Secure access is decided long before the sign-in method.
A modern strategy decides who gets in, from which device, to which application and under what risk, and only then with which credential. Our experts take you from minimum compliance to adaptive, passwordless access.
SMS and voice MFA retire on February 1, 2027.
Users whose only method is a phone will not be able to sign in, with no fallback. It is the urgent first step of a secure access strategy, and the best moment to start one.
SMS and voice are no longer accepted as MFA.
One governed access model
Authentication methods are the tip of the iceberg. Under the waterline, these six domains decide every access request.
Identity Protection
User and administrator identity protection, privileged access, identity governance and risk-based protection.
Authentication Modernization
MFA, phishing-resistant methods, FIDO2, passkeys and governance of authentication methods.
Conditional Access
Policy enforcement, user and device context, risk signals and session controls.
Applications & Workload Access
Enterprise and SaaS applications, application identities, service principals and workload protection.
Device Trust
Managed and compliant devices, BYOD controls and endpoint health signals.
Modern Operations & Agentic Security
Agentic operations, automated remediation, agentic change management and user assistance agents.
Passwordless is roughly 10–15% of the landscape. It is a capability inside the architecture, not the architecture itself.
Crawl, walk, run, fly
Each step builds on the licensing you may already own. We start where you are and sequence the rest.
Crawl
Resolve the immediate urgency and reach a minimum compliant state
- Remove legacy authentication methods
- Retire SMS and voice call
- Register at least one strong method
- Bring every user to minimum compliance
Walk
Move from authentication to a real access strategy
- User, group and application-based policy enforcement
- Authentication strength requirements (MFA and passkeys)
- Device trust validation and Continuous Access Evaluation
- Session controls and application access restrictions
- Modern apps with MSAL integration for internal apps
Run
Extend access policy beyond Microsoft 365
- Adaptive policies based on user and device risk
- Authentication strength enforcement
- Conditional Access App Control for cloud applications
- Endpoint risk integration with Defender for Endpoint
- Identity Governance for access lifecycle and entitlements
Fly
A cross-cutting secure access architecture
- Private and legacy apps through Entra Private Access
- Policy-based internet access through Entra Internet Access
- Automated identity lifecycle governance with approvals
- Governance and access control for AI agents and workload identities
- Centralized agent identity management with Entra Agent ID
Find your maturity level
The question is not whether you already use Authenticator or passkeys. It is how prepared you are to guarantee continuity, resilience and long-term identity control.
Consulting, technology and operation
One strategy, delivered through our experts, our own E-Suite solutions and our managed services.
Consulting E-xperiences
Passwordless Readiness packages, from a free read-only review of your tenant to a full rollout with knowledge transfer, delivered by our identity experts.
E-Suite technology
Secure Access Intelligence Report, Passwordless Readiness and Adoption agents, and Micro-Visor Passwordless in Microsoft Teams.
Managed Services
Policies, methods and risk kept under continuous operation, with reporting that proves adoption over time.
Frequently asked questions
Is passwordless the same as a secure access strategy?
No. Passwordless replaces the credential, but access is decided by identity, device, application, risk and Conditional Access. A secure access strategy governs all of them; phishing-resistant methods are one control inside it.
What changes on February 1, 2027?
SMS and voice call are retired as MFA methods. Registration of a compliant method becomes mandatory and users whose only method is a phone cannot sign in. Passkeys have been the default since September 1, 2026.
Do we need new licenses?
Not necessarily. Each maturity step builds on licensing many organizations already own, from Entra ID Free for the first step to Entra ID P1, P2 and the Entra Suite for the next ones. Much of the value comes from activating and governing what you already have.
Can we start without changing production?
Yes. Passwordless Readiness Free is a read-only review of your tenant with findings and recommendations, with no configuration activities and no commercial commitment.
Where and in which languages do you deliver?
Across the Americas and Europe, in English or Spanish, in person or remote.
Plan your secure access strategy
Tell us where you are today. A Synergy Advisors expert will recommend the right starting point.
Share your contextUsers, authentication methods, licensing and timeline.
Get a recommendationThe package or maturity step that fits, with scope and next steps.
Move before the deadlineIn English or Spanish, in person or remote.