Microsoft Entra ID to Make Passkeys Default, Retire SMS and Voice Authentication
Summary
Microsoft will make passkeys the Entra ID default starting September 2026 and retire SMS and voice authentication on February 1, 2027. Users relying on phone-based MFA will be prompted to register passkeys.
Key points
- Microsoft plans to make passkeys the default Entra ID authentication method starting in September 2026.
- Users enabled for SMS or voice authentication will be enabled for passkeys and prompted to register one at their next multifactor authentication.
- Microsoft will retire its SMS and voice delivery service and remove those methods as native Entra capabilities on February 1, 2027.
- Existing phishing-resistant options, including Windows Hello for Business, FIDO2 security keys, and smart cards, will continue to work.
- Organizations can use Microsoft’s Entra SMS/Voice Policy Scanner PowerShell script to identify users relying on phone authentication.
- Microsoft recommends moving users to phishing-resistant authentication to reduce risks from credential theft and phishing.
Article Details
- Event Type
- Microsoft Entra ID authentication policy change: passkeys will become the default authentication method, and Microsoft-provided SMS and voice authentication will be retired.
- Impact
- Starting in September 2026, users who rely on SMS or voice authentication will be enabled for passkeys and prompted to register at their next multifactor authentication. On February 1, 2027, SMS and voice will no longer be available as native Microsoft Entra authentication methods, so organizations must move affected users to phishing-resistant methods or configure third-party telecom providers if phone-based authentication is still required. Microsoft says the change is intended to reduce phishing and credential-theft risks.