How to Prepare for Microsoft Entra ID Passkey Default: A Step-by-Step Migration Guide

According to Microsoft, “SMS and voice are no longer positioned as secure authentication methods and will no longer be provided natively in Entra ID”. Microsoft explicitly explained that these traditional authentication methods are phishable and highly vulnerable to cyberattacks.

So, whether you’re restructuring your organization’s security posture or migrating from E5 to E7 license to adopt AI enterprise-wide, it is critical to acknowledge this “Microsoft Entra ID Passkey 2026” rollout.

You do not have to wait for the September 2026 automated nudges. Simply go through this step-by-step migration guide. It will help you prepare your environment for passkey use and make your tenant more secure and AI-ready!

Microsoft Entra SMS and Voice MFA Retirement Timeline

Here is the complete Entra SMS and Voice MFA retirement timeline that highlights the phases with dedicated key changes:

Why Microsoft is Making Passkeys the Default Sign-In Experience?

Microsoft Entra ID is enabling passkeys as the default sign-in authentication method across all tenants to secure authentication (from rising AI-enabled phishing and identity attacks) and help enterprises adopt AI at scale.

Traditional authentication methods (such as SMS/Voice MFA) rely on shared secrets. That makes them highly prone to cyberattacks. Cybercriminals can easily bypass these vulnerable methods through:

• Sim swapping attacks
• Social engineering
• And advanced man-in-the-middle phishing kits.

On the other hand, passkeys use public-key cryptography instead of shared secrets, which is highly optimized after accounting for severe cyberattacks. Also, it has been observed that it significantly improves the user experience. Yes, signing with a passkey is 14x faster than typing a password or waiting for a text message.

Starting from September 1, 2026, passkeys (passwordless sign-in) will become the primary authentication method and will be automatically applied to users enabled for SMS or voice.

Additionally, from February 1, 2027, Microsoft’s built-in telecom delivery for SMS and voice will be retired. Prompting users requiring SMS or voice to configure customer-managed providers via the Microsoft Security Store.

Users who already register or sign in with passkeys, Windows Hello for Business, or alternative phishing-resistant methods can continue using those methods. But the big question is: how to find active SMS or voice users in the tenant?

How to Find Active SMS or Voice Users in the Tenant?

Auditing active SMS or voice users in the tenant before migrating from MFA to modern authentication is a critical step. Microsoft 365 experts and IT professionals strongly advocate for this practice to identify vulnerable users.

There are two ways to find out active SMS/voice users in the tenant:

1. Checking Authentication Method Policy (in the Entra admin center).
2. PowerShell script (Entra SMS/Voice Policy Scanner).

Before running the PowerShell script, make sure you have one of the Global Reader, Authentication Policy Administrator, or Security Reader roles enabled.

• Policy.Read.All: Read authentication method policies
• Group.Read.All: Fix group display names

The Entra SMS/Voice Policy Scanner PowerShell script:

1. Displays the registration camp state (enabled/disabled/Microsoft managed).
2. Provides SMS and voice policy state and scope (included/excluded groups and users).
3. Exports chosen groups/users to CSV.
4. Shows an impact summary purely based on the SMS/Voice retirement timeline.

#Here are prerequisites PowerShell script:

Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Module Microsoft.Graph.Identity.SignIns -Scope CurrentUser
Install-Module Microsoft.Graph.Groups -Scope CurrentUser

#Entra SMS/Voice Policy Scanner PowerShell Script

.\Get-SmsVoicePolicyUsers.ps1 -TenantId "contoso.onmicrosoft.com"

#Run the given command if you have already connected to Graph

.\Get-SmsVoicePolicyUsers.ps1

Here’s the example output of the Entra SMS/Voice Policy Scanner PowerShell script

Registration campaign: Microsoft managed

SMS state: disabled
Voice state: enabled

Voice scope:
Include: ALL USERS
Exclude group: Service Accounts (abc-123-def)

Exported to: .\SmsVoicePolicyTargets_20260624_100000.csv

===== IMPACT SUMMARY =====
Sep 1, 2026: Users in SMS/Voice scope auto-enabled for passkeys. Reg campaign set to Microsoft Managed.
To prevent: move users out of SMS/Voice AMP scope before Sep 1.
Jan 28, 2027: Microsoft SMS/Voice delivery RETIRED. Migrate to passkeys or configure a customer-managed provider.
Guide: https://aka.ms/passkey-deployment-guide

Once you have found the vulnerable SMS/Voice users, it’s time to understand the passkey types Entra ID supports.

