Technology · 10 Aug
Microsoft Entra ID makes passkeys the default and begins retiring SMS and voice sign-in
Microsoft Entra ID is making passkeys the default authentication experience. From September 1, 2026, users currently enabled for SMS or voice will be automatically enabled for passkeys, and the registration campaign will prompt them to register one at their next MFA sign-in. From February 1, 2027, Microsoft-provided telecom delivery for SMS and voice is retired completely. After that date, any user whose only available MFA method is SMS or voice will hit a blocking prompt that requires registering a passkey before they can sign in — explicitly no opt-out, enforced for all tenants.
Organizations with a genuine regulatory or operational need for SMS or voice can keep it by contracting a customer-managed telecom provider through the Microsoft Security Store: provider details arrive September 18, 2026, and configuration becomes possible October 30, 2026. Until then, a temporary opt-out of the September 1 auto-enablement exists via a Graph API setting (passkeyDynamicMigration set to true in the authentication methods policy), but it does not extend past February 1, 2027.
Admins should find which users still rely on SMS or voice — Microsoft provides a PowerShell script for this — then follow the passkey deployment guide and run a phased user-communication plan. Passkeys come in two forms: synced ones stored in platform credential managers (iCloud Keychain, Google Password Manager) and device-bound ones (Microsoft Authenticator, Windows, FIDO2 hardware keys).