Passkeys become the default in Entra ID – what to do before September 1

As of September 1, 2026, Microsoft is making passkeys the default sign-in experience in Microsoft Entra ID. As of February 1, 2027, SMS and voice will disappear entirely as Microsoft-provided MFA methods. Organisations that do nothing until then risk blocked sign-ins – and the users hit hardest are precisely those that are hardest to reach with a self-service prompt.

We have discussed this topic with several customers over the past few weeks, so here is a consolidated view of the facts, the available options and our recommendations.

What Microsoft is actually announcing

On July 13, 2026, Microsoft officially confirmed that passkeys are becoming the default authentication experience in Entra ID. The timeline looks like this:

• September 1, 2026 – Rollout begins. All users enabled for SMS or voice in the Authentication Methods Policy (or in legacy MFA settings) are automatically enabled for passkeys and placed into a passkey profile without restrictions. Your Registration Campaign is switched to Microsoft Managed state targeting passkeys. On their next sign-in with successful MFA, these users receive a prompt to register a passkey. Initially, this prompt can be snoozed an unlimited number of times.

• September 18, 2026 – Microsoft publishes information on supported telecom providers, pricing and commercial terms in the Microsoft Security Store.

• October 30, 2026 – From this date, customers who still require SMS or voice can select and configure a telecom provider through the Security Store.

• February 1, 2027 – Microsoft-provided SMS and voice delivery is retired completely. Users whose only available MFA method is SMS or voice must register a passkey during sign-in. This prompt is blocking, and there is no opt-out from it.

September is therefore not the critical date – it is simply the first visible one. The critical date is February 1, 2027, and the five months in between are your implementation window.

A common misunderstanding: many tenants are already seeing the prompt

We have already had feedback from customers whose users were prompted to register a passkey well before September 1. This is neither a Microsoft bug nor an early rollout, but a separate change that has already completed:

Via MC1253746 and MC1279092, passkey (FIDO2) was rolled out as the target method for Registration Campaigns in Microsoft Managed state – starting mid-May 2026 and completing at the end of June 2026. If your tenant meets the criteria (Registration Campaign in Microsoft Managed state, passkeys enabled, self-service setup allowed, no attestation or AAGUID restrictions in the passkey profile), your users are already receiving the nudge today. On top of that, the expansion of system-preferred authentication to the first factor in May 2026 reinforces the impression that passkeys are now the default.

So if you are currently fielding surprised service-desk calls: check the state of your Registration Campaign before you attribute it to the September change.

Your options at a glance

Option 1 – Roll out passkeys now, on your terms (our recommendation)

You keep control instead of handing it over to the Microsoft-managed rollout. In practice that means your own passkey profiles per user group, your own Registration Campaign on your own schedule, and your own communications. Which method fits which user group – passkey in the Authenticator app, YubiKey, Windows Hello or Entra CBA – is entirely your decision; Entra ID is flexible here.

The benefit: you know the date, your service desk knows it too, and you work through the edge cases without time pressure.

Option 2 – Temporary opt-out to buy time

Microsoft provides an opt-out covering the period from September 1, 2026 to February 1, 2027. It prevents both the automatic passkey enablement and the Registration Campaign rollout:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json

{
  "optOutSettings": {
    "passkeyDynamicMigration": true
  }
}

Important: this is a deferral and nothing more. There is no opt-out from the enforcement starting February 1, 2027 – for any tenant. Setting the opt-out without migrating in parallel simply moves the problem to a point where it becomes blocking.

Option 3 – Telecom provider via the Security Store

If you have a defensible regulatory or operational requirement for an SMS or voice channel, you can configure a third-party provider through the Microsoft Security Store from October 30, 2026. Any resulting telecom costs are borne by the customer.

Our assessment: this is an option for clearly defined user segments, not for an entire workforce. If you go down this route, document precisely which regulation or which scenario justifies the requirement – otherwise you end up carrying a paid channel that merely masks an unfinished migration.

Option 4 – Alternative phishing-resistant methods

Passkeys are not the only path. Windows Hello for Business, FIDO2 security keys, smart cards and certificate-based authentication (CBA) all remain fully usable, and users who already use a phishing-resistant method are not affected by the rollout. In environments with an existing PKI in particular, Entra CBA is often the more pragmatic route than rolling out new hardware keys.

What to do now

Before you decide on methods, you need numbers. Specifically:

1. Who in your tenant is still using SMS or voice? Not "who is allowed to", but "who has it registered and who actually uses it" – including SSPR usage. Microsoft provides the entra-sms-voice-usage-analyzer for this.

2. How is your Registration Campaign configured? State, target method, scoping, snooze behaviour.

3. What do your passkey profiles look like? Enforcing attestation automatically excludes synced passkeys – a detail that regularly produces error messages during rollout.

4. Are your Conditional Access policies blocking registration? Device compliance requirements and app protection policies in the registration path in particular.

5. Which users have SMS or voice only? That is the group that gets blocked from February 1, 2027. It is your first priority.

6. Prepare your communications. Microsoft provides templates for email, Teams and employee portals at aka.ms/mfatemplates. In our experience, coordinated communication is the single best predictor of a smooth rollout.

How we can help

We can both run the analysis and plan the rollout with you.

For the analysis, we have built an automated report that evaluates the points above across one or several tenants – the result is a solid list of affected users rather than an estimate. For the planning, we bring experience from industrial organisations with frontline workers, where SMS and voice are still frequently in use. Which method fits which user group – passkey in the Authenticator app, YubiKey, Windows Hello or Entra CBA – is part of that conversation.

Get in touch if you want to know how many of your users are affected. The analysis is typically completed within a few days.

Beyond that, we are happy to help bring your overall M365 tenant security up to standard – including, in this context, the introduction of Conditional Access. The entry point is our Microsoft 365 Security Baseline Assessment, which reviews Entra ID, Conditional Access, MFA and privileged access against the CIS benchmark. But we do not stop there: we also implement the resulting measures and, as part of our Excellence Managed Services, take on ongoing operations and continuous optimisation – so you get more than a report, you get a partner for the whole journey.