All posts

Entra makes passkeys the default. SMS/voice retire in 2027. MSPs: here’s the 30‑day plan.

Starting Sept 1, 2026, Entra will prompt SMS/voice MFA users to register passkeys. Microsoft-provided SMS/voice retires Feb 1, 2027, with no opt‑out. Here’s how MSPs prevent sign‑in breaks across tenants.

AI‑enabled phishing now drives materially higher click‑through than traditional campaigns. Microsoft’s response: make passkeys the default in Entra and phase out Microsoft‑provided SMS and voice for MFA.

Key dates MSPs must track

• Sept 1, 2026: Passkeys become the default sign‑in experience for Entra tenants. Users enabled for SMS/voice will be auto‑enabled and prompted to register a passkey during MFA.
• Feb 1, 2027: Microsoft‑provided SMS/voice is fully retired. Users whose only MFA is SMS/voice will hit a blocking prompt to register a passkey. There’s no opt‑out.
• Sept 18, 2026: Microsoft will publish details on customer‑managed telecom options via the Microsoft Security Store for orgs that must keep SMS/voice.

What to do in the next 30 days (multi‑tenant)

1. Inventory risk:
   • Report who actually uses SMS/voice today and where passkeys are already enabled. Prioritize high‑impact roles and shared/device‑restricted users.
2. Set your target authentication baseline:
   • Enable passkeys for all users capable of phishing‑resistant auth (passkeys, Windows Hello for Business, FIDO2). Define exceptions per customer.
3. Update Conditional Access:
   • Require phishing‑resistant MFA for admins and sensitive apps. Add registration requirements so passkey prompts land before your deadlines, not during a critical login.
4. Ready the endpoints:
   • Confirm platform/browser support, security key availability, and managed device policies. Test passkey profiles and attestation behavior.
5. Communications + support:
   • Send tenant‑branded guides, schedule desk‑side enrollments for frontline users, and script help‑desk flows for blocked sign‑ins after Feb 1, 2027.
6. Decide on SMS/voice continuity (if required):
   • If regulation or edge cases demand OTP by phone, plan a customer‑managed telecom provider via the Microsoft Security Store and budget for carrier fees.

Practical takeaway

This shift is coming with hard dates. If you don’t move users to phishing‑resistant methods, they will be forced to register passkeys during sign‑in—and production will stop while they do it. What percentage of your customers’ users still rely on SMS/voice today? Start with that number and work it down weekly.