I usually say that if you’re only doing MFA you’re already late. The industry is moving beyond traditional MFA and into a model where phishing-resistant authentication becomes the expected baseline.

Proof ot that is that Microsoft has announced that passkeys will become the default authentication method for Microsoft Entra ID tenants.

At the same time, Microsoft is retiring its role as a native telecom provider for MFA. This does not mean that SMS and voice are being banned as authentication methods at the protocol level, but Microsoft will no longer provide the underlying delivery service for those codes.