Microsoft Entra Passkeys: What Admins Must Know Before 2027

Microsoft Entra ID is moving away from SMS and voice authentication and making passkeys the default. For Microsoft 365 and identity admins, this is a deadline-driven migration with automatic policy changes, blocking registration, and potential sign-in disruption if users are not prepared before February 1, 2027 for users except global admins and external users. Those users will need to move to passkeys by July 1, 2027.

Why Microsoft Entra Is Moving to Passkeys

Legacy Multi-Factor Authentication (MFA) methods remain vulnerable to phishing, SIM swapping, interception, and social engineering. Microsoft Entra passkeys use FIDO2 public-key cryptography instead of shared secrets. Because the credential is bound to the legitimate service, it cannot be relayed through a fake sign-in page in the same way as an SMS code or password.

This is due to the observed Microsoft Threat Intelligence reporting that has seen AI-enabled phishing campaigns reaching, and fooling, more people. With other technology advances, even voice is not secure enough.

Entra Passkey Timeline

Thankfully, this is not an overnight change. There are phases to the rollouts that start on the following dates I mention below. That said, always be sure to check the current timelines as they move.

September 1, 2026: Microsoft begins rolling out passkeys as the default Microsoft Entra authentication experience. Users enabled for SMS or voice are automatically enabled for passkeys and prompted to register after MFA.

September 18, 2026: Supported telephony providers, pricing, and commercial terms announced.

October 30, 2026: Admins may select and configure a supported telephony provider through Microsoft Security Store.

February 1, 2027: Microsoft-provided SMS and voice authentication retire for most users. Internal guest users are included in this wave.

July 1, 2027: The retirement reaches Global Administrators and external users.

After the applicable retirement date, users whose only MFA option is SMS or voice must register a passkey before they can continue signing in. The prompt is blocking, and there is no opt-out. These dates apply to Microsoft Entra ID in the public cloud; other cloud environments will follow separate timelines.

Choosing a Microsoft Entra Passkey Model

Microsoft Entra ID supports synced and device-bound passkeys. Synced passkeys are stored in a platform credential manager, such as iCloud Keychain or Google Password Manager, and work well for much of the general workforce. Device-bound passkeys remain on a specific device and include Microsoft Authenticator passkeys, Entra Passkey on Windows, and FIDO2 security keys.

The decision is partly about governance. Synced passkeys improve convenience but do not provide device provenance. If your Microsoft Entra passkey profile requires attestation, only supported device-bound passkeys are allowed. FIDO2 security keys are the stronger fit for privileged users, regulated environments, and accounts that access sensitive systems.

What Changes Automatically in Microsoft Entra ID

The September 2026 rollout changes tenant policy, not just the user interface. Users enabled for SMS or voice in the Microsoft Entra Authentication Methods Policy or legacy MFA settings are placed into a passkey-enabled profile. Registration Campaign settings move to a Microsoft-managed state that targets passkeys. Users can initially snooze the registration prompt, but that flexibility ends when blocking enforcement begins.

Microsoft Entra Admin Migration Checklist

1. Inventory SMS and voice users: Identify every affected account and place those users in a dedicated security group for phased deployment and communications.

2. Drive Adoption with a Registration Campaign: Rather than wait for the automatic enablement, get ahead of it so you don’t add to helpdesk requests when crunch time arrives. This is the most effective way to start moving your users to the proper security protocols, but be sure the configuration paths are clear and specific.

6. Communicate in phases: Build awareness, provide device-specific registration instructions, and follow up with users who have not completed enrollment. This has to be done in waves so it doesn’t overwhelm users or your helpdesk staff.

Plan Exceptions Without Making Them the Default

Organizations with a genuine regulatory, technical, or business requirement for SMS or voice can contract with a supported telephony provider through Microsoft Security Store with customers being responsible for provider costs and configuration. Currently, Soprano and Telesign are the initial providers during the private preview. From a schedule standpoint, starting October 20, 2026, those who must continue with SMS or voice requirements can select a provider.

Treat this as a documented exception for limited user groups, not a substitute for a broader Microsoft Entra passkey migration.

Make Microsoft Entra Passkey Readiness a 2026 Priority

The risk is not simply that Microsoft Entra authentication is changing. It is that unprepared users can encounter a blocking registration experience at sign-in. Inventory affected accounts, select the right passkey model, pilot Microsoft Entra Conditional Access policies, and move users before the deadlines become an outage.

If your organization needs help planning a Microsoft Entra passkey deployment, protecting privileged identities, or managing the transition from SMS and voice MFA, The Partner Masters can help.