Entra ID Makes Passkeys the Default Sept. 1 and Ends Built-In SMS and Voice MFA in February

Updated Oct. 26, 2026, 6:47 a.m. ET: Adds Microsoft’s later documentation changes: a July 1, 2027 retirement date for Global Administrators and external users, and Soprano and Telesign as the first telephony providers.

Microsoft is about to push most Entra ID tenants off text-message and phone-call MFA. Starting Sept. 1, as the rollout reaches each organization, users enabled for SMS or voice will automatically be enabled for passkeys and prompted to register one the next time they complete multifactor authentication, Microsoft said in a security blog post. Microsoft says the automatic registration prompts will be enforced in all tenants, with no opt-out.

The bigger change comes on Feb. 1, 2027. That’s when Microsoft retires its own telecom delivery for SMS and voice and stops offering them as native Entra features. Organizations that still need those methods for regulatory, technical or business reasons will have to contract with a third-party telecom provider through the Microsoft Security Store and pay the provider’s costs.

“SMS and voice have served their purpose well, bringing multifactor authentication to billions of users who otherwise would have had none. But the threat environment has evolved beyond their capabilities, and we need to evolve with it,” Microsoft wrote.

Why now

Microsoft points to AI-driven phishing. Its threat intelligence team has seen AI-enabled campaigns reach click-through rates as high as 54%, compared with about 12% for traditional phishing, and says SIM swapping and MFA bypass have become easier to repeat. Passkeys use public-key cryptography bound to the site or app, so there is no code for a phishing page to capture and replay.

Who gets hit, and when

Microsoft’s retirement documentation spells out the details:

– From Sept. 1, 2026: SMS and voice users are auto-enabled for passkeys and nudged to register at MFA sign-in. – From Feb. 1, 2027: Microsoft-provided SMS and voice end for everyone except Global Administrators and external users. Anyone whose only MFA method is SMS or voice will hit a blocking prompt and must register a passkey before signing in. Internal guest users follow this date. – From July 1, 2027: The same retirement applies to Global Administrators and external users.

Users already on passkeys, Windows Hello for Business or another phishing-resistant method aren’t affected. The dates cover Entra ID in the public cloud only. Other cloud environments will follow on a separate timeline.

What admins should do now

Find out who still relies on SMS or voice. Microsoft’s documentation links a guide for finding active SMS and voice users in a tenant. Then get them onto passkeys, Windows Hello or FIDO2 keys before February, using Microsoft’s passkey deployment guide. For any group that genuinely can’t move, such as staff without compatible devices, budget for a telephony provider. Microsoft’s docs name Soprano and Telesign as the initial options in private preview.

The blocking prompt is the part most likely to cause help-desk calls. Any user who reaches February with only a phone number on file won’t be able to sign in until they register a passkey.