Registration Campaign for Passkeys

Question

Hi!

My tenant has authentication methods migration status "not started" so as far as I understand legacy methods and "modern" authentication methods counts. I ran script provided by Microsoft to determine the scope of users with enabled SMS/Voice.

(To find users enabled for SMS or Voice, run this PowerShell script. Ensure you have one of global reader, Authentication policy administrator, or Security reader roles enabled.)

Output of this script looks like it:

Registration campaign: disabled SMS state: disabled Voice state: disabled ===== IMPACT SUMMARY ===== SMS/Voice disabled - no action required.

And in fact - in "modern" panel we have SMS/Voice disabled but still a lot users use SMS as MFA/SSPR method.

What will happened on 1st September? Users with registered SMS/Voice are going to get passkey campaign or not?
If yes, how can I prevent it? Our idea for migration is to enforce MS Authenticator for MFA and MS Authenticator + Email OTP for SSPR. (2nd question is... when SSPR asks for auth metod registration, there is no way to configure Email OTP - you have to visit MySignIns portal to register it. What will happened after 1st february if we enforce 2 methods in SSPR?)

Answer 1

Your tenant is currently in a mixed state because Authentication Methods migration is “Not Started.” This means Entra ID still considers both legacy authentication settings (such as per-user MFA and older SSPR configurations) and the modern Authentication Methods policy. The Microsoft script showing SMS/Voice disabled only reflects the modern policy - so users may still be using SMS because it remains enabled in the legacy configuration.

AFAIK, on September 1st, users with registered SMS or voice authentication methods should not automatically receive the passkey registration campaign if SMS/Voice is disabled in the modern Authentication Methods policy. However, leaving the tenant in the “Not Started” migration state creates risk because legacy methods may continue to function until Microsoft retires them. The larger impact occurs on February 1, 2027, when Microsoft retires Microsoft-managed SMS and voice delivery. Users who still depend on these methods may lose their ability to complete MFA or SSPR.

To avoid unexpected behavior, you should complete the migration to modern Authentication Methods. Change the migration state from Not Started to Migration Complete under Protection > Authentication methods > Manage migration so Entra ID uses only the modern policy. Also review the FIDO2/passkey settings and disable them if you do not want users registering passkeys, and set the Registration Campaign to Disabled instead of Microsoft-managed if you do not want Microsoft prompting users to register new methods.

For SSPR, requiring both Microsoft Authenticator and Email OTP can create registration issues. During the enforced combined security information registration process, users can immediately register Microsoft Authenticator, but Email OTP cannot normally be added during that sign-in interruption unless an email authentication method already exists. If users are required to register two methods and only have Authenticator available, they may be unable to complete registration and could be blocked.

A safer migration approach would be to first require only one SSPR method and have users register Microsoft Authenticator. After users have completed registration, instruct them to visit the My Sign-Ins (Security Info) portal to manually add Email OTP. Once most users have both methods registered, increase the SSPR requirement to two methods. Another option is to pre-register email authentication methods using Microsoft Graph, but this requires automation and additional validation because simply populating directory attributes such as alternate email does not automatically make the address a usable SSPR authentication method.

More at https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin