Microsoft Entra Passkeys Default Starts September 1: Plan SMS Fallback Now

Microsoft Entra ID is moving enterprise authentication further away from telecom-delivered MFA. Microsoft Learn says passkeys become the default authentication experience on September 1, 2026 for users enabled for SMS or voice. Beginning February 1, 2027, Microsoft-provided telecom delivery for SMS and voice will be retired, and tenants that still need those methods should configure customer-managed providers through the Microsoft Security Store.

This is not a claim that SMS is useless. It is a sign that high-value workforce authentication is moving toward phishing-resistant credentials by default. Passkeys resist phishing, SIM swap, replay, and shared-secret theft better than traditional codes.

What businesses should do now

Organizations should not wait until the blocking date to find out who still depends on SMS or voice MFA. A clean migration needs inventory, testing, help-desk preparation, and fallback planning for users who lose devices or cannot use a platform authenticator.

• Identify active SMS and voice MFA users.
• Enable passkeys and run a registration campaign before enforcement.
• Plan Temporary Access Pass or help-desk recovery flows.
• Use customer-managed telecom only where SMS or voice is still required.
• Protect administrator accounts with phishing-resistant methods first.

BillioPlus perspective

BillioPlus sits in the real world where SMS, voice, and virtual numbers still solve practical onboarding and recovery problems. The lesson from Entra is not to abandon SMS everywhere. The lesson is to reserve stronger authentication for higher-risk actions and give SMS a clear, limited role.

For admins, passkeys should become the primary control. For customer onboarding and low-risk verification, SMS may remain useful when paired with rate limits, fraud checks, and clear anti-phishing language.

Source links

• Microsoft Learn: Passkeys by default and SMS/voice retirement
• Microsoft Learn: SMS and voice retirement FAQ