The confirmed change
Microsoft has announced that passkeys will become the default authentication experience for Microsoft Entra ID users enabled for SMS or voice authentication beginning September 1, 2026. Microsoft-provided SMS and voice delivery is scheduled for retirement on February 1, 2027. Users who rely only on those methods may be required to register a passkey before continuing to sign in.
These are Microsoft’s published dates and policies. Tenant behavior can depend on configuration, licensing, user method registration, and whether an organization chooses a customer-managed telecom provider. Do not wait for a sign-in disruption to discover who is affected.
Who is affected
The impact is not limited to technical administrators. It may include:
- Employees who use text messages for MFA.
- Contractors and guests with access to business resources.
- Owners who use a personal phone as the only recovery path.
- Shared workstations and older devices.
- Service accounts or applications incorrectly treated as human users.
- Staff who work in areas with limited mobile connectivity.
Microsoft recommends phishing-resistant methods such as passkeys, FIDO2 security keys, Windows Hello for Business, and certificate-based authentication. Traditional MFA methods can improve security over password-only access, but remote phishing can target passwords and one-time codes.
Step one: inventory authentication methods
Export or review active SMS and voice users in the tenant. Categorize them by role, device, location, and sensitivity of access. Give priority to administrators, finance staff, executives, employees handling patient or client records, and users with access to critical applications.
Also inventory:
- Break-glass or emergency accounts.
- Authentication methods registered by administrators.
- Guest accounts and external identities.
- Conditional Access policies.
- Legacy applications that cannot handle modern authentication.
- Applications using service principals, certificates, or secrets.
Do not assume that a user who rarely signs in is low risk. Dormant access can become valuable during a compromise.
Step two: prepare the user journey
A passkey rollout is an operational change. Explain what users will see, which devices are supported, what happens when a phone is replaced, and how to report an unexpected registration request.
Provide a controlled enrollment session for users who need help. Do not collect passkeys, PINs, recovery codes, or personal device secrets. A manager should know the support path, not the user’s authentication material.
For workers without suitable devices, consider FIDO2 security keys or another supported phishing-resistant method. Document exceptions and give each exception an owner and expiration date.
Step three: protect privileged accounts first
Microsoft recommends phishing-resistant authentication for privileged accounts. Separate daily work accounts from administrator accounts. Limit permanent administrative access and review application-consent permissions.
A practical order is:
- Administrators and emergency accounts.
- Users with access to sensitive information or critical systems.
- Finance, payroll, and executive accounts.
- Remote workers and contractors.
- Remaining users.
Use report-only policies where available before enforcement. Review sign-in logs for unsupported devices, legacy protocols, service interruptions, and users who would be blocked.
Step four: test recovery before enforcement
Authentication improvements can create recovery problems if the fallback process is weak. Test what happens when:
- A user loses a phone.
- A security key is lost.
- An administrator leaves the company.
- The only registered method is unavailable.
- The tenant administrator cannot sign in.
Microsoft documents identity verification and account-recovery capabilities, but recovery must be configured and governed by the organization. Keep emergency access accounts protected, monitored, and excluded only where necessary for emergency use.
Step five: review applications
Microsoft also documents changes affecting application authentication, including the retirement of service-principal-less authentication for certain non-Microsoft multitenant applications from March 2026. Owners should ask vendors whether their integrations use supported Entra application identities and whether permissions are appropriately scoped.
This is especially important for document systems, scheduling platforms, accounting tools, backup services, and workflow automation. An application that “has always worked” may still depend on an outdated identity pattern.
Confirmed versus uncertain
Confirmed: Microsoft has published the passkey and SMS/voice timeline. Confirmed: Microsoft recommends phishing-resistant authentication methods. Uncertain: the exact user experience for every organization, because tenant configuration, device readiness, policies, and application dependencies differ.
A 90-day preparation plan
- Days 1–15: inventory SMS, voice, administrators, guests, and integrations.
- Days 16–30: select supported passkey or security-key methods.
- Days 31–60: enroll high-risk users and test recovery.
- Days 61–90: use report-only policies, resolve exceptions, and communicate the next steps.
The management lesson is simple: authentication changes are identity-inventory projects. The office that knows who uses which method, what depends on it, and how recovery works will experience a controlled transition instead of an avoidable access crisis.
Sources:
- https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
- https://learn.microsoft.com/en-us/azure/active-directory/authentication/overview-authentication
- https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication
- https://learn.microsoft.com/en-us/entra/identity-platform/retire-service-principal-less-authentication