Phishing-Resistant by Default: What Microsoft's Passkey Shift Means for You with Nathan McNulty (Patriot Consulting) and Eric Woodruff (Semperis)
Show notes
Passkeys are now the default authentication method in Entra ID. If you’re responsible for Entra ID identity, the question you face is not “Should I care about passkeys?” but “How do I move forward without breaking the user experience—or the business?”
This episode features Nathan McNulty, Principal Security Solutions Architect at Patriot Consulting, and Eric Woodruff, Chief Identity Architect at Semperis, who explain Microsoft's September 1 change and the looming retirement of SMS and voice in February 2027. They uncover the quirks of registration campaigns, debate the tradeoffs between device-bound and synced passkeys, and emphasize that passkeys only protect users once weaker fallback methods are removed. They close with a new risk: attackers registering their own passkeys to keep access to an account.
The takeaway: Passkey shift is a planning problem to start now, not when SMS officially goes away.
Nathan is a Microsoft MVP who has consulted hundreds of organizations. Before that, he built a security program from scratch at a school district of roughly 50,000 users. Eric is a Microsoft MVP for Security with over 25 years in IT and cybersecurity, including time at Microsoft—and he led the passkey rollout at Semperis.
Guest Bios
Nathan McNulty Nathan McNulty is a Microsoft MVP and Principal Security Solutions Architect for Patriot Consulting where he helps clients securely implement Azure, Entra, Defender, and Intune. He started his career on helpdesk for a civil engineering firm before becoming their Enterprise Desktop Administrator. He later took a role as the Client Architect for a large school district of roughly 50K users where he became their cloud architect and security architect, spending several years building their security program from scratch. He has also worked with industrial control systems and several non-profits and consulted for hundreds of organizations across many sectors.
Eric Woodruff With over 25 years in IT and cybersecurity, Eric Woodruff has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Senior Premier Field Engineer, and spent almost 15 years in the public sector, 10 of them as a technical manager.
Eric is a Microsoft MVP for security, recognized for his expertise in the Microsoft identity ecosystem. His security research has also been recognized by Microsoft, most notably for his findings dubbed “UnOAuthorized.” Eric is a strong proponent of knowledge sharing and spends a good deal of time sharing his insights and expertise at conferences as well as through blogging. Eric further supports the professional security and identity community as an IDPro member, working as part of the IDPro Body of Knowledge committee.
Guest Quotes “Instead of looking at how do I postpone this or how do I still make this work for some of my users, try to focus on the ones that we know we can fix and try to get them over to using passkeys.” - Nathan McNulty
“In the end, the tech bit is always the easy part, right? It's turn a few knobs and dials. It's the people part that is the challenge.” - Eric Woodruff
Time stamps 01:44 Meet Nathan McNulty and Eric Woodruff 02:49 Microsoft Makes Passkeys the Entra ID Default 06:01 Why Retaining Weaker Methods Undermines Passkeys 08:36 The Cost and Risk of SMS Authentication 12:12 What Changes for Existing Tenants 14:52 Device-Bound vs. Synced Passkeys 19:40 Taking Control of Registration Campaigns 22:19 Communicating a Passkey Rollout 24:36 What Passkey Sign-In Looks Like for Users 28:16 Conclusion and Final Thoughts
Sponsor The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.