An empty pocket. A working day on hold.
Imagine a consultant travelling to a client meeting. At the station, she reaches for her phone and finds an empty pocket. Her laptop is open, but the sign-in screen wants an approval from the missing device. The meeting details are in Teams, the latest client document is in SharePoint and an email needs answering.
This is an illustrative scenario, not a reported incident. Nothing dramatic has happened yet. But an ordinary working morning has become a question of access, information and trust. Borrowing a colleague's phone does not recreate her authentication method. A replacement SIM may restore a number, but not the credentials or work applications on the old handset.
Who verifies that the person requesting help really is the employee? Who decides whether the missing phone holds company information? Who restores access without leaving the old route into the account available? The network, IT team and employee may each expect someone else to know.
A lost phone used to mean a call to the mobile network. Today, it can mean losing the way into the working day.
The handset is only part of the story.
Outlook, Teams, SharePoint and business apps have made phones useful working tools. They may hold client correspondence, downloaded documents and active sign-in sessions. The same device may approve multi-factor authentication, or MFA: an extra check that helps prove who you are when you sign in, rather than relying on a password alone.
That does not make a phone compulsory. Hardware security keys, Windows Hello on a computer and other approved methods can provide different routes into an account. Nor is every notification from an authentication app a passkey. The important question is which credentials people actually use, and what remains available when one is lost.
Organisations often buy handsets and airtime through procurement, leave Microsoft identity with IT and treat replacements as a support issue. Each arrangement can be sensible in isolation. The weakness appears between them: a new device arrives, but nobody owns the employee's safe return to work.
2027 is a prompt to check the route back in.
Microsoft is retiring Microsoft-provided SMS and voice authentication delivery in Entra ID, its business identity service. The dates below follow the current FAQ, not the simpler wording in the July announcement. This is not a ban on all SMS MFA: supported telephony providers through Microsoft Security Store remain an option for justified needs, requiring configuration and a transition before the relevant deadline.[source]
Since 1 September 2026, users enabled for SMS or voice have been automatically enabled for passkeys and nudged to register. Enabled does not mean registered. At the applicable retirement date, users whose only available MFA method is native SMS or voice, with no alternative telephony provider, must register a passkey before continuing. Users with another approved registered method are not universally forced to do so.[source]
The scope is Microsoft's public cloud, including GCC. Other clouds have separate later schedules. Azure AD B2C is outside this change; External ID tenants await a separate announcement. Those tenants are not the same as external users in workforce tenants.[source]
Passkeys are digital sign-in credentials that prove possession without handing a reusable secret to a fake website. They can be held on compatible phones, computers, supported synced providers or physical FIDO2 security keys. Policy and compatibility matter. The board-level question is not which handset to buy, but whether access and recovery are ready for change.[source][source]
Different phones need different boundaries.
BYOD means bring your own device: an employee uses a personally owned phone for work. Start with the work they need to do, the sensitivity of the information and the platforms you can support. NCSC guidance emphasises objectives and risk, not a single answer for everybody.[source]
Corporate-owned, fully managed
StrengthDevice configuration, approved apps and compliance can be managed. Useful where the organisation needs tighter control of a business-owned phone.
LimitOwnership alone is not protection. Enrolment, maintained policies and an agreed replacement process still matter.
Personal phone, protected work apps
StrengthSupported app policies can restrict work-data movement and selectively remove managed company information without wiping personal photographs or messages.
LimitThis does not manage the whole phone or protect every app. Selective deletion needs the app to receive and process the request.
Alternative authenticators
StrengthAn approved hardware security key or computer-based credential can reduce reliance on one phone and suit sensitive roles.
LimitA second credential still needs secure registration, user support and recovery. It does not protect data already on a phone.
Mobile device management, or MDM, enrols a device so IT can configure and manage it. Mobile application management, or MAM, protects company information inside supported work apps, potentially without full device enrolment. They solve different problems. App protection is not an assurance that the whole personal phone is compliant.[source]
Capabilities depend on the platform, licence, app and configured policy. Agree permitted access, support boundaries and deletion rights before trouble occurs. A company should protect its information without assuming ownership of an employee's private life. Some roles need a managed corporate phone; others can work safely within narrower app-level controls.[source][source]
A lost phone starts three jobs, not one.
