Microsoft Entra ID is updating its authentication experience by making passkeys the default sign-in method starting September 1, 2026. Passkeys use public-key cryptography, providing phishing-resistant authentication compared to SMS and voice methods, which rely on shared secrets vulnerable to interception and social engineering. Microsoft will retire its native SMS and voice authentication delivery on February 1, 2027. Organizations must transition users to passkeys or configure third-party telecom providers via the Microsoft Security Store for SMS/voice if required. This change responds to the evolving threat landscape, including AI-powered phishing campaigns and MFA bypass tactics, to enhance identity security.

The update reduces reliance on phishable authentication methods (SMS and voice) that are vulnerable to interception, SIM swapping, and social engineering. By making passkeys the default, Microsoft Entra ID strengthens protection against credential theft and phishing attacks. Organizations continuing to use SMS or voice authentication must contract with third-party telecom providers and bear associated costs. Users will be required to register passkeys for MFA sign-in after the transition, improving overall authentication security posture.

A fix is effectively available as Microsoft is rolling out passkeys as the default authentication method starting September 1, 2026. Organizations should plan and execute migration to passkeys promptly to avoid reliance on SMS and voice authentication, which Microsoft will no longer natively support after February 1, 2027. If SMS or voice authentication remains necessary, organizations must select and configure supported third-party telecom providers through the Microsoft Security Store before the retirement date. Microsoft provides detailed deployment guidance and user communication resources to facilitate this transition.