MC1426371 - Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

Updated September 15, 2026: We have updated the content and timeline. Thank you for your patience.

What and why

Passkeys will becomebecame the default authentication experience in Microsoft Entra on September 1, 2026. Telecom-based methods (SMS and voice) will transition to customer-configured providers through the Microsoft Security Store.

The AI era demands stronger, phishing-resistant authentication. We are making passkeys the default authentication experience in Microsoft Entra to help customers securely adopt AI at scale.  

As part of this transition, SMS and voice will no longer be available as multifactor authentication methods starting February 1, 2027. SMS and voice do not offer sufficient levels of security in comparison to passkeys. Traditional authentication methods including passwords, SMS one-time passcodes, and voice-based verification remain vulnerable to phishing, interception, and social engineering attacks.

We strongly recommend moving away from telephony-based authentication methods to improve security and prevent identity attacks. Passkeys are included in all Microsoft Entra plans, so making this critical security change comes at no additional cost for you.  

While we recommend adopting passkeys for phishing-resistant authentication as quickly as possible, we also recognize that some customers may have business needs that make an immediate transition impractical. In such cases, customers may continue to use SMS and voice by selecting a telecom provider in the Microsoft Security Store. 

Rollout schedule

1. September 1, 2026:
   • Rollout begins.began. Changes may take time to reach all tenants and will be deployed gradually. 
   • Passkeys will be automatically enabled for users currently enabled for SMS or voice. 
   • Registration Campaign will be set to Microsoft-Managed targeting passkeys for all users in eligible tenants. 
   • Users will be prompted to register a passkey during MFA sign-in; users will be able to skip. 
2. September 18th, 2026:
   • reviewReview the telecom providers and related information available through the Microsoft Security Store to evaluate which optiohnoption best meets your regional and compliance requirements.
3. October 30, 2026:  
   • Customers who need to continue to use SMS or voice will be able to choose from a list of telecom providers available through the Microsoft Security Store. 
4. February 1, 2027:
   • Microsoft-provided SMS and voice authentication will be retired. 
   • Only customer-configured telecom providers will support SMS and voice going forward. 
   • Passkeys become the default, recommended authentication method. 
5. July 1, 2027:

If no action is taken, tenants relying only on Microsoft-provided SMS or voice may experience sign-in disruptions after February 1, 2027.

Impact on your organization

Who is affected

1. All Microsoft Entra ID tenants enabled for SMS or voice authentication
2. Users enabled for SMS or voice 

Platforms and services

1. Microsoft Entra ID
2. Multifactor authentication
3. Microsoft Security Store

What will happen

1. Passkeys will be automatically enabled for eligible users and Registration Campaign for passkeys will be set to Microsoft Managed state starting September 1, 2026.
2. Users will be prompted during MFA sign-in to register a passkey; users can skip the prompt.
3. Microsoft-provided SMS and voice authentication will be retired for most users on February 1, 2027.2027, and for Global Administrators and external users on July 1, 2027.
4. Organizations that still require telephony methods must configure a telecom provider in the Microsoft Security Store.
5. Tenants that do not configure a provider and continue relying on Microsoft telephony will face SMS and voice authentication disruptions after retirement.

Action required and recommendations

Admins should take the following steps:

1. Prepare for passkeys
   • Plan to transition users to passkeys and communicate upcoming registration prompts. 
2. Decide if SMS or voice is still required
   • If SMS or voice is still needed, you must configure a customer-managed telecom provider. We recommend completing setup at least 4 weeks before the February 1 enforcement to allow sufficient time for testing and a cautious transition. 
3. Set up a telecom provider before February 1, 2027
   • SMS and voice will only work after this date if a customer-configured telecom provider is enabled.  
4. Use temporary opt-out if needed
   • A temporary opt-out will be available for the September 1, 2026 through February 1, 2027 changes. This allows you to delay passkey and Registration Campaign enablement while you complete transition activities, such as configuring customer-managed telecom providers or migrating to other authentication methods.
   • After February 1, 2027, passkey enablement will be enforced for all users in scope.

Additional documentation and more information will be available on Microsoft Learn and the Tech Community.

For more information please visit: https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement more

Learn more:

1. Deploy passkey adoption campaigns with the Conditional Access Optimization Agent | Microsoft Entra | Microsoft Learn
2. Get started with phishing-resistant passwordless authentication deployment in Microsoft Entra ID | Authentication | Microsoft Entra ID | Microsoft Entra | Microsoft Learn
3. It's Time to Hang Up on Phone Transports for Authentication | Microsoft Entra Blog
   
4. Passkeys by default and retirement of Microsoft-provided SMS and voice authentication | Microsoft Entra | Microsoft Learn

Compliance considerations

Review as appropriate for your organization.