Edit

Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

To help enterprises adopt AI at scale, it is imperative for users to use secure authentication and move from phishable authentication methods to phishing-resistant authentication methods like passkeys. Therefore, Microsoft Entra ID is making passkeys the default sign-in experience, so every organization gets phishing-resistant security by default. SMS and voice are no longer positioned as secure authentication methods and will no longer be provided natively in Entra ID.

Starting September 1, 2026, passkeys become the default authentication experience and will be automatically enabled for users enabled for SMS or voice. From February 1, 2027, Microsoft-provided telephony delivery for SMS and voice will be retired for all users except Global Administrators and external users. For Global Administrators and external users, Microsoft-provided SMS and voice authentication will be retired on July 1, 2027. Customers who still require these methods should configure a telephony provider through Microsoft Security Store. Soprano and Telesign are the initial providers available during the private preview, and more providers will become available by general availability. For provider and offer information, see Choose a telephony provider for SMS and voice authentication.

Users who already sign in with passkeys, Windows Hello for Business, or another phishing-resistant method can continue using those methods. However, users who remain enabled for SMS or voice might still receive prompts to register passkeys on eligible devices. The July 1, 2027 retirement date applies to Global Administrators and external users. Internal guest users aren't included in that July 1 group and still follow the February 1, 2027 retirement date. To check who in your tenant still uses SMS or Voice, see Find active SMS or Voice users in your tenant.

Retirement timeline

Date Milestone What you should do
September 1, 2026 Tenants with users enabled for SMS or voice, those users are auto-enabled and nudged for Passkey registration upon MFA sign-in. Notify end users of the changes happening. Use the passkey deployment guide to prepare your environment for passkey use.
February 1, 2027 Microsoft-provided SMS and voice authentication is retired for all users except Global Administrators and external users. Internal guest users remain in scope for the February 1 retirement. Make sure users in scope for the February 1 retirement are on a phishing-resistant method (passkeys, Windows Hello, or FIDO2) before this date, or they might experience sign-in disruption.
After February 1, 2027 Users in scope for the February 1 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue to sign in to their account.
There is no opt out from this February 1 behavior for users in scope of the February 1 retirement.		 Migrate users in scope for the February 1 retirement to a phishing-resistant method or choose a telephony provider to continue using SMS or voice.
July 1, 2027 Microsoft-provided SMS and voice authentication is retired for Global Administrators and external users. Internal guest users aren't included in this July 1 group and still follow the February 1, 2027 retirement date. Make sure Global Administrators and external users are on a phishing-resistant method before this date, or they might experience sign-in disruption.
After July 1, 2027 Global Administrators and external users whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue to sign in to their account.
There is no opt out from this July 1 behavior for Global Administrators and external users.		 Migrate Global Administrators and external users to a phishing-resistant method or choose a telephony provider to continue using SMS or voice.

Prepare for transition to passkeys

1. Find users enabled for SMS or Voice

Microsoft recommends that you identify which users are enabled for SMS or Voice, before you plan your migration. Use the following steps to find each group.

To find users enabled for SMS or Voice, run this PowerShell script. Ensure you have one of global reader, Authentication policy administrator, or Security reader roles enabled.

2. Move users to passkeys

Passkeys are the default phishing-resistant credential for Microsoft Entra ID. They're tied to a device or a synced credential store, use cryptographic keys instead of shared secrets, and are resistant to phishing, SIM-swap, and replay attacks.

Microsoft Entra ID supports two types of passkeys:

  • Synced passkeys — passkeys saved to a platform credential manager (such as iCloud Keychain, or Google Password Manager) and synced across the user's devices. Best for users who already use a platform credential manager.
  • Device bound passkey — the passkey is created and stored on a user's device, such as Passkey in Microsoft Authenticator, Entra Passkey on Windows, FIDO2 hardware security key, and so on.

To enable passkeys for your tenant and plan your rollout, see Plan a passkey deployment in Microsoft Entra ID and Enable passkeys (FIDO2) for your organization.

To view the full list of passwordless authentication methods that Entra ID supports, see Microsoft authentication overview.

Important

On September 1, 2026, users enabled for SMS or Voice in the Entra Authentication Methods Policy (AMP), or in legacy MFA settings, will be auto-enabled for passkeys in AMP. These in scope users will be put into a passkey profile allowing all types of passkeys. Your Registration Campaign settings will be set to Microsoft Managed state targeting passkeys, and will automatically bring these users into scope.

When these users next sign-in and complete MFA, the registration campaign will nudge them to register a passkey. By default, users will have unlimited snoozes of the nudge prompt. If you do not want this to occur, move users out of SMS or Voice in AMP before September 1st.

Proactively drive adoption with a registration campaign

You can enable a passkey registration campaign before it is automatically enabled for your SMS and Voice enabled users on September 1, 2026. A registration campaign prompts users to set up a passkey the next time they sign in and complete MFA. It's the most effective way to move users off SMS and Voice at scale without adding help-desk load.

Before configuring the registration campaign, ensure Passkey (FIDO2) is enabled as an authentication method and that your SMS/Voice users are included in a passkey-enabled authentication methods policy.

To configure a registration campaign for passkeys:

  1. Sign in to the Microsoft Entra admin center as an Authentication Policy Administrator.
  2. Go to Entra ID > Authentication methods > Registration campaign.
  3. Set State to Microsoft Managed and target the security group of SMS and Voice users you created in step 1.

3. Evaluate a telephony provider in Microsoft Security Store for operational needs

Microsoft recommends passkeys as the primary migration path for all users where possible. If you operate in a regulated industry or have an operational need for a telephony channel — for example, specific compliance regimes that require an out-of-band SMS, or scenarios where no other method is workable — you can use a telephony provider available through Microsoft Security Store for those user segments.

  1. Identify the specific user segments where you have a genuine regulatory or operational need for a telephony channel. Document the requirement, such as the applicable regulation or scenario.
  2. Review the initial private-preview providers, Soprano and Telesign, and their offers in Choose a telephony provider for SMS and voice authentication. More providers will become available by general availability.
  3. Beginning October 30, 2026, customers who need to continue using SMS or voice can select and configure a telephony provider from Microsoft Security Store.
  4. Stand up the carrier contract through the marketplace flow and test with a pilot group before broad rollout.
  5. For every other user segment in your tenant, default to passkeys.

4. Communicate the change to your users

With passkeys enabled in your tenant, give your users clear notice of what's changing, when, and what they need to do before you start driving registration. Coordinated communications are the single biggest predictor of a smooth passkey rollout.

Microsoft recommends a phased communication plan aligned with the retirement timeline:

  1. Awareness — announce that SMS and Voice are retiring, explain why, and tell users which method they'll move to.
  2. Action — direct users to register a passkey, with step-by-step guidance for their device type (Windows Hello, iOS, Android).
  3. Reminder — remind users who haven't yet registered a phishing-resistant method on the actions they should take.

Use end-user communication templates for email, Teams, and employee communications portals. Microsoft recommends that you scope your messaging to the security group of SMS and Voice users you created in step 1, so the right people hear from you at the right time.

5. After retirement

Beginning February 1, 2027, Microsoft-provided SMS and voice delivery will be retired in Microsoft Entra ID for all users except Global Administrators and external users. Internal guest users remain in scope for the February 1, 2027 retirement.

If your tenant still has users in scope for the February 1, 2027 retirement enabled for SMS or voice and you haven't configured a telephony provider through Microsoft Security Store, those users can no longer use SMS or voice to complete MFA and sign in as usual.

After this date, users in scope for the February 1, 2027 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue signing in to their account.

There is no opt out from this February 1 behavior for users in scope of the February 1 retirement.

Beginning July 1, 2027, Microsoft-provided SMS and voice delivery will be retired for Global Administrators and external users. Internal guest users aren't included in that July 1 group and still follow the February 1, 2027 retirement date.

After this date, Global Administrators and external users whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account. This prompt is blocking. Users must register a passkey before they can continue signing in to their account.

There is no opt out from this July 1 behavior for Global Administrators and external users.

To avoid sign-in disruption, make sure users register a passkey or move to another phishing-resistant authentication method before their applicable retirement date. If your organization has a valid business, regulatory, or operational need to keep using SMS or voice, configure a telephony provider before that date.

Temporarily opt out of the automatic passkey enablement

A temporary opt-out is available for the September 1, 2026 through February 1, 2027 changes. This lets you delay passkey and Registration Campaign enablement while you complete transition activities, such as configuring a telephony provider or migrating to other authentication methods.

To opt out, you need the Microsoft Graph Policy.ReadWrite.AuthenticationMethod permission. Update your authentication methods policy using Microsoft Graph and set the passkeyDynamicMigration property to true.

Request

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json

{
   "optOutSettings": {
     "passkeyDynamicMigration": true
   }
}

After this setting is applied, your tenant is excluded from the automatic passkey enablement and Registration Campaign rollout during the opt-out period. Beginning February 1, 2027, standard passkey migration and enforcement timelines apply regardless of this setting for users in scope of the February 1 retirement. Global Administrators and external users instead follow the July 1, 2027 retirement date. Internal guest users remain on the February 1, 2027 retirement date.

If your tenant still has users enabled for Microsoft-managed SMS or voice on their applicable retirement date, and you haven't configured a telephony provider through Microsoft Security Store, those users can no longer use SMS or voice to satisfy MFA requirements and continue signing in.

There is no opt out for enforcement. This requirement applies to all tenants on the applicable retirement date for each user population.

Frequently asked questions

For answers to common questions about the SMS and voice retirement, telephony providers, opt-out options, and passkey migration, see Frequently asked questions about SMS and voice retirement.

  • Last updated on