Bence Weiszmann Microsoft Security notes

Entra ID

Microsoft is moving beyond SMS-based MFA: Passkeys become the default authentication experience in Entra ID

Why SMS-based MFA no longer counts as phishing-resistant, and what Microsoft's shift to passkeys as the default authentication experience in Entra ID changes.

By Bence Weiszmann, , 3 min read

SMS-based MFA has played an important role in improving security adoption, but in today's threat landscape it is no longer considered a phishing-resistant authentication method.

Microsoft has announced a significant change: Starting September 1, 2026, Microsoft Entra ID will begin making passkeys the default authentication experience for users currently relying on SMS or voice authentication, and on February 1, 2027, Microsoft will discontinue SMS- and voice-based authentication.

This change is less about introducing another authentication option and more about changing how organizations approach identity security.

Why now, of all times?

In recent years, the focus of attacks has clearly shifted toward identities. Stealing passwords, obtaining session tokens, or even bypassing MFA is now, in many cases, easier than exploiting a traditional vulnerability.

The emergence of AI has further accelerated this trend.

According to Microsoft Threat Intelligence, AI-powered phishing campaigns can achieve click-through rates as high as 54%, while traditional campaigns typically range between 10% and 15%. This means that any authentication method based on a secret that can be stolen or relayed poses an increasingly greater risk.

Although SMS- and voice-call-based MFA have long been important steps on the path to security, today we must defend against attacks such as:

  • AI-based phishing
  • SIM swapping
  • Social engineering
  • MFA fatigue and other MFA bypass techniques

What’s more, attackers are now able to escalate privileges and move laterally within an environment using a compromised identity in a matter of minutes, not hours.

Why are passkeys better?

Passkey is not just another MFA method.

In fact, it takes a completely different approach.

While SMS is based on a shared secret, Passkey uses public-key cryptography. The private key never leaves the user’s device, so there is nothing to steal or enter on a phishing site.

As a result, Passkey:

  • phishing-resistant by design
  • faster and easier for users
  • based on modern public-key cryptography
  • resistant to credential phishing attacks
  • simpler to manage at enterprise scale

What will happen in practice?

Microsoft is rolling out the transition in several phases.

2026. September 1.

Any user who is currently enabled for SMS or voice authentication will also be enabled for passkey registration.

The next time users complete an MFA sign-in, they will be prompted to register a passkey.

2026. September 18.

Microsoft will announce the telecommunications partners that will be able to provide SMS and voice services in the future to those who, for regulatory or business reasons, are not yet able to make the transition.

2026. October 30.

Administrators can now select and configure their preferred provider through the Microsoft Security Store.

2027. February 1.

As of this date, Microsoft will no longer provide native SMS or voice MFA services in Entra ID.

Anyone who wishes to continue using this type of authentication must enter into a contract with a third-party provider and bear the associated telecommunications costs.

After February 1, 2027

Passkey registration will become mandatory.

It will not be possible to opt out of the automatic registration campaign.

What should you start preparing for now?

Organizations that use Microsoft Entra ID should start preparing now.

I recommend the following steps:

  • Identify users who are still using SMS or voice MFA.
  • Start with a controlled passkey pilot deployment.
  • Determine which type of Passkey is best suited for the organization:
    • Microsoft Authenticator Passkey
    • Windows Entra Passkey
    • FIDO2 security keys
    • Platform Passkey (iCloud Keychain, Google Password Manager, etc.)
  • Launch a registration campaign.
  • Communicate the change to users in advance.

For most organizations, this will not merely be a technology upgrade, but an identity security project.

What does this mean in practice?

This announcement clearly demonstrates that Microsoft’s long-term strategy is clear:

The gradual phase-out of passwords and authentication methods based on phishing.

Conditional Access, Token Protection, Continuous Access Evaluation, Passkey, and Identity Protection together form an identity protection model designed from the outset to address the threats of the AI era.

In my opinion, by 2026, the question will no longer be whether it’s worth switching to Passkey, but rather how quickly an organization can implement it in a secure and user-friendly manner.

Organizations that start preparing now will be able to handle the 2027 transition with much greater peace of mind than those who wait until the last minute.

In many environments I work with, identity is already the first place attackers look — because compromising a valid account often provides a faster path than exploiting infrastructure vulnerabilities.

Passkeys are not just another authentication option they represent the next step toward a phishing-resistant identity security model.