Passkeys Become the Default as Microsoft Entra Retires SMS and Voice Authentication

Back in July 2023, we wrote about early signs that Microsoft was quietly phasing out SMS & voice MFA. At the time, there was no confirmed retirement date, just a nudge toward Authenticator and a “voice OTP” upgrade. Three years later, Microsoft has stopped hinting and made it official.

The push behind it isn’t just tidying up old auth methods. As organizations lean harder into AI, phishable credentials become a bigger liability, and Microsoft wants phishing-resistant security to be the default, not something admins have to opt into. That’s why passkeys are taking over as the standard sign-in experience in Entra ID.

Let’s take a quick look at Microsoft’s shift to passkey-first authentication.

Phone-based authentication uses SMS text messages or voice calls to verify a user’s identity. For years, many organizations have relied on these methods for multi-factor authentication. It’s familiar and easy to set up, but it comes with real security gaps.

SMS and voice codes travel over the phone network, which makes them an easy target for:

• Interception – A code sent by text can be intercepted in transit.
• Social engineering – A voice call can be talked out of a user by an attacker posing as IT or support.
• SIM swapping – An attacker can hijack a user’s phone number and hand themselves the entire MFA flow, without ever touching the user’s actual device.

None of that requires much skill from an attacker, which is exactly why these methods keep showing up in real-world breaches. Therefore, organizations should begin removing phone-based authentication wherever possible and transition to stronger authentication methods like passkeys.

Passkeys close that gap. Instead of a code that travels over a network, a passkey is a cryptographic key pair that simply can’t be reused, guessed, or handed over on a fake login page. Microsoft gives users two ways to set one up:

• Synced passkeys – Saved to a platform credential manager like iCloud Keychain or Google Password Manager and carried across all of a user’s devices. The better fit for people who already live in one of those ecosystems.

• Device-bound passkeys – Created and stored on a single device, such as Passkey in Microsoft Authenticator, Entra Passkey on Windows (via Windows Hello), or a FIDO2 hardware security key. The better fit for higher-security scenarios where you don’t want credential syncing anywhere.

Microsoft is also removing an additional step for users registering their first MFA method. With the upcoming update, users will be able to register a supported passkey or passwordless sign-in method directly, without first registering an alternative method such as SMS or voice authentication.

This change will roll out in two phases:

• Phase 1 (November 2026 – January 2027): Synced passkeys, Microsoft Entra passkeys on Windows, and FIDO2 security keys.
• Phase 2 (January – February 2027): Windows Hello for Business, macOS Platform SSO, Microsoft Authenticator passkeys, and Authenticator passwordless sign-in.

Here’s how the rollout breaks down, from passkeys going default to SMS and voice fully retiring.

• September 1, 2026 – Passkeys become the default authentication experience. Any user currently enabled for Microsoft-provided SMS or voice gets auto-enrolled for passkeys, and Registration Campaign switches to Microsoft-managed, nudging those users to register a passkey at their next MFA sign-in. Users can skip the prompt (with unlimited snoozes) unless admins turn that off.
• September 18, 2026 – Microsoft opens up details on customer-managed telecom providers in the Microsoft Security Store. These are third-party carriers that admins can contract to keep delivering SMS and voice codes, since Microsoft itself is stepping out of that role.

Organizations with a genuine business, regulatory, or operational need to continue using SMS or voice can evaluate a supported customer-managed telecom provider. Microsoft recommends passkeys as the primary migration path wherever possible.

• October 30, 2026 – Customers can start selecting and configuring a customer-managed telecom provider through the Security Store.
• February 1, 2027 – Microsoft-provided SMS and voice authentication will be retired for all users except Global Administrators and external users. Internal guest users are also included in this retirement.
• July 1, 2027 – Microsoft-provided SMS and voice authentication will be retired for Global Administrators and external users. Those with SMS or voice as their only MFA method must register a passkey at sign-in to continue. There is no opt-out from this enforcement.

