Microsoft will make passkeys the default authentication experience in public-cloud Entra ID beginning September 1, starting a staged transition that ends native Microsoft delivery of SMS and voice authentication in February 2027.
As the rollout reaches each organization, users currently enabled for SMS or voice will automatically become eligible for passkeys. The next time they complete multifactor authentication, Entra ID will prompt them to register one.
Microsoft supports synced passkeys held in platform credential managers, device-bound credentials in Microsoft Authenticator and Windows, and FIDO2 security keys. The change is intended to move organizations toward authentication based on public-key cryptography instead of codes that can be intercepted, phished or redirected through social engineering.
The company will release a list of supported telecom providers, deployment guidance and commercial terms on September 18. From October 30, administrators with a continuing regulatory, technical or operational need for SMS or voice will be able to configure a third-party provider through the Microsoft Security Store. Customers will contract with those providers and pay any associated telecom costs.
Microsoft-provided SMS and voice delivery will stop on February 1, 2027. After that date, users who still depend on those methods for MFA must register a passkey before signing in. Automatic registration prompts will be enforced across all public-cloud tenants and will not include an opt-out.
The schedule is more prescriptive than Microsoft’s earlier efforts to encourage passwordless adoption. The company has already begun reducing SMS use for personal Microsoft accounts, but the Entra plan addresses workforce identity and gives administrators fixed milestones for migration.
Organizations will need to identify users who rely on telecom-based factors, decide which passkey types fit their devices and workflows, and prepare recovery paths and user communications. Those operational steps have become a central concern as passkey adoption moves from pilots into larger deployments.
The dates apply only to Entra ID in Microsoft’s public cloud. Other cloud environments will follow a separate schedule, with additional guidance to be published before their transition.
Microsoft cited phishing, SIM swapping and MFA bypass as reasons for the change. It said passkeys offer a phishing-resistant alternative because the private credential does not leave the user’s device and the authentication is bound to the legitimate service.
Sources: Microsoft Security Blog
–
By Cass Kennedy
