Passkeys Instead of SMS: A 5-Step Guide to Planning Your Entra ID Migration Before 1 February 2027

Updated 7 October 2026: Microsoft has refined the timeline (Message Center MC1426371): Microsoft-provided SMS and voice authentication ends on 1 February 2027 for most users, and only on 1 July 2027 for Global Administrators and external users. Organisations that still need SMS or voice can connect a telecom provider through the Microsoft Security Store from 30 October 2026.

On 1 September 2026, Microsoft began gradually changing multi-factor authentication for all Entra ID users who log in via SMS or voice call. Since then, those users have been prompted to register a passkey when they sign in. And on 1 February 2027, Microsoft will shut down its own SMS and voice option for most users, followed on 1 July 2027 by Global Administrators and external users. After that, SMS and voice only work through a telecom provider you connect yourself.

Organisations that are prepared will experience a smooth transition. Those that are not will confront their employees with a blocking login prompt and a flood of helpdesk tickets.

What Happens When?

Microsoft has announced the following dates (Message Center MC1426371, last updated 15 September 2026; details on Microsoft Learn):

• 1 September 2026: Microsoft gradually launched a Registration Campaign for all Public Cloud tenants. Users who have Microsoft-native SMS or voice set up as their MFA method are invited to register a passkey when they sign in. For now, they can dismiss this prompt indefinitely ("unlimited snoozes").
• 30 October 2026: Organisations that still need SMS or voice can choose a telecom provider in the Microsoft Security Store. The providers have been available for review there since 18 September 2026.
• 1 February 2027: Microsoft-provided SMS and voice are shut down for most users; after that, SMS and voice only work through a provider you connect yourself. Users whose only MFA method is SMS or voice must then register a passkey during sign-in before they can continue (a blocking registration prompt); according to Microsoft, nobody is locked out. This deadline applies to all Public Cloud tenants, and no opt-out is possible.
• 1 July 2027: Microsoft-provided SMS and voice also end for Global Administrators and external users.

The time until the February deadline is your window. The campaign has been running automatically since September, and that's helpful. But without preparation, communication, and a fallback plan, the February deadline will become a real problem.

If you need more time: admins can temporarily delay the passkey rollout until 1 February 2027 at the latest via the Microsoft Graph API by setting the passkeyDynamicMigration property to true. This postpones the nudge, but not the hard shutdown on 1 February 2027.

Am I Affected?

Yes, if at least one user in your tenant has Microsoft-native SMS or voice set up as an MFA method. You can find the full picture in the Entra Admin Center under Reports → Authentication Methods Activity. Filter by SMS and voice.

Not affected by this timeline: Azure AD B2C, Microsoft Entra External ID (a separate announcement will follow) and special cloud environments (GCC, China Cloud). External users such as B2B guests from other organisations fall within scope, but for them and for Global Administrators the Microsoft-provided SMS and voice option only ends on 1 July 2027; internal guest users stay on 1 February 2027. Microsoft plans passkey support for B2B and internal guest users by the end of 2026. Self-Service Password Reset (SSPR) configured with SMS is also affected and must be included in your planning.

What Are Passkeys, Exactly?

A passkey replaces both a password and an SMS code with a cryptographic confirmation on the user's own device, verified via biometrics (Face ID, fingerprint) or device PIN. Entra ID supports two types:

• Synced Passkeys (e.g., iCloud Keychain, Google Password Manager): Synchronised across devices; no loss of access when switching devices.
• Device-bound Passkeys (Microsoft Authenticator, FIDO2 hardware security keys): Valid on a single device only; highest security level.

Passkeys are available at no additional cost in all Entra ID editions, including the free tier. To enforce passkey use via Conditional Access (phishing-resistant MFA required), you need Entra ID P1, which is already included in Microsoft 365 Business Premium, M365 E3, and E5.

Compatibility requirements at a glance:

Browsers: Chrome, Edge, Firefox, and Safari are supported. Firefox on Android is currently not supported.

The 5-Step Plan for Your Entra Tenant

Whether you manage a tenant for a small office in Recklinghausen or a mid-sized company in the Ruhr region, the approach is the same everywhere:

Step 1: Inventory (who is still using SMS or voice?) Download the Authentication Methods Activity report in the Entra Admin Center and filter by SMS and voice. This gives you an exact picture of how many users are affected and lets you estimate the effort involved.

Step 2: Pilot group (start with admins) Enable passkeys in the Authentication Methods Policy for a small test group first, ideally IT administrators and technically confident employees. Test all sign-in scenarios (browser, desktop app, mobile app) before rolling out more broadly.

Step 3: Secure with Conditional Access (recommended) With Entra ID P1, you can create a policy that enforces phishing-resistant MFA. This prevents users from falling back to weaker methods and simultaneously supports many cyber insurance and compliance requirements.

Step 4: Define a fallback Plan for what happens when a user loses their device or cannot use their passkey. Options include the Microsoft Authenticator app (TOTP), a FIDO2 hardware key, or a Temporary Access Pass (TAP). Without a fallback plan, helpdesk load will rise sharply after 1 February 2027.

Step 5: Communicate with users (now, not just before 1 February 2027) Inform your employees proactively: what a passkey is, why Microsoft is making this change, and how the registration works (Settings → Security Info → Add passkey). A short internal email or a one-page guide will prevent dozens of support calls.

Special Case: Frontline Workers and Shared Devices

Cashiers, warehouse staff, and other frontline workers who share a terminal run into a structural problem: a passkey is bound to a specific device and user, which does not work smoothly on shared devices. Microsoft has announced an alternative solution starting 30 October 2026: through the Microsoft Security Store, tenants will be able to connect an external telecommunications provider that continues to deliver SMS and voice. The providers have been available for review there since 18 September 2026; Microsoft recommends completing the setup at least four weeks before 1 February 2027. FIDO2 hardware security keys (personally assigned, portable) are not subject to this limitation.

If your organisation has frontline worker scenarios, place this user group on your watchlist and review the providers in the Microsoft Security Store in good time.

Note: This post is not legal or compliance advice. It provides a technical overview based on official Microsoft documentation. Current as of August 2026.

Conclusion

1 September 2026 may have sounded like a deadline, but it was actually the start of a grace period. The hard cutover is 1 February 2027 (1 July 2027 for Global Administrators and external users). Organisations that run their inventory now, roll out to a pilot group in the coming weeks, and communicate with users in good time will navigate this transition without stress.

Want to know how many of your users are still relying on SMS MFA and what the migration looks like for your specific tenant? Get in touch. We support Entra ID projects in the Ruhr region and beyond.

Related service: IT support and managed services

Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).