Secure the identity
Verify the employee independently through an agreed process, not caller claims or a familiar voice. Review account risk, remove lost authentication methods and revoke sessions where appropriate. A convincing request for an MFA reset is not proof of identity; urgency must not become an exception to the checks.
Protect company information
Establish ownership, management status and what work data may be present. Use supported, authorised lock, selective work-data removal or device wipe as appropriate. These actions are not interchangeable. Revoking a credential or session does not erase all local data, and an offline phone may not receive a deletion request promptly. Consider whether a data-breach assessment and reporting obligations arise.[source]
Restore safe access
Recover or issue an approved credential, arrange a replacement device or alternative authenticator and record the change. Where policy allows, an authorised administrator can issue a Temporary Access Pass, or TAP: a time-limited credential that helps bootstrap registration or recovery of strong authentication. It follows independent identity verification; it does not replace it. Issuing one does not automatically remove the old methods.[source]
These jobs may overlap, but somebody must coordinate them. Returning to email is not the same as closing the incident. Confirm which protections actually took effect, what remains outstanding and whether the employee can work securely while a replacement is arranged.
Five responsibilities. One accountable outcome.
The network can restore connectivity. IT can manage an account. A security provider may investigate risk. HR knows when people join, change roles or leave. None necessarily owns the whole journey unless the organisation has explicitly assigned it.
Name an accountable owner for the outcome, then agree who performs each part. That owner needs visibility of device records, authentication dependencies, support arrangements and exceptions. This does not mean one supplier must do everything. It means handovers should not depend on an employee explaining the same loss to three unrelated desks.
Include ordinary changes, not just emergencies. A phone upgrade, a new starter and a leaver can all change the relationship between person, device and credential. Evidence should show what was issued, what was removed and who authorised it. Rehearse recovery before someone is standing on a station platform.
For Wavex, the useful connection is between security and governance and the practical support that keeps people working. The responsibilities still need to be agreed, not assumed.
Seven questions worth asking before the next loss.
Ask for evidence, not just a reassuring yes. A device inventory, a written recovery process and a clear service boundary tell you more than a list of products. Use these questions in the next IT review:
- Do we know which employees use personal or company phones for work and authentication?
- Which users still rely on Microsoft-provided SMS or voice, and what is our transition plan?
- Are corporate phones managed and are suitable BYOD apps protected?
- Can we revoke access and remove business data without unnecessarily affecting personal data?
- How do we independently verify a user who has lost their authentication device?
- How quickly can we restore access safely, including out of hours, and who is actually contracted to do it?
- Who reviews compliance, exceptions, lost-device events and starter/leaver processes?
Where the answer is unclear, agree an owner and a next action. Out-of-hours cover, personal-device support and replacement times should be defined in the service agreement, not inferred from the availability of a helpdesk number.
Start with ownership, not another tool.
A mobile contract is not a mobile security strategy. The sensible next step is to review ownership and practise recovery, not reflexively buy more tools. Wavex's approach is to connect devices, Microsoft identity, security and support where appropriate, with the level of management and responsibilities agreed. Different service levels do not include identical controls. The test is simple: can your organisation protect its information and help a verified employee return to work when the phone is no longer there?
The practical questions, answered.
What changes to Microsoft SMS MFA on 1 February 2027?
Microsoft-provided SMS and voice delivery retires for standard users and internal guests in the public cloud, including GCC. Active Global Administrators and external users have a 1 July 2027 date. Supported alternative telephony providers remain possible. Other clouds, Azure AD B2C and External ID tenants have different scope or timelines.
Do passkeys have to be stored on a mobile phone?
No. Depending on organisational policy and compatibility, passkeys can be held on phones, computers, supported synced providers or physical FIDO2 security keys. A phone can be one approved credential, not the only route into work.
Can a company protect work data on an employee's personal phone?
Supported app protection can control and selectively remove managed work data without full device enrolment. Capabilities depend on platform, licence, app and policy. It does not manage the whole phone, and deletion is not an instant guarantee while the device is offline.
What should happen when a phone used for MFA is lost?
Independently verify the employee, review lost authentication methods and sessions, assess company data and restore access using an approved credential. A Temporary Access Pass may help registration after verification. Revoking access does not itself erase locally stored information.
What is the difference between MDM and MAM?
Mobile device management enrols and manages a device. Mobile application management protects company data inside supported work apps and can operate without full device enrolment. App-level protection and whole-device management are different controls, chosen according to ownership, work needs and risk.