[REVISION HISTORY]

Microsoft Entra ID authentication method transition

Updated 3 times since CLSTR started tracking revisions of this situation.

What changed

2026-09-02 04:36 UTC → 2026-09-03 03:30 UTC · added ~~removed~~

Microsoft is transitioning its Entra ID identity platform toward passwordless authentication by phasing out SMS and voice call-based multi-factor authentication (MFA). This shift is driven by the rise of AI-enabled cyber threats, including increased effectiveness in phishing, social engineering, and SIM-swapping attacks. Starting September 1, 2026, passkeys will become the default sign-in method for Microsoft Entra ID tenants. During this phase, users currently relying on SMS or voice credentials will be prompted to register a passkey during the sign-in process as part of an automatic enablement and registration