Entra ID makes passkeys the default, and retires SMS and voice in 2027

Microsoft is making passkeys the default authentication method in Entra ID on two dates. From September 2026, users currently authenticating with SMS or voice are automatically enabled for passkeys. On 1 February 2027, SMS and voice are retired outright and stop functioning.

The second date is the one that matters, because it is enforcement rather than encouragement. Microsoft states there is no opt-out and that the behaviour applies to all tenants. Users already on a phishing-resistant method, Windows Hello for Business, FIDO2 security keys, smart cards, or equivalent, are unaffected and need do nothing.

For organisations that genuinely require phone-based authentication, the remaining route is a third-party telecom provider configured through the Microsoft Security Store, not a tenant setting.

Why it matters

Vendors have spent years recommending against SMS as a second factor while continuing to ship it, because removing it breaks people. This is Microsoft accepting that breakage on a published date, and the deadline does the work that a decade of advisories did not.

The risk is not the technology, it is the tail: shared mailboxes, frontline staff without managed devices, contractors, service accounts with a phone number attached, and anyone whose recovery path silently depends on SMS. Those are exactly the accounts that will discover the change on 1 February 2027. Run the Entra SMS/Voice Policy Scanner now to size the population rather than in January, and read the enrollment step as the risk it is: attackers are already vishing users through fake passkey registration, and a mass migration is exactly the cover such a campaign wants. Our enterprise passkey guide covers sequencing this.

Source: BleepingComputer