On 1 September 2026 Microsoft Entra ID started making passkeys the default sign-in method. Every user enabled for SMS or voice in the Authentication Methods Policy, or in legacy MFA settings, was auto-enabled for passkeys. Tenants' registration campaigns were switched to a Microsoft-managed state, so those users now see a prompt to register a passkey after their next MFA sign-in.
That's the gentle phase. On 1 February 2027 Microsoft stops delivering SMS and voice codes itself for most users, and anyone whose only MFA method is SMS or voice will have to register a passkey before they can sign in.
What's affected
Microsoft Entra ID tenants in the public cloud. Microsoft says other clouds will follow on a later schedule. Azure AD B2C is out of scope, and Microsoft Entra External ID changes come next year under a separate announcement.
The timeline from Microsoft Learn:
| Date | What happens |
|---|---|
| 1 Sep 2026 | SMS and voice users auto-enabled for passkeys and nudged to register. Snoozes are unlimited by default. |
| 30 Oct 2026 | Configuration of third-party telephony providers through Microsoft Security Store opens. |
| 1 Feb 2027 | Microsoft-provided SMS and voice retired for all users except Global Administrators and external users. Internal guests are in this group. |
| After 1 Feb 2027 | Users whose only MFA method is SMS or voice get a blocking passkey registration prompt. |
| 1 Jul 2027 | Same retirement for Global Administrators and external users. |
The retirement applies across Entra, including self-service password reset. Tenants with a genuine need for SMS or voice can keep it by contracting a telephony provider through Microsoft Security Store. Soprano and Telesign are the initial providers in private preview.
Auto-enabled users are placed in a passkey profile that allows all passkey types. That includes synced passkeys in platform credential managers such as iCloud Keychain and Google Password Manager, as well as device-bound passkeys in Microsoft Authenticator, Windows, or a FIDO2 security key.
How to check if you're exposed
Find out who still relies on SMS or voice. Microsoft publishes a PowerShell analyzer at github.com/microsoft/entra-sms-voice-usage-analyzer. You need Global Reader, Authentication Policy Administrator or Security Reader. Microsoft says any non-zero result means you are in scope.
Check whether your tenant opted out of the automatic enablement:
az rest --method GET \
--url "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy" \
--query "optOutSettings"
Check the registration campaign state in the admin center under Entra ID, Authentication methods, Registration campaign.
Then decide whether your Conditional Access policies will accept passkeys where users need them. If a policy requires a specific authentication strength that excludes the passkey type users register, they will be nudged to enroll something they can't use.
What to do now
- Run the usage analyzer and put the SMS and voice users into a security group. Microsoft's guidance uses that group for both the registration campaign and user communications.
- Decide on synced versus device-bound passkeys. The auto-enabled profile allows all types. If your policy requires device-bound keys for admins or regulated users, create a separate passkey profile for those groups now.
- Move Global Administrators first, even though their deadline is later. Admins on SMS are the accounts attackers most want to SIM-swap.
- Fix break-glass accounts. Emergency access accounts with only SMS will hit a blocking prompt after the retirement date. Give them FIDO2 keys stored securely.
- Use the opt-out only if you have a real plan. Setting
optOutSettings.passkeyDynamicMigrationtotruethrough Microsoft Graph delays the September changes until 1 February 2027. It doesn't delay enforcement. Microsoft is explicit that there is no opt-out from the retirement itself. - Evaluate a telephony provider only for segments with a documented regulatory or operational need, from 30 October.
- Communicate. Microsoft calls coordinated communications "the single biggest predictor of a smooth passkey rollout."
Why it matters
SMS codes can be phished and SIM-swapped. Microsoft's FAQ calls SMS and voice "among the most vulnerable authentication methods available today." Changing Entra ID's defaults to passkeys moves the work from "should we" to "by when."
The risk for security teams is a quiet migration. Users will register whatever passkey type is easiest on their phone, and that may not match the device-bound policy your auditors expect. Choosing the profile deliberately now costs less than cleaning it up later.
For compliance, this is also evidence. Frameworks that ask for phishing-resistant MFA for privileged access now have a vendor-driven deadline to point at.
Try it yourself
Run the usage analyzer in a test or production tenant with read-only rights and count the in-scope users. Split them by role: admins, standard users, guests, service accounts. That split is your migration plan. The demo below shows how authentication controls map to framework requirements, which helps when you report progress.
Click through it at your own pace, or open it full screen.
Quick check
Will users be locked out on 1 February 2027?
No, according to Microsoft. Users whose only MFA method is SMS or voice get a blocking prompt to register a passkey and must complete it before they can continue signing in.
Does the opt-out stop the retirement?
No. passkeyDynamicMigration only delays the automatic passkey enablement and registration campaign until 1 February 2027. There is no opt-out for enforcement.
Can we keep SMS for a regulated user group?
Yes, through a telephony provider configured in Microsoft Security Store, available from 30 October 2026. Microsoft recommends passkeys for every other segment.
