Microsoft Entra Passkeys 2026: SMS & Voice Retirement

Updated 1 October 2026. Microsoft Entra ID began making passkeys the default authentication experience on 1 September 2026. The change is part of Microsoft’s move away from phishable methods such as SMS and voice toward phishing-resistant authentication.

The most important clarification is that 1 September was not the date when every password, SMS code or voice call stopped working. It was the start of default passkey enablement and registration nudges for users who were still enabled for SMS or voice. The retirement of Microsoft-provided SMS and voice delivery happens later.

Microsoft Entra ID passkeys: what changed on 1 September 2026?

Microsoft says users enabled for SMS or voice in the Entra Authentication Methods Policy—or legacy MFA settings—are automatically enabled for passkeys in the relevant policy. Microsoft-managed registration campaigns can then prompt those users to register a passkey after completing MFA.

Microsoft’s current Entra authentication transition documentation is the primary source for the timeline.

The registration prompt is intended to move users toward passkeys without requiring an administrator to wait until SMS and voice are switched off. Microsoft currently allows users to snooze the registration nudge during this phase.

When will Microsoft-provided SMS and voice retire?

For most users, Microsoft-provided telecom delivery for SMS and voice authentication is scheduled to retire on 1 February 2027. Microsoft documents a later 1 July 2027 retirement date for Global Administrators and external users.

Internal guest users do not automatically fall into that later external-user group; Microsoft’s current documentation says they follow the February timeline unless another documented condition applies.

Does this mean SMS MFA is completely banned?

Microsoft is retiring its own native telecom delivery for SMS and voice in Entra ID, but organisations that still have a business requirement for these methods can evaluate customer-managed telecommunications providers through the Microsoft Security Store.

Microsoft’s strategic recommendation is still to migrate to phishing-resistant methods such as passkeys or Windows Hello for Business rather than treating third-party SMS as the preferred long-term destination.

What is a passkey in Microsoft Entra ID?

A passkey uses public-key cryptography rather than asking a user to type a reusable secret into a website. Depending on the organisation’s configuration, a passkey can be stored in a security key, platform authenticator or supported credential manager.

The security advantage is that the credential is bound to the legitimate service and is far more resistant to conventional credential-phishing pages. A user cannot accidentally type a private key into a fake Microsoft login form because that private key is not handled like a password.

Are passwords disappearing on 1 September?

No. ‘Passkeys by default’ describes Microsoft’s authentication-method rollout and registration experience; it does not mean Entra has universally removed every password from every tenant on that date.

Passwordless deployment is an organisational change. Applications, legacy protocols, break-glass accounts, device registration and recovery processes still need to be reviewed before an administrator can assume the environment is fully passwordless.

What happens to users who only have SMS or voice?

Microsoft says organisations should migrate these users before the relevant retirement date. After Microsoft-provided SMS and voice are retired, users who have no suitable method may face a blocking registration experience that requires them to register a passkey before they can continue.

That is why administrators should not wait until February 2027 to discover which users depend entirely on SMS. The migration work should include account recovery and accessibility scenarios, not only everyday sign-in.

What should Entra administrators check now?

• Identify active users who still rely on SMS or voice.
• Confirm that passkeys are enabled for the intended groups in the Authentication Methods Policy.
• Review the registration campaign and Microsoft-managed settings.
• Test passkey registration on the device types used by employees.
• Review Conditional Access policies so stronger authentication does not unexpectedly break legitimate workflows.
• Prepare help-desk procedures for lost devices, replacement credentials and recovery.
• Keep emergency or break-glass access aligned with Microsoft’s current resilience guidance.
• Audit legacy applications that may still depend on older authentication assumptions.

What about Conditional Access?

Passkeys can contribute to stronger authentication requirements, but enabling passkeys does not automatically redesign an organisation’s Conditional Access strategy. Policies still determine who can access which resources, from what device state, location or risk context.

Administrators should test the combined behaviour rather than treating authentication methods and Conditional Access as separate projects. A technically successful passkey rollout can still create support problems if policy conditions were written around older workflows.

Does a passkey stop every account takeover?

No. Passkeys materially reduce the risk of credential phishing and password reuse, but account security still depends on endpoint security, session protection, recovery controls, administrator privileges and application security.

Attackers can target authenticated sessions, malware-infected endpoints, social-engineering of support processes or weak recovery mechanisms. A phishing-resistant sign-in method is an important control, not a complete security programme.

What if an organisation needs SMS for accessibility or operations?

Microsoft’s transition documentation provides a path to customer-managed telecom providers where SMS or voice remains operationally necessary. Organisations should assess those needs early because a fallback designed in a rush is more likely to create security or support problems.

Accessibility should be handled as a deployment requirement rather than dismissed as resistance to change. Test supported passkey options with the actual user population and maintain documented alternatives where policy and regulation require them.

The timeline in one place

• 1 September 2026: passkeys become the default experience for users in scope; eligible SMS/voice users can be auto-enabled and nudged to register.
• 1 February 2027: Microsoft-provided SMS and voice delivery retires for most users.
• 1 July 2027: Microsoft documents the later retirement for Global Administrators and external users.

Because Microsoft can update implementation guidance, administrators should check the live Microsoft Learn article before executing a migration based on an old screenshot or blog post.

Bottom line

Microsoft Entra ID’s September 2026 change makes passkeys the default direction, but it is a staged transition rather than an overnight deletion of every older authentication method. The immediate task for administrators is to identify SMS/voice dependence, enable and test passkeys, prepare recovery and Conditional Access workflows, and complete migration before the applicable 2027 retirement date.