Understanding Passkey Types (Device-Bound vs Synced Credentials)

Understanding the types of passkeys Microsoft Entra ID supports is imperative before you migrate from SMS to passkeys in Microsoft. Because each passkey serves a different security posture. Typically, Microsoft Entra ID supports two primary types of passkeys:

• Synced Passkeys
• Device-Bound Passkeys

Additionally, you can assign different passkey profiles that align with the user roles, risk levels, and regulatory requirements.

Synced Passkeys (Cloud-Based)

Synced Passkeys is specifically designed for a smooth, multi-device experience. It operates on a cloud-based architecture. This private key is created, encrypted on the local device, and backed up to a cloud-based credential provider. The headlining advantage of Synced Passkeys is that they solve the credential recovery problem.

• Suppose an employee loses their phone or upgrades to a new laptop and tries to sign in on the new device; the passkey backed up on his/her cloud ecosystem will be instantly restored. Significantly reducing helpdesk tickets for lost MFA tokens.
• It is an ideal passkey option for environments where reducing sign-in friction and maintaining productivity are strictly prioritized (such as standard enterprise users, hybrid workers, and BYOD (Bring Your Own Device) environments).
• Apple iCloud Keychain, Google Password Manager, and third-party managers such as iPassword or Dashlane are common providers.
• The only caveat with Microsoft Entra ID’s Synced Passkey is that Microsoft cannot perform attestation due to credential roaming across the cloud. A critical security check to cryptographically validate the specific physical hardware being used.

Device-Bound Passkeys

Device-bound passkeys are well optimized for zero-trust environments (such as highly regulated industries, strictly managed corporate endpoints, and executives with access to sensitive data). It generates a cryptographic key pair on a single, physical hardware chip and is locked on that exact device. Hence, it can never be exported, backed up, or synced to the cloud.

• It supports a strict hardware attestation. Entra ID can easily verify exactly the model through which a user is authenticating. Even if the user’s personal cloud account gets compromised somehow, no attacker can extract the passkey because it is physically stored or tightly trapped inside the hardware.
• Common providers of Device-bound passkeys are FIDO2 hardware security keys, Windows Hello PIN (connected to the local TPM chip), and the Microsoft Authenticator app.
• Device-bound passkeys drawback is the credential will be lost forever if the physical device is lost or destroyed. The respective employee must go through the organization’s recovery process to register a brand new device.

The Role of Microsoft Authenticator

Microsoft Authenticator operates as a device-bound passkey and lives on a mobile device, serving as a powerful, cost-effective middle ground. It provides secure, unphishable security of a physical FIDO2 USB key when the Authenticator app passkey setup is configured.

It generates a private key and secures it within the exact phone’s secure hardware (It doesn’t sync to personal iCloud or Google account). To use it, the user is required to unlock the key locally via biometric login (Face ID, Fingerprint) or a device PIN.

How to Set Up Passkeys in Microsoft Entra? (FIDO2 Passkey Deployment Guide)

Migrating from SMS/voice to passkeys and setting up passkeys in Microsoft Entra requires a systematic, disciplined approach. Because a misconfigured policy has the potential to block users from logging in or mistakenly allow an unauthorized consumer credential manager to save corporate credentials

So, here’s how to set up, configure, and use passkeys in the tenant ahead of the September 2026 default:

Prerequisites for configuring Passkeys (Minimum Requirements)

• Permissions: Requires Authentication Policy Administrator Role to sign in to the admin center.
• OS Compatibility: Windows 10 version 1903 (2004 for Hybrid-joined) or iOS 17+ /Android 14+ to support native passkey APIs.

