Microsoft Entra ID Makes Passkeys Default and Retires SMS/Voice Sign-In

Microsoft is making passkeys the default authentication experience for Microsoft Entra ID public-cloud users beginning September 1, 2026 and will retire Microsoft-provided SMS and voice authentication. SMS first-factor sign-in and native Microsoft SMS/voice capabilities for workforce tenants will end on February 1, 2027; Global Administrators and external users have until July 1, 2027. SMS first-factor authentication has already been retired for Entra ID Free tenants.

Organizations must migrate affected users to phishing-resistant authentication to avoid sign-in disruptions. Users relying only on Microsoft-provided SMS or voice will have to register a passkey before they can sign in after the applicable deadline, with no opt-out from enforcement; a temporary opt-out only defers the initial passkey-default rollout until February 1, 2027. Microsoft also supports QR-code authentication, FIDO2 security keys, and other Entra methods, while organizations needing SMS or voice must use a supported customer-managed telecom provider through the Microsoft Security Store.