Notifications
Clear all
Topic starter
11/07/2026 8:27 pm
TL;DR: Passage will be retired on January 16, 2026, leaving teams about three months to migrate authentication flows before SDKs, APIs, and hosted services stop receiving updates and security patches, according to Authsignal. The real issue is not feature parity alone, but whether identity teams can move without turning a planned migration into an availability and risk event.
NHIMG editorial — based on content published by Authsignal: Looking for a Passage alternative? Why teams are migrating to Authsignal
By the numbers:
- 16, ssage will be retired on January 16, 2026, giving teams about three months to plan, rebuild, and migrate.
- The platform has processed millions of passkey authentications, with passkeys making up 62% of authentication volume.
Questions worth separating out
Q: How should security teams handle an authentication platform retirement without disrupting users?
A: Start with a complete dependency map of applications, SDKs, recovery flows, and admin paths, then rank them by business criticality and migration complexity.
Q: Why do passkeys still need adaptive MFA in enterprise IAM programmes?
A: Passkeys remove password replay and phishing risk, but they do not tell you whether a session is normal, risky, or fraudulent.
Q: What breaks when authentication orchestration is missing during a migration?
A: Without orchestration, teams usually hardcode policy decisions into applications or duplicate them across channels, which creates inconsistent challenge logic and poor visibility.
Practitioner guidance
- Inventory every authentication dependency List all apps, SDKs, hosted flows, recovery paths, and admin consoles that rely on the retiring platform.
- Rebuild the migration plan around risk-based step-up Define which user behaviours, devices, and session conditions should trigger stronger authentication in the replacement stack.
- Preserve audit evidence through the transition Make sure the new platform logs challenge decisions, authenticator changes, failure reasons, and fallback usage.
What's in the full article
Authsignal's full article covers the operational detail this post intentionally leaves for the source:
- Comparative guidance on passkey, MFA, and orchestration capabilities for teams replacing Passage
- Implementation notes on integrating with AWS Cognito, Azure AD B2C, Auth0, and Keycloak
- Examples of no-code authentication rules and real-time analytics workflows
- Procurement and deployment details for teams planning a staged migration
👉 Read Authsignal's guidance on migrating from Passage to a passkey and MFA platform →
Passage retirement and auth migration: what IAM teams should do now?
Explore further
11/07/2026 8:56 pm
Passkey migration is now an identity continuity problem, not a feature upgrade. When a core authentication service is retired, the enterprise inherits a hard deadline for preserving access, assurance, and supportability at the same time. That shifts the work from product selection to operational continuity, because the failure mode is not theoretical lockout but an unfinished cutover that affects production sign-in. IAM teams should treat retirement dates as governance milestones, not procurement reminders.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What should IAM leaders evaluate before replacing a retired login platform?
A: Look beyond sign-in success and assess portability, auditability, fallback design, and long-term maintainability. A replacement should support current authentication methods, give you evidence of policy decisions, and avoid trapping recovery logic inside one vendor stack. If the architecture cannot survive the next product change, it is not truly future-ready.
👉 Read our full editorial: Passage retirement shows why authentication migration cannot wait
