Entra ID makes passkeys the default and retires Microsoft-provided SMS/voice MFA

Who is affected

All Entra ID users whose MFA methods include Microsoft-provided SMS or voice. Users already on passkeys, Windows Hello for Business, or FIDO2 are unaffected.

Admin roles to involve: Identity admin, Security admin, Authentication policy admin, Helpdesk

What administrators should do

Identify users still relying on SMS or voice MFA (Microsoft provides a PowerShell script), plan a passkey rollout, and communicate the change. From September 1, 2026 those users are auto-enabled and nudged to register passkeys. If a regulated segment must keep SMS/voice, configure a customer-managed telecom provider through the Microsoft Security Store before February 1, 2027. A temporary Graph-based opt-out exists for the transition period, but the February 1, 2027 enforcement has no opt-out.

What happens if this is ignored

After February 1, 2027, users whose only MFA method is SMS or voice hit a blocking passkey-registration prompt and cannot sign in until they register one.