What are passkeys, and why is Microsoft transitioning to them?

Passkeys are passwordless authentication methods based on cryptographic keys. Microsoft is adopting them to improve security, as they are resistant to phishing and credential theft, unlike SMS or voice verification.

What happens to users currently using SMS or voice authentication?

Starting September 2026, they will automatically gain access to passkeys. By February 2027, SMS and voice authentication will be fully deprecated in Entra ID.

Can companies continue using phone-based authentication after 2027?

Yes, but only through third-party telecom providers integrated via Microsoft Security Store. Native SMS and voice verification support in Entra ID will be discontinued.

← All news

Security

Microsoft Entra ID to Make Passkeys Default Authentication Method from September 2026

July 14, 2026

Photo: BleepingComputer

Quick answer

From September 2026, Microsoft Entra ID will adopt passkeys as the default authentication method, replacing SMS and voice verification by February 2027.

Microsoft has announced that it will transition to passkeys as the primary authentication method for its enterprise identity service, Entra ID, effective September 2026. This change will impact all users currently relying on SMS or voice verification, which will be fully phased out by February 2027.

Users already employing phishing-resistant methods such as Windows Hello for Business, FIDO2 keys, smart cards, or other alternatives can continue using them without disruption. After the update, the system will prompt users to register a passkey during their next multi-factor authentication request. Administrators can proactively identify users dependent on SMS or voice authentication using the Entra SMS/Voice Policy Scanner PowerShell script.

Microsoft urges organizations to adopt phishing-resistant authentication methods before February 2027 to prevent access disruptions. Companies requiring phone-based authentication can integrate third-party providers via Microsoft Security Store. The shift to passkeys follows a surge in attacks targeting Entra ID accounts, including AI-enhanced phishing campaigns exploiting stolen credentials.

Common questions

What are passkeys, and why is Microsoft transitioning to them?: Passkeys are passwordless authentication methods based on cryptographic keys. Microsoft is adopting them to improve security, as they are resistant to phishing and credential theft, unlike SMS or voice verification.
What happens to users currently using SMS or voice authentication?: Starting September 2026, they will automatically gain access to passkeys. By February 2027, SMS and voice authentication will be fully deprecated in Entra ID.
Can companies continue using phone-based authentication after 2027?: Yes, but only through third-party telecom providers integrated via Microsoft Security Store. Native SMS and voice verification support in Entra ID will be discontinued.

Dzen feed: /feed/dzen.xml · RSS: /feed.xml