Microsoft Entra ID Is Moving Beyond SMS: Is Your Business Ready for Passkeys?

The rollout begins on 1 September 2026. Users enabled for SMS or voice will progressively be prompted to register a passkey during multifactor authentication. On 1 February 2027, Microsoft will stop providing native SMS and voice delivery in Entra ID. Organizations with a specific requirement may select a third-party telecom provider through Microsoft Security Store and pay the related costs.

A passkey replaces a copyable secret with cryptographic proof bound to a device or synchronized through a credential manager. Users can sign in with Windows Hello, Microsoft Authenticator, a FIDO2 key or a compatible manager. The legitimate service receives proof, never a reusable secret, which makes passkeys phishing-resistant by design.

First identify users still relying on phone methods in Entra authentication reports. Select passkey types that fit devices and workflows, then run a small pilot covering mobile workers, leaders and support. Prepare recovery procedures and Temporary Access Pass onboarding. Finally, launch a progressive registration campaign with clear user communication and a known support path.

Enabling everything for everyone without a pilot is risky. Check shared devices, emergency accounts, people without a corporate smartphone and offline scenarios. Do not remove old methods before recovery has been tested. A sound project combines authentication policy, user enablement, support and adoption measurement.