Microsoft Entra ID Makes Passkeys Default and Retires Native SMS/Voice MFA

Microsoft announced a major authentication overhaul for Microsoft Entra ID in the public cloud, making passkeys the default sign-in experience starting September 1, 2026 and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets.

Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the Microsoft Security Store. Administrator configuration for supported providers is scheduled to begin on October 30, 2026, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin February 1, 2027. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.