Entra ID retires SMS MFA, passkeys become the default

The timetable is fixed

Any account enabled for SMS or voice in the Authentication Methods Policy or in the legacy MFA settings has been enabled for passkeys automatically since the start of September. The registration campaign is set to "Microsoft Managed" and shows a prompt at the next sign-in with MFA. By default, users can dismiss that prompt as often as they like. Administrators can change that.

There is a temporary opt-out. It exempts the tenant from the automatic enablement and from the campaign until 1 February 2027, and it requires Graph permissions plus a policy change. The retirement itself stays on schedule. Microsoft states plainly that there is no way around the enforcement.

• 1 September 2026: automatic passkey enablement and sign-in nudge

• 30 October 2026: own telecom provider configurable in the Security Store

• 1 February 2027: Microsoft-provided SMS and voice end for regular accounts and internal guests

• 1 July 2027: same step for Global Administrators and external guest accounts

Where agencies run into trouble

The prompt comes from Microsoft and appears on every platform, so on the Mac, on the iPhone and in the browser. For the helpdesk that means queries which look like an MDM problem but are not one.

Shared and functional accounts are the awkward part. An info@ or accounts@ mailbox secured by SMS to the office number cannot run the same way with passkeys. Passkeys are tied to a person and a device. These accounts need their own inventory and a different model before the wider rollout.

Freelancers, client logins and shared project tenants are in scope too. Internal guests fall under the February date, external guests under July 2027. We could not yet verify in detail how passkeys behave under macOS and Safari. We are testing that and recommend the Authenticator app route until we know more.

For Contao, WordPress or Shopware projects there is no direct technical link. It matters where Microsoft 365 identities are wired into a content system or shop backend. Transactional SMS from a shop, such as dispatch notifications, are unaffected by this change.

The deadline that arrives sooner

Anyone running a local AD with Entra Connect Sync has a more pressing date in the calendar. From version 2.5.79.0 onwards synchronisation continues, below that the services stop on 30 September 2026. That is nine days from today.

Also since 7 September, self-service password reset only accepts explicitly registered authentication methods. Phone numbers and mail addresses from directory attributes no longer count. Tenants that relied on them will find out at the worst possible moment.

What to do now

We recommend a short, ordered sequence per tenant. The effort depends heavily on how many accounts are still set to SMS or voice. For tenants already fully on Authenticator or passkeys, there is little left to do.

Bringing your own telecom provider into the Security Store makes sense only under genuine regulatory pressure. It is configurable from 30 October, it requires a carrier contract of your own, and it preserves a method that Microsoft itself rates as weak.

• Check the Entra Connect version and update before 30 September

• List which accounts are still enabled for SMS or voice

• Decide how often the prompt may be dismissed and set that value in the registration campaign

• Handle functional and shared accounts separately

• Write a short guide for Mac and iPhone and send it out before the first prompt

• Review the registered SSPR methods