Tooling

Microsoft is changing how people sign in to its enterprise identity platform. According to the Microsoft Security Blog, passkeys will become the default authentication method in Microsoft Entra ID starting 1 September 2026, and Microsoft's own SMS and voice authentication will be fully retired on 1 February 2027. For developers and IT admins, this is a major push toward passwordless, phishing-resistant login.

Entra ID is Microsoft's enterprise identity platform, formerly known as Azure AD. It is what signs users in to Microsoft 365, Azure and countless applications that rely on Microsoft for authentication. A change to its default sign-in method touches a large share of the corporate world, so it is worth understanding exactly what Microsoft announced and what it does not.

What Microsoft announced

According to the Microsoft Security Blog, from 1 September 2026 passkeys become the default authentication method in Entra ID. In practice, Microsoft says users will be prompted to register a passkey at their next MFA challenge on or after that date. This is about steering people toward passkeys by default, rather than a switch that instantly removes other options overnight.

The second date is the harder deadline. Microsoft says its own SMS and voice (phone-call) authentication will be entirely retired on 1 February 2027. After that, according to Microsoft, organisations that still need text-message or phone-call codes will have to use third-party providers, which are paid. Microsoft says it will share the details - which providers are supported and how pricing works - around 18 September 2026.

What a passkey is and why it resists phishing

A passkey is a modern, passwordless credential based on the FIDO2 and WebAuthn standards. Instead of a shared secret you type in, your device holds a private key and proves your identity by signing a challenge from the site. The matching public key is stored by the service. There is no reusable password to steal, phish or leak in a breach, because the private key never leaves your device.

• Passkeys become the default sign-in method in Entra ID on 1 September 2026
• Microsoft's own SMS and voice authentication is retired on 1 February 2027
• Passkeys use FIDO2/WebAuthn and are phishing-resistant - the private key never leaves your device
• Microsoft says SMS and voice codes cannot stop modern, AI-assisted attacks
• Still need SMS or voice? Microsoft says you will use paid third-party providers (details around 18 September 2026)

Passkeys are described as phishing-resistant because that signature is cryptographically bound to the real website's domain. A fake login page on a look-alike domain cannot produce a valid response, so a user cannot be tricked into handing over a working credential. One-time codes sent by SMS or read out on a call do not have that binding: a convincing phishing page or a scam call can get a user to type or say the code, and an attacker can relay it in real time.

That gap is Microsoft's stated reason for the change. According to Microsoft, SMS and voice codes cannot stop modern attacks, including attacks assisted by AI, and it is pushing passkeys in their place. In other words, the company is retiring a method it considers too weak against today's phishing and real-time relay attacks, and defaulting to one designed to resist them.

What Entra admins should do now

For teams that manage Entra ID, the practical takeaway is to plan now rather than react in 2027. Confirm which users and service accounts still rely on Microsoft's SMS or voice authentication, since those flows stop working when the method is retired on 1 February 2027. Any process built on receiving a text or call code from Microsoft - including some automated or legacy sign-ins - will need another path.

Where SMS or voice is genuinely still required, note that Microsoft says it will point to third-party providers that are paid, with details expected around 18 September 2026. For everyone else, the direction is clear: begin rolling out passkeys and other phishing-resistant methods, test the registration prompt that appears at the next MFA challenge from 1 September 2026, and update internal documentation so users know what to expect.

The honest takeaway

It is worth being precise about what is and is not happening. Making passkeys the default from 1 September 2026 is a change to what users are prompted to set up, not a claim that every other method disappears that day. The hard removal is specifically Microsoft's own SMS and voice authentication on 1 February 2027. Treat those two dates as the anchors and verify anything beyond them against Microsoft's own documentation.

The bigger picture is that a major identity provider is defaulting millions of enterprise users to passwordless, phishing-resistant login and setting a firm date to drop text and call codes it considers outdated. According to Microsoft and reporting from Cybernews and Windows Latest, the reasoning is that SMS and voice cannot keep up with modern, AI-assisted attacks. If you run anything on Entra ID, the two dates to put on the calendar are 1 September 2026 and 1 February 2027.