Here’s how you can prepare for the transition:

Before migrating users to passkeys, admins should identify who currently relies on Microsoft-provided SMS or voice authentication for MFA. Microsoft provides the GetEntraSMSVoicePolicyUsers PowerShell script to identify users who are enabled for Microsoft-provided SMS and voice authentication through their authentication method policies and legacy MFA settings.

However, being enabled for SMS or voice authentication does not necessarily mean that a user has registered these methods. To identify users who have actually registered phone-based authentication, you can use the script below.

It identifies users with registered SMS or voice authentication methods and assesses their potential MFA impact. The report includes their registered authentication methods, default MFA method, and other relevant user details, helping admins plan the migration.

Download the script: SmsVoiceRetirementReport.ps1

The report classifies users into three impact levels based on their registered authentication methods and default MFA method:

As the SMS & Voice retirement affects SSPR (Self-service password reset) in Microsoft Entra ID, the report also includes an SSPR impact analysis. This helps administrators identify affected users and assess the impact on password resets before the retirement takes effect.

Once you’ve identified users still relying on SMS or voice authentication, the next step is to transition them to passkeys.

1. Enable Passkey as an authentication method in Microsoft Entra.
2. Add the identified SMS/voice users to a passkey-enabled authentication policy.
3. Go to Protection > Authentication methods > Registration Campaign.
4. Set the Registration Campaign to Microsoft Managed and target the user group.

With this configuration, users will be prompted to register a passkey the next time they complete MFA. This helps complete the transition before the September 1, 2026 automatic enrollment while minimizing help desk requests.

⚠️ If your organization is ready, the registration campaign will help users transition smoothly to passkeys. But if you need more time or still have users who must rely on SMS or voice authentication, Microsoft provides a few options to ease the transition:

If your organization isn’t ready to transition all users to passkeys, Microsoft offers a temporary opt-out to delay the rollout.

• The opt-out is available from September 1, 2026 to February 1, 2027.
• It lets you postpone passkey enrollment and the Registration Campaign while you complete your migration.
• API support for configuring the opt-out becomes available on August 1, 2026.
• This is only a temporary measure – all organizations must complete the transition by February 1, 2027, as no further extensions will be available.

If some users must continue using SMS or voice authentication due to business, regulatory, or operational requirements, you can still support these methods using your own telecom provider.

• Starting October 30, 2026, you can select and configure a supported telecom provider through the Microsoft Security Store.
• The selected provider will deliver the SMS messages or voice calls used for authentication instead of Microsoft.
• Messaging costs are charged per message and vary by provider and region, so be sure to plan your budget accordingly.
• To avoid disruption, configure the provider and migrate the affected users before February 1, 2027. Global Administrators and external users have until July 1, 2027.

1. Will migrating to Entra passkey authentication cost extra?

No. Passkeys are included in all Entra plans. Telecom provider costs through the Security Store are separate and billed per-message.

2. Do I have to migrate users to passkeys manually?

Not if you don’t act. On September 1, 2026, in-scope users get auto-enrolled for passkeys and Registration Campaign flips to Microsoft-managed automatically. If you’d rather control the timing, move users out of SMS/voice before that date.

3. Does retiring SMS & Voice authentication affect self-service password reset (SSPR) too?

Yes, native SMS and voice retirement covers SSPR as well. A telecom provider through the Security Store can still support it.

4. Will Entra users be locked out when Microsoft-provided SMS and voice authentication are retired?

Users whose only available MFA method is SMS or voice will see a blocking prompt to register a passkey before they can continue signing in. This applies from February 1, 2027, for most users, while Global Administrators and external users follow the July 1, 2027 retirement date.

Microsoft’s move to passkey-first authentication marks a significant step toward phishing-resistant security in Microsoft Entra. The sooner you begin the migration, the smoother the transition will be.

Thanks for reading!