Step #1: Sign in to Microsoft Entra Admin Center

• Go to Microsoft Entra Admin Center.
• Log in as an Authentication Policy Administrator.

Step #2: Select the Passkey (FIDO2)

• Locate Entra ID and select Security.
• Click the Authentication method (on the left-hand navigation pane) >> Select Policies.
• Find and select Passkey (FIDO2) from the list of available methods.
• Click the link in the banner text to opt in. This will allow you to use passkey profiles.

Note: Once you opt in to enable passkey profiles, you can’t opt out.

Step #3: Configure Allow self-service setup to Yes.

• Switch to the Configure tab >> set the Allow self-service setup to Yes (at the top).
• If this setting is configured to No, users will not be able to register their own passkeys via the My Security Info portal. Even if the passkeys are allowed by the Authentication methods policy.

Step #4: Select the Default Passkey Profile

• Select the default passkey profile (under the Default passkey profile tab).

Step #5: Create & Set Up a New Passkey Profile

• Click +Add passkey profile (on the Configure Tab) to customize the experience for specific security groups.
• Enter the mandatory profile details in the given fields. In the Passkey Types, choose the Passkey types that align with your Corporate security framework:
  •  Device-bound,
  •  Synced,
  • or both.
• Set Enforce attestation to Yes (for highly regulated enterprises).
• Optional Step: Toggle Enforce key restrictions to Yes >> enter specific AAGUIDS (Authenticator Attestation Global Unique Identifiers). It will allow registration only for approved vendors (such as YubiKey or Microsoft Authenticator).
  Click Save to apply the configuration

Step #6: Apply a Passkey Profile to a Targeted Group

• Switch to Enable and Target >> Toggle the Enable switch to On (in the Enable and Target Tab)
  Under the Include tab, click +Add Target.
• Choose All users or select targets to select the specific groups.

Note: It is strongly advised to avoid selecting “All users”. Only choose this once you have validated your helpdesk and recovery workflows.

• Select the passkey profiles (you want to assign to a specific group).

How to Delete a Passkey Profile (FID02)?

If you feel that you have misconfigured a passkey profile, you can easily delete it:

• Select Configure >> click the Delete (trash icon) next to the passkey profile >> Save.

How to Enforce Passkey (FIDO2) Sign-In?

Enforcing passkey sign-in for users ensures sensitive resources remain safe from unauthorized exposure. To do so,

• Use a native phishing-resistant authentication strength.
• Or, create a custom authentication strength.

A custom authentication strength is a Conditional Access Policy that enables passkey (FIDO2) sign-in for only a particular security key model or passkey (FIDO2) provider. Here’s how to create a custom authentication strength;

• Log in to the Microsoft Entra admin center as a Conditional Access Administrator.
• Go to Entra ID >> Authentication Methods >> Authentication strengths.
• Click New authentication strength.
• Name your new authentication strength.
• Provide a Description and select Passkeys (FIDO2)
• Optional Step: To restrict a specific AAGUID, click Advanced options >> Add AAGUID. Enter the AAGUID and hit Save.
• Lastly, right-click Next and validate the policy configuration.

How to Provision Passkeys using Microsoft Graph API (Preview)?

To provision passkeys, IT admins and teams can use Microsoft Graph Preview and custom clients. Provisioning passkeys in the preview requires the Authentication Administrator role or a client application (with UserAuthenticationMethod.ReadWrite.All permission).

This provisioning can request WebAuthn creation Options from Microsoft Entra ID. Including the ability to register the provisioned security key directly with Microsoft Entra ID.

Also, using these modern APIs, enterprises can architect their own clients to provision passkey (FIDO2) credentials on security keys on behalf of a user. Here are the three core steps of it:

• Request creationOptions for a user: The MS Entra ID shares back the required information of the client to provision a passkey credential. The necessary information comprises user information, relying party ID, credential policy requirements, algorithms, registration challenge, etc.
• Provision the passkey credential using the creation Options: For provisioning the credential, use the creationOptions and a client compatible with Client to Authenticator (CTAP). This step requires inserting the security key and configuring a PIN.
• Register the provisioned credential with Entra ID: To provide Entra ID the required information to register the passkey (FIDO2) credential for the targeted user, use the formatted output from the provisioning process.

Note: For Internal or external guest users, registration of passkey (FIDO2) credentials is not supported. It also includes B2B collaboration users in the resource tenant. And if a user’s UPN is modified, IT admins cannot modify passkeys. The user needs to sign into Security Info using the passkey, delete the old passkey, and create a new one.

How to Migrate Users to Phishing-Resistant Security (During Tenant Consolidation)?

Don’t worry, we’ll sort it out for you! We understand that as an IT administrator or business owner, you want secure authentication across your complete Microsoft 365 ecosystem.See, merging tenants or migrating users while implementing the “Microsoft Entra ID Passkey Default 2026” requires ultimate precision.

Because enforcing a tenant-wide shift to passkeys is challenging enough on its own. And attempting to do so while major structural changes create a high-risk scenario that may result in:

• Corrupted or Lost Data: Incomplete migration of Exchange Mailboxes and OneDrive architectures.
• Security Vulnerabilities: Misapplied Conditional Access policies.
• Low Productivity: Locked-out users; unable to access historical files after new deployment.

But that doesn’t mean you cannot navigate this complexity. Simply by automating the data transfer, you can achieve major structural change, including modern phishing-resistant methods.

The Takeaway

Microsoft is forcing this Entra SMS MFA retirement and setting passkeys as the default authentication method to ensure robust credential theft protection. Because legacy authentication methods such as SMS/Voice MFA are highly vulnerable to cyberattacks because they rely on shared secrets.

So, if your employees or users are still using SMS or Voice MFA, proactively migrating to the modern authentication method before the complete retirement is highly recommended. Until the full SMS MFA retirement, you may experience sign-in disturbances. And once the legacy authentication methods are retired completely, you must register for a phishing-resistant method or choose a paid, third-party telecom provider to continue using SMS or voice

Contact us at @[email protected] or [email protected] for any technical queries!

FAQs (Frequently Asked Questions)

Q.1 When is Microsoft automatically turning on passkeys for everyone?
Starting from September 1, 2026, Microsoft will start automatically turning on passkeys as the default sign-in experience for everyone. It will be a phased rollout across all tenants.

Q.2 What happens to users who only use SMS for 2FA right now?
From September 1, 2026, they will be automatically nudged to adopt a passkey or other phishing-resistant authentication method. After February 1, 2027, the SMS/voice MFA will completely retire. Organizations will need to set up a paid custom telecom provider via the Microsoft Security Store.

Q.3 Will we have to pay to keep using SMS authentication?
Unfortunately Yes! You will have to integrate third-party telecom providers via the Microsoft Security Store and pay for it if your enterprise has strict operational requirements. Microsoft is retiring its free, native SMS/voice delivery. Starting October 30, 2026, you will be able to start configuring the telecom providers in the Microsoft Security Store.

Q.4 Can employees use personal phones for Microsoft Authenticator passkeys?
Absolutely Yes! Employees can install and use the Microsoft Authenticator app on their personal devices. Because passkeys depend on device-level biometric login (Face ID, Fingerprint). Ensuring the private key remains secure and isolated on the employee’s phone.

Q.5 How do we find out who is still using SMS in our system?
By running the Entra SMS/Voice Policy Scanner PowerShell script as a Global Reader or Authentication Policy Administrator, you can generate a dedicated report of all users currently using SMS MFA.

Q.6 Do passkeys work if an employee gets a new phone?
It entirely depends on the passkey type. If you or the admin enabled synced credentials (such as Apple iCloud Keychain or Google Password Manager), the passkey will automatically sync on the new device. On the other hand, if a strict device-bound credential is enforced, the employee will need to register their new phone as a new authentication device.