Microsoft Mandates Passkeys by Default in Entra ID, Begins Phasing Out SMS Authentication
Tap title to read story
Microsoft Corporation has officially mandated passkeys as the default authentication experience across Microsoft Entra ID starting September first two thousand twenty-six. The major security transition automatically prompts users reliant on traditional text message or voice verification for multi-factor authentication to adopt phishing-resistant credentials today. Microsoft confirmed that native telecommunications delivery for short message service and voice verification will be completely retired by February first two thousand twenty-seven. Organizations requiring telephony-based authentication due to specific regulatory or operational requirements must configure independent telecom providers through the Microsoft Security Store following upcoming commercial releases. The policy shift aims to combat rising identity threats and sophisticated artificial intelligence driven credential theft targeting corporate cloud networks globally. Tenants retain administrative options for temporary deferrals during the migration window, but complete transition to phishing-resistant public-key cryptography remains mandatory for long-term platform compliance across enterprise digital environments worldwide right now for enhanced cloud account security standards.
Timeline
- On July 13 2026 Microsoft announced passkeys as default authentication method for enterprise platforms.
- On August 1 2026 enterprise security teams reviewed updated policy guidelines published by Microsoft.
- On August 13 2026 administrators warned against using SMS verification methods amid rising cyber threats.
- On September 1 2026 Microsoft began rolling out passkeys by default across Entra tenants.
- On September 18 2026 Microsoft will share pricing and commercial terms for telecom partners.
- On October 30 2026 administrators may select supported external telecom providers via security store.
- On February 1 2027 Microsoft will retire native SMS and voice authentication service completely.
- On February 2 2027 users lacking passkeys face mandatory registration prompts during sign in.
- In mid 2027 corporate networks evaluate improved phishing resistance levels across active directories.
- By 2028 passwordless authentication standards dominate enterprise security market sectors throughout industries.
Sources
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.































