layered approach directly into Microsoft Entra, helping organizations strengthen account recovery within their existing identity infrastructure. Organizations can activate CLEAR1 directly through the Microsoft Security Store—without custom development—bringing high-assurance identity verification into a workflow where a user no longer has access to their primary credential.
When an employee needs to recover access, CLEAR1 helps confirm their identity with a process that's as simple as taking a selfie. The recovery flow then continues in Microsoft Entra, including Microsoft Authenticator and Verified ID steps, before a Temporary Access Pass is issued.
For employees, this provides a seamless path back to work. For security and IT teams, it adds another layer of protection against impersonation and unauthorized access without requiring a separate integration or disrupting existing IAM infrastructure. The result is stronger assurance at a critical point in the employee lifecycle, with a recovery experience designed to balance security and efficiency.
Preparing for the Next Era of Authentication
Microsoft's transition away from SMS and voice creates an immediate priority for enterprise security teams: preparing employees for passkeys and ensuring authentication policies are ready for the change.
It's also an opportunity to look more closely at the processes surrounding authentication, addressing questions such as: How are identities established before credentials are issued? What happens when an employee loses access to a device? How can organizations securely restore access without introducing new vulnerabilities or unnecessary friction?
Phishing-resistant credentials provide stronger protection at sign-in, while multi-layered identity assurance helps establish confidence in the person receiving or recovering access. With CLEAR1 integrated into Microsoft Entra, organizations can bring these capabilities together within the infrastructure they already use.
