#mfa
- Analysis · Nov 9, 202654% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let admins require them, and 60% of apps with a documented SSO plan charge more for SSO. Here is what the matrix is and how to use it.
- Analysis · Nov 3, 202646.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and in 2025-2026, 20 of 43 breaches abused a path with no login for MFA to protect at all.
- Analysis · Sep 29, 2026The SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and the new federal front door runs on Login.gov. Here is how to plan the move off SMS without creating a new weak point in recovery.
- News · Sep 21, 2026Entra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signing in. Global Administrators and external users get until July 1. Keeping SMS means buying it from a telephony provider.