Overview
- Microsoft will roll out passkeys as the default authentication method for Microsoft Entra ID in the public cloud starting September 1, 2026, and will auto-enable passkeys for users who currently use SMS or voice.
- The company published a staged timetable that includes publishing supported telecom providers and pricing on September 18, 2026, an admin configuration window beginning October 30, 2026, and retirement of Microsoft-provided SMS and voice on February 1, 2027.
- After February 1, 2027, users who still rely on SMS or voice will be required to register a passkey before they can sign in and automatic passkey registration prompts will be enforced for all tenants with no opt-out.
- Organizations that must keep SMS or voice for regulatory or business reasons can contract third-party telecom providers through the Microsoft Security Store and will pay any carrier charges themselves.
- Microsoft says the change responds to faster, more effective AI-enabled phishing and explains passkeys use public-key cryptography rather than shared secrets, making them resistant to phishing; it also advises customers to identify affected users, run pilot registrations, and prepare user communications now.