Microsoft has confirmed that passkeys will serve as the standard authentication approach for its Entra ID enterprise identity platform beginning in September 2026.

Passkeys will activate automatically for Entra ID accounts that currently depend on phone-based SMS and voice verification, both of which are scheduled for retirement across every tenant in February 2027.

Accounts already protected by passkeys, Windows Hello for Business, FIDO2 keys, smart cards, or other phishing-resistant options can keep using those same methods without change.

Microsoft stated that once the update reaches an organization, users set for SMS or voice will gain passkey support and receive a prompt to register one during their next multifactor authentication step.

After the transition, Microsoft will end its own telecom support for SMS and voice on February 1, 2027, removing both options as built-in Entra capabilities.

Companies should move every user to a phishing-resistant method before that deadline to prevent sign-in issues once SMS and voice are no longer available for multifactor checks.

Administrators holding global reader, authentication policy administrator, or security reader roles can locate affected accounts by running the Entra SMS/Voice Policy Scanner PowerShell script.

Groups that must retain phone authentication will need to set up third-party providers via the Microsoft Security Store.

Step-by-step instructions for rolling out and managing phishing-resistant passwordless sign-in appear in Microsoft documentation.

Teams are encouraged to drop telephony methods to reduce identity attacks and boost security, especially after recent SaaS theft campaigns that targeted Entra single sign-on accounts with stolen credentials.

Microsoft Threat Intelligence noted AI-driven phishing campaigns achieving click rates up to 54 percent versus roughly 12 percent for traditional efforts, underscoring the risk of passwords and phishable factors.

Setting passkeys as the default experience helps organizations cut reliance on vulnerable methods and guard against credential theft and phishing attempts.