Article
Aug 28, 2026
Passkeys by Default and the Retirement of Microsoft SMS and Voice MFA: The Entra Migration Playbook
Microsoft Entra ID is making passkeys the default sign-in experience and retiring Microsoft-provided SMS and voice authentication. Two dates matter: on 1 September 2026 passkeys are auto-enabled for every user still on SMS or voice and a Microsoft-managed registration campaign starts nudging them; on 1 February 2027 Microsoft-provided SMS and voice telecom delivery is retired, and after that any user whose only MFA method is SMS or voice hits a blocking passkey-registration prompt with no opt-out. This playbook covers who is in scope, how to find your exposed users, how to move them to passkeys, when a customer-managed telecom provider is worth it, the temporary Graph opt-out and its limits, and how it all ties into your Conditional Access baseline. Dates and behaviours validated against Microsoft Learn, August 2026.