Microsoft makes passkeys the default in Entra ID as it retires built-in SMS codes

Microsoft is making passkeys the default sign-in method in Entra ID, its workplace identity service, and has reminded administrators that it will stop delivering SMS and voice authentication codes itself on Feb. 1, 2027. The company says organizations that still depend on text-message codes need to move users to phishing-resistant methods before then or risk sign-in disruption.

The change matters to almost every Canadian organization that uses Microsoft 365. Text and voice codes remain common as a second factor, but they can be phished, intercepted or defeated through SIM-swap fraud. Microsoft's documentation now states plainly that SMS and voice are no longer positioned as secure authentication methods.

What is changing

According to Microsoft's retirement guidance, the rollout began Sept. 1, 2026. Users enabled for SMS or voice are automatically enabled for passkeys, and a Microsoft-managed registration campaign nudges them to register one after they complete multifactor authentication. By default, users can snooze that prompt as often as they like.

That changes on Feb. 1, 2027, when Microsoft-provided SMS and voice delivery is retired for most users. After that date, a user whose only MFA method is SMS or voice will be forced to register a passkey before signing in, and the prompt cannot be skipped. Global administrators and external users get until July 1, 2027. Internal guest users follow the February date.

Organizations that have a regulatory or operational need to keep text or voice codes can contract a telephony provider through the Microsoft Security Store. Microsoft lists Soprano and Telesign as the first providers, with configuration opening Oct. 30, 2026. BleepingComputer reported that Azure AD B2C and Entra External ID customer tenants are not affected.

A temporary opt-out, set through Microsoft Graph, lets a tenant delay the automatic passkey enablement until February. Microsoft says there is no opt-out from the retirement itself.

Why it matters

Passkeys use a cryptographic key pair tied to a device or a synced credential store, so there is no code for an attacker to trick a user into typing on a fake page. Entra supports synced passkeys stored in platform managers such as iCloud Keychain or Google Password Manager, and device-bound passkeys held in Microsoft Authenticator, Windows Hello or a FIDO2 hardware key.

What to do

• Run Microsoft's SMS and voice usage scanner to find users who still rely on those methods.
• Tell staff a passkey prompt is coming and give device-specific instructions before the nudges turn into a hard block.
• Check that shared accounts, front-line workers and staff without smartphones have a workable alternative, such as a hardware security key.
• If you must keep SMS for compliance reasons, line up a telephony provider well before Feb. 1, 2027.