By Matthew Williams | Your Translator for Microsoft's Fine Print
Microsoft has announced a major identity and security update for Entra ID (the identity system behind Microsoft 365 sign-in): passkeys are becoming the default authentication experience, and Microsoft-provided SMS and voice codes for MFA are being phased out as part of that shift. Starting September 1, 2026, anyone in your tenant currently using SMS or voice codes for multi-factor authentication will be automatically enrolled in passkeys and nudged to register one. From February 1, 2027, Microsoft stops providing SMS and voice delivery entirely, and there's no opt-out: if a user's only MFA method is still a text or phone call on that date, they'll be blocked at sign-in until they register a passkey. If your organization still leans on text-message codes for MFA, the work to get ahead of this starts now, not next year.
For years, the easiest way to add a second sign-in step was a code texted or called in. It felt secure because it was a second thing, but it's built on your phone network, and phone networks can be tricked. A SIM swap, a forwarded call, an intercepted text, and that "second factor" isn't so second anymore.
A passkey works differently. Instead of a code that travels over a phone network and can be intercepted or phished, it's a cryptographic key tied to your device or a secure credential store (like your phone's built-in security chip). There's no code to read back to an attacker on a fake login page, because there's no code at all.
Here's the rollout Microsoft has published:
The part worth reading twice: after February 1, 2027, any user whose only MFA method is still SMS or voice will hit a blocking prompt at sign-in and must register a passkey to get into their account. Microsoft has been explicit that there is no opt-out from this enforcement, it applies to every tenant. A temporary opt-out property does exist for the September 1 auto-enrollment (passkeyDynamicMigration), which buys breathing room to plan a rollout on your own terms, but it does not extend past the February 1 deadline.
This isn't a nudge toward best practice; it's Microsoft closing a door it considers a real liability. Microsoft's own security team has pointed to a surge in AI-generated phishing as the driver: internal Microsoft Threat Intelligence data cited alongside this announcement puts click-through rates on AI-crafted phishing messages as high as 54%, compared to roughly 12% for traditional phishing attempts. Text and voice codes are exactly the kind of credential that a convincing phishing page can capture and relay in real time. Passkeys can't be phished the same way, because there's no code for a user to type into a fake page in the first place.
Coverage of the announcement has also noted this follows Microsoft already narrowing SMS-based recovery on the consumer side (Outlook, Xbox, OneDrive) earlier in 2026, so this enterprise-side change is a continuation of a broader shift away from phone-based codes across Microsoft's products, not an isolated policy change in Entra ID alone.
Do these first:
Then follow up:
Authentication changes like this tend to surface gaps nobody's looked at in years, who's still on an old MFA method, whose device can't take a passkey yet, which compliance requirement actually forces your hand on a telecom provider. That's exactly the kind of thing our Microsoft 365 Health Check is built to catch: a focused review around the ten questions we get asked most about the security of an M365 environment, with plain-language findings and real-world recommendations, not a report that sits in a folder. If you want a clear read on where your organization stands before September, reach out to us at (937) 388-4405 or info@secdef.com.