Passkeys are taking over: What the end of SMS and Voice means for Entra ID
Overview
Microsoft is accelerating the move from phishable authentication methods toward Passkeys and phishing-resistant authentication.
Starting September 1, 2026, Entra ID users enabled for SMS or Voice will be automatically enabled for Passkeys and brought into the Passkey Registration Campaign, prompting them to register a Passkey after MFA. Then, on February 1, 2027, Microsoft-provided SMS and Voice authentication will be retired.
In this article, we’ll explore what is changing, how FIDO2 and Passkeys work, and how to assess your environment to identify who still depends on SMS or Voice before the transition.
What is changing in Microsoft Entra ID?
Microsoft is moving Entra ID away from natively provided SMS and Voice authentication and making Passkeys the default path forward.
The transition starts before the actual retirement date:
| Date | What Changes |
|---|---|
| September 1, 2026 | Users enabled for SMS or Voice are auto-enabled and nudged for Passkey registration upon MFA sign-in. |
| February 1, 2027 | Microsoft-provided SMS and Voice are fully retired in Microsoft Entra ID. |
| After February 1, 2027 | Users whose only MFA method is SMS or Voice must register a Passkey during sign-in. The prompt is blocking. |
Microsoft provides a temporary opt-out from the September Passkey/Registration Campaign changes during the transition period. However, there is no opt-out from the February 1, 2027 retirement enforcement.
The key point: the migration does not start in February 2027. It starts in September 2026.
Global Administrators and external users follow a later retirement timeline of July 1, 2027. Internal guest users remain in scope for February 1, 2027.
Why This Matters
This change is not simply about replacing one authentication method with another.
SMS and Voice can provide MFA, but they are still vulnerable to phishing, social engineering, SIM swapping, and credential relay attacks. The real challenge for organizations is understanding who still depends on these methods and who is ready to move to stronger authentication.
The security baseline is shifting from “MFA enabled” to “Phishing-resistant authentication enabled.”
Not all MFA methods provide the same level of protection and that is exactly why Passkeys matter.
From SMS Codes to Passkeys
SMS and Voice improved account security by adding a second factor beyond the password. The problem is that both methods still rely on credentials that can be received, copied, shared, or relayed.
Passkeys change that model.
Instead of asking the user to receive and enter a temporary code, Passkeys use FIDO2 public-key cryptography to authenticate the user without sending a reusable secret during sign-in.
What Is FIDO2?
FIDO2 is an open authentication standard built around two main components:
When a Passkey is registered, a cryptographic key pair is created:
- Private Key → stays protected by the authenticator
- Public Key → registered with Microsoft Entra ID
During sign-in, Entra ID sends a challenge that is signed with the private key and validated using the public key.
What Is a Passkey?
A Passkey is a FIDO2-based credential that provides passwordless and phishing-resistant authentication.
Instead of: Password → SMS Code → Sign in
the experience becomes: Passkey → Biometric / PIN → Sign in
The PIN or biometric does not authenticate directly to Microsoft. It unlocks the local authenticator so that it can use the private key to complete the cryptographic challenge.
This is one of the main reasons Passkeys are resistant to phishing and credential replay.
Assess Before You Migrate
Before changing authentication policies, start by understanding what is already happening in your tenant.
Microsoft Entra provides built-in reporting that can help answer an important question: Are users simply registered for SMS and Voice, or are they actually using these methods?
Start in: Microsoft Entra admin center → Entra ID → Authentication methods → Activity
The Authentication Methods Activity dashboard provides two main views:
| View | What it shows |
|---|---|
| Registration | Which authentication methods users have registered and whether they are capable of MFA, passwordless authentication, or SSPR. |
| Usage | Which authentication methods are actually being used for sign-in and password reset activities. |
Microsoft Entra ID P1 or P2 is required to access Authentication Methods Usage and Insights.
User Registration Details
The User registration details report provides a user-level view of authentication readiness.
It helps identify:
- Which users are MFA capable
- Which users are passwordless capable
- Which authentication methods are registered
- Whether users already have FIDO2, Passkeys, Windows Hello for Business, Microsoft Authenticator, or phone-based methods
Assessment Tooling
There is no single view that answers the entire migration-readiness question.
Microsoft and the community provide different tools that help assess policy scope, actual SMS/Voice usage, and available authentication alternatives. Together, they help answer three practical questions:
Who CAN use SMS/Voice? → Who ACTUALLY uses it? → Who still DEPENDS on it?
| Item | Tool | What it is | What it does |
|---|---|---|---|
| Policy Scope | Get-SmsVoicePolicyUsers.ps1 | Official Microsoft PowerShell script | Analyzes SMS and Voice configuration in the Authentication Methods Policy, including policy state, targets, Registration Campaign state, migration state, and CSV export. |
| Actual Usage | SmsVoiceActualUsage.kql | Community KQL query for Log Analytics / Sentinel | Analyzes Entra SigninLogs to identify users who actually authenticated with SMS or Voice and summarizes usage details. |
| Authentication Alternatives | Get-UserAuthMethodSplit.ps1 | Community PowerShell script | Checks registered authentication methods for the users identified in the previous step and separates users with alternative MFA from phone-dependent users. |
| Microsoft Graph | userRegistrationDetails and related reports | Microsoft Graph reporting data source | Retrieves tenant-wide authentication registration and readiness information, including registered methods, MFA/passwordless capability, preferred methods, and admin status. |
Consolidated Assessment Script
To simplify the assessment, I created a PowerShell script that consolidates the main checks performed by the tools above into a single HTML report.
One important advantage is that Log Analytics or Microsoft Sentinel aren’t required to identify SMS and Voice usage. The script queries Microsoft Entra sign-in logs directly through Microsoft Graph.
The assessment includes:
- SMS and Voice Authentication Methods Policy configuration and targeting
- Registration Campaign configuration, including Passkey migration opt-out
- Actual SMS and Voice authentication usage
- Registered authentication methods and available MFA alternatives
- Users that still depend on phone-based authentication
- MFA and passwordless readiness information
The script analyzes the previous 30 days of sign-in activity, which is the default assessment window used by the tool.
It is available in my PowerShell repository: Download the script from GitHub
Example HTML report:
Hands-On: Enable and Configure Passkeys
With the assessment complete, the next step is to configure Passkeys in Microsoft Entra ID and validate the experience with a small pilot group.
The rollout follows this sequence:
Enable Passkey Profiles
In the Microsoft Entra admin center, browse to: Entra ID → Security → Authentication methods → Policies → Passkey (FIDO2)
If Passkey Profiles haven’t been enabled yet, select the option in the banner to opt in.
When Passkey Profiles are enabled, the existing global Passkey configuration is moved to a Default passkey profile. Microsoft currently supports up to three Passkey profiles, including the Default profile.
This is also a one-way operation: after Passkey Profiles are enabled, you can’t return to the previous global-only configuration.
On the Configure tab, also verify: Allow self-service set up = Yes
This setting is global. If it is disabled, users can’t register their own Passkeys through Security info even if Passkey (FIDO2) is enabled for them.
Create a Passkey Profile
The profile defines which Passkeys users assigned to it are allowed to register and use.
Select + Add profile and create a profile dedicated to the pilot deployment.
Choose the Passkey Type
When creating the Passkey profile, one of the first decisions is whether to allow device-bound or synced Passkeys.
- Device-bound keep the private key associated with a specific authenticator or device. Physical FIDO2 security keys are a common example.
- Best fit: administrators and highly privileged users.
- Synced can be synchronized through a supported Passkey provider and used across multiple devices.
- Best fit: broader workforce and user convenience.
Attestation and AAGUID
When configuring a Passkey profile, two terms are important: Attestation and AAGUID.
Think of Attestation as a certificate of authenticity. During registration, the authenticator can provide information that allows Microsoft Entra ID to verify that it is a genuine device from the claimed vendor.
For example, Entra can verify that a security key really comes from an expected manufacturer and model.
AAGUID (Authenticator Attestation GUID), on the other hand, works more like a model identifier. Each authenticator type has an AAGUID that Entra can use to identify and control which authenticators are allowed.
In simple terms:
- Attestation → “Can I trust that this authenticator really is what it claims to be?”
- AAGUID → “Which authenticator model is this?”
This allows an organization to create rules such as Allow only approved YubiKey models or Block specific authenticator types.
To find an authenticator’s AAGUID, check the vendor documentation, the Microsoft list of supported FIDO2 security keys, or the FIDO Alliance Metadata Service. Prefer official sources over third-party lookup tools.
Enable and Target the Pilot Group
After creating the profile, go to: Passkey (FIDO2) → Enable and Target
Enable Passkey (FIDO2) and assign the profile to your pilot group:
Register and Test a Passkey
With the policy assigned, sign in as the test user at: https://aka.ms/mysecurityinfo
Select: Add sign-in method → Security key
Then:
- Connect the device.
- Enter or configure its PIN.
- Touch the device when prompted.
- Complete the registration.
The process is simple:
- PIN → unlocks the authenticator
- Touch → confirms user presence
- Private key → remains on the YubiKey
The PIN isn’t the user’s Microsoft Entra password and isn’t sent to Microsoft.
After registration, the device appears in Security info and can be tested by signing in with the new device-bound Passkey.
Drive Adoption with Registration Campaign
After validating Passkeys with a pilot group, the next step is to encourage users to register them during normal sign-in.
In the Microsoft Entra admin center, go to: Entra ID → Authentication methods → Registration campaign
For a controlled rollout, configure:
- State: Enabled
- Authentication method: Passkey
- Include: your pilot or migration group
- Days allowed to snooze: 1–14
- Limited number of snoozes: Enabled or Disabled
When targeted users complete MFA, Microsoft Entra can prompt them to register a Passkey. Users can select Skip for now according to the configured snooze settings.
For SMS and Voice migration, this is especially important because Microsoft is moving affected users into a Microsoft managed Passkey registration campaign as part of the retirement process.
Use Enabled when you want full control over the Passkey target and snooze behavior. Use Microsoft managed when you prefer Microsoft to apply the recommended campaign settings automatically.
Enforce Phishing-Resistant Authentication
Registration Campaign helps users adopt Passkeys, but it doesn’t require them to use one.
To enforce phishing-resistant authentication, use Conditional Access + Authentication Strength.
Go to: Microsoft Entra admin center → Entra ID → Conditional Access → Policies → New policy
For a pilot deployment:
- Users: Specific group
- Target resources: select the application or resources you want to protect
- Grant: Grant access + Require authentication strength: Phishing-resistant MFA
Microsoft provides a built-in Phishing-resistant MFA strength that supports methods such as FIDO2 security keys and other phishing-resistant authentication methods.
Start the policy in Report-only mode to validate the impact before switching it to On.
Make sure targeted users have already registered a phishing-resistant authentication method before enforcing the policy. Otherwise, they may be unable to access the protected resource.
Once enabled, users covered by the policy can no longer satisfy the authentication requirement with SMS or Voice. They must use an authentication method that satisfies the configured phishing-resistant strength.
Final Thoughts
The retirement of SMS and Voice authentication isn’t just a change in Microsoft Entra ID, it’s an opportunity to move users toward stronger, phishing-resistant authentication.
The safest migration path is straightforward:
Assess → Configure Passkeys → Pilot → Drive Registration → Enforce Phishing-Resistant Authentication
Start by identifying who can use SMS or Voice, who actually uses them, and who still depends on phone-based authentication. Then configure Passkey Profiles, test the experience with a pilot group, drive adoption through Registration Campaign, and finally enforce phishing-resistant authentication with Conditional Access.
Moving away from SMS and Voice significantly reduces exposure to attacks such as:
- credential phishing
- OTP theft and interception
- adversary-in-the-middle (AiTM) phishing
- SIM-swapping attacks
- social engineering targeting SMS or Voice verification
With Passkeys, authentication is based on public-key cryptography and the private key remains protected by the user’s authenticator, making credentials much harder to steal or replay.
The goal isn’t simply to replace one MFA method with another. It’s to remove authentication mechanisms that can be phished and move the environment toward a stronger, passwordless, and more resilient identity model.
References
Microsoft. Passkeys by default and retirement of Microsoft-provided SMS and voice authentication. Microsoft Learn. Available at: Microsoft Learn
Microsoft. FAQ for Microsoft-provided SMS and voice retirement. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Authentication Methods Activity. Microsoft Learn. Available at: Microsoft Learn
Microsoft. How to enable passkeys (FIDO2) in Microsoft Entra ID. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Enable synced passkeys in Microsoft Entra ID. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Register a passkey with a FIDO2 security key. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Run a registration campaign to set up a passkey or Microsoft Authenticator. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Conditional Access authentication strengths. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Require phishing-resistant multifactor authentication for administrators. Microsoft Learn. Available at: Microsoft Learn
Microsoft. Entra SMS/Voice Policy Scanner. Microsoft GitHub. Available at: GitHub
FIDO Alliance. FIDO User Authentication Specifications. FIDO Alliance. Available at: FIDO Alliance