Microsoft will make passkeys the default authentication expertise in Entra ID starting September 1, 2026, and can totally retire its native SMS and voice multifactor authentication (MFA) supply providers on February 1, 2027.
Based on Microsoft, the transition is a part of Microsoft’s broader effort to remove phishable credentials as enterprises develop cloud utilization, distant entry, and AI-enabled workflows.
Passwords, one-time SMS codes, and voice-based verification stay frequent targets of credential phishing, adversary-in-the-middle assaults, SIM swapping, social engineering, and replay assaults.
Microsoft Entra ID Makes Passkeys Default
Underneath the brand new coverage, Entra ID tenants with customers at the moment enabled for SMS or voice authentication may have these customers robotically enabled for passkeys by way of the Authentication Strategies Coverage. When an affected consumer subsequently indicators in and is prompted for MFA, Entra ID will immediate them to register a passkey.
Microsoft will configure the Registration Marketing campaign in a Microsoft Managed state and robotically goal eligible customers. This strategy is meant to scale back administrative effort whereas accelerating adoption of phishing-resistant authentication throughout enterprise tenants.
Passkeys use public-key cryptography somewhat than shared secrets and techniques. A non-public key stays protected on the consumer’s machine or authenticator, whereas the service retains the corresponding public key.
As a result of no reusable password or one-time code is transmitted throughout authentication, passkeys are designed to withstand credential theft and phishing-based account takeover. Entra ID helps each synced and device-bound passkeys.
Synced passkeys will be saved in credential managers, together with iCloud Keychain and Google Password Supervisor, permitting customers to entry credentials throughout supported units. Machine-bound passkeys stay related to a specific platform or authenticator.
Examples of device-bound authentication choices embrace Home windows Hi there for Enterprise, Microsoft Authenticator, Entra Passkey on Home windows, and FIDO2 {hardware} safety keys.
Organizations with greater assurance necessities might favor device-bound credentials or hardware-backed keys, significantly for privileged accounts, directors, and delicate enterprise methods.
Microsoft-provided SMS and voice MFA providers will likely be retired on February 1, 2027. Organizations that also require telecom-based MFA after that date should use a customer-managed supplier obtainable by way of the Microsoft Safety Retailer. Microsoft plans to publish info on supported suppliers starting September 18, 2026.
Buyer choice and configuration capabilities are anticipated to grow to be obtainable on October 30, 2026, leaving enterprises with solely a restricted interval to judge, procure, take a look at, and deploy another telecom supplier earlier than the native service’s retirement.
The retirement creates a major operational danger for organizations that defer migration. After February 1, 2027, customers relying solely on SMS or voice authentication will obtain a blocking passkey-registration immediate.
They have to register a passkey to take care of entry to Entra-protected purposes and assets. Microsoft has said that this enforcement will apply to all tenants and that no opt-out possibility will likely be obtainable after the retirement date.
Directors ought to due to this fact establish affected customers within the Entra Authentication Strategies Coverage and legacy MFA settings as early as attainable.
Microsoft has printed a PowerShell-based utilization analyzer to assist organizations assess their dependence on SMS and voice MFA. Operating the evaluation requires International Reader, Authentication Coverage Administrator, or Safety Reader permissions.
A staged migration ought to embrace enabling FIDO2 passkeys, creating safety teams for affected customers, launching a registration marketing campaign, and issuing focused end-user communications.
Though customers can initially snooze enrollment prompts indefinitely, organizations ought to set up inside deadlines and supply clear directions for passkey registration and restoration.
Directors can quickly postpone computerized passkey enablement and registration campaigns between September 1, 2026, and February 1, 2027.
Utilizing Microsoft Graph beta, directors with the Coverage.ReadWrite.AuthenticationMethod permission can set the passkeyDynamicMigration opt-out property to true. Nonetheless, that setting doesn’t delay the SMS and voice retirement deadline.
Enterprises needing out-of-band telecom authentication should deploy a customer-managed supplier earlier than February 2027, whereas most organizations ought to prioritize passkeys, Home windows Hi there, or different phishing-resistant strategies to keep away from consumer disruption.
Cease new phishing & malware earlier than they compromise what you are promoting. Combine reside intel from 15K SOCs world wide
