Secure Cyber Blog

Microsoft Entra ID Identity and Security Updates: What Passkeys-by-Default Means for Your Organization

Written by SecureCyber | Sep 9, 2026, 5:35:08 PM

By Matthew Williams | Your Translator for Microsoft's Fine Print

The Short Version

Microsoft has announced a major identity and security update for Entra ID (the identity system behind Microsoft 365 sign-in): passkeys are becoming the default authentication experience, and Microsoft-provided SMS and voice codes for MFA are being phased out as part of that shift. Starting September 1, 2026, anyone in your tenant currently using SMS or voice codes for multi-factor authentication will be automatically enrolled in passkeys and nudged to register one. From February 1, 2027, Microsoft stops providing SMS and voice delivery entirely, and there's no opt-out: if a user's only MFA method is still a text or phone call on that date, they'll be blocked at sign-in until they register a passkey. If your organization still leans on text-message codes for MFA, the work to get ahead of this starts now, not next year.

What's Actually Changing

For years, the easiest way to add a second sign-in step was a code texted or called in. It felt secure because it was a second thing, but it's built on your phone network, and phone networks can be tricked. A SIM swap, a forwarded call, an intercepted text, and that "second factor" isn't so second anymore.

A passkey works differently. Instead of a code that travels over a phone network and can be intercepted or phished, it's a cryptographic key tied to your device or a secure credential store (like your phone's built-in security chip). There's no code to read back to an attacker on a fake login page, because there's no code at all.

Here's the rollout Microsoft has published:

  • September 1, 2026: Passkeys become the default sign-in experience in Entra ID. Any user still enabled for SMS or voice is automatically enrolled for passkeys, and the next time they complete MFA, they'll see a registration prompt. By default, that prompt can be snoozed indefinitely unless an admin turns that off.
  • September 18, 2026: Microsoft opens details on customer-managed telecom providers through the Microsoft Security Store, for organizations that have a genuine ongoing need for SMS or voice.
  • October 30, 2026: Organizations that need to keep using SMS or voice can select and configure one of those third-party telecom providers.
  • February 1, 2027: Microsoft-provided SMS and voice delivery is fully retired. If your tenant hasn't moved users to passkeys or configured a customer-managed telecom provider by this date, affected users lose the ability to sign in with SMS or voice.
  • Any user still enrolled in SMS or voice MFA in your tenant's Authentication Methods Policy or legacy MFA settings. Microsoft provides a PowerShell-based usage analyzer specifically to find them.
  • Self-service password reset (SSPR), which relies on the same retiring telecom delivery and is in scope alongside standard MFA.
  • Regulated or compliance-driven teams that specifically require an out-of-band SMS channel. These organizations aren't left with nothing, but they'll need to contract a customer-managed telecom provider through the Microsoft Security Store, which is a new cost line that didn't exist when Microsoft provided this natively.
  • B2B and guest users, who are included in scope for the retirement, though Microsoft has said passkey support for that population is planned by the end of calendar year 2026, worth tracking if your org relies heavily on guest access.
  • Help desk and support teams, who should expect a wave of "why am I being asked to set up a passkey" calls once the September auto-enrollment reaches your tenant.

The part worth reading twice: after February 1, 2027, any user whose only MFA method is still SMS or voice will hit a blocking prompt at sign-in and must register a passkey to get into their account. Microsoft has been explicit that there is no opt-out from this enforcement, it applies to every tenant. A temporary opt-out property does exist for the September 1 auto-enrollment (passkeyDynamicMigration), which buys breathing room to plan a rollout on your own terms, but it does not extend past the February 1 deadline.

Why Microsoft Is Making This Mandatory, Not Optional

This isn't a nudge toward best practice; it's Microsoft closing a door it considers a real liability. Microsoft's own security team has pointed to a surge in AI-generated phishing as the driver: internal Microsoft Threat Intelligence data cited alongside this announcement puts click-through rates on AI-crafted phishing messages as high as 54%, compared to roughly 12% for traditional phishing attempts. Text and voice codes are exactly the kind of credential that a convincing phishing page can capture and relay in real time. Passkeys can't be phished the same way, because there's no code for a user to type into a fake page in the first place.

Coverage of the announcement has also noted this follows Microsoft already narrowing SMS-based recovery on the consumer side (Outlook, Xbox, OneDrive) earlier in 2026, so this enterprise-side change is a continuation of a broader shift away from phone-based codes across Microsoft's products, not an isolated policy change in Entra ID alone.

Who and What This Touches

What To Do Now

Do these first:

  1. Run Microsoft's usage analyzer (or check Entra ID > Authentication methods) to find every user still enabled for SMS or voice. Any non-zero result means you're in scope.
  2. Decide, per user segment: migrate to passkeys (the default path, no added cost), or document a genuine regulatory/operational need and plan to contract a telecom provider through the Microsoft Security Store once details open September 18, 2026.
  3. If you need more runway before the September 1 auto-enrollment hits your tenant, set the passkeyDynamicMigration opt-out property now. Remember this only delays the September behavior, it does not move the February 1, 2027 deadline.
  4. Turn on a passkey registration campaign proactively rather than waiting for Microsoft's automatic rollout, it's the more controlled way to move users at scale without flooding the help desk.
  5. Build a short, phased communication plan for affected users: awareness that this is changing and why, clear action steps for their device (Windows Hello, iOS, Android), then a reminder pass for stragglers before the deadline.
  6. If any compliance program, you're subject to specifically names SMS or voice as a required MFA channel, flag that now so you're not scrambling to stand up a telecom provider contract in December.

Then follow up:

How SecureCyber Can Help

Authentication changes like this tend to surface gaps nobody's looked at in years, who's still on an old MFA method, whose device can't take a passkey yet, which compliance requirement actually forces your hand on a telecom provider. That's exactly the kind of thing our Microsoft 365 Health Check is built to catch: a focused review around the ten questions we get asked most about the security of an M365 environment, with plain-language findings and real-world recommendations, not a report that sits in a folder. If you want a clear read on where your organization stands before September, reach out to us at (937) 388-4405 or info@secdef.com.

Sources