In a nutshell: Microsoft is ending support for SMS and voice authentication in Entra ID from February 2027, forcing enterprises to switch to passkeys as the only remaining native MFA method.
Microsoft is forcing enterprise customers to migrate to passkeys through binding deadlines: Starting September 2026, SMS and voice authentication in Entra ID will be gradually replaced by passkeys, with support ending completely by February 2027 for Microsoft’s own telecommunications authentication.
Microsoft will make passkeys the standard in its cloud identity management service Entra ID. The rollout spans six months: From 1 September 2026, users with SMS or voice authentication enabled will be automatically prompted to register a passkey during MFA login. On 18 September, Microsoft will share pricing and supported telecommunications providers for legacy cases. From 30 October, organizations that still need SMS or voice authentication must themselves configure a provider and bear its costs. As of 1 February 2027, Microsoft’s native support for these methods ends definitively – there is no opt-out option.
Passkeys replace passwords by combining device ownership with biometrics or PIN. They can be stored on USB keys like YubiKey or as digital credentials on devices or cloud accounts. Unlike passwords and SMS codes, they do not transmit shared secrets over networks and are therefore not phishable. Even AI-generated phishing sites cannot compel users to disclose a passkey because the user’s device and biometrics are part of the authentication process.
The driver for Microsoft’s aggressive strategy is the escalation of the threat landscape: attackers increasingly use AI for automated phishing campaigns, credential theft and fake login pages. SMS and voice authentication, which were broadly deployable, have nothing to counter the modern attack pattern.
Experts attribute slow adoption so far to fragmented identity ecosystems, legacy applications that only support passwords, cross-platform compatibility issues, lifecycle management and onboarding hurdles – as well as the perception of passkeys as consumer technology rather than an enterprise standard. From February 2027, these concerns will become obsolete for Entra ID users.
The regulation applies to public cloud instances of Entra ID. Other cloud environments will follow at a later date.
Source: www.csoonline.com · Published 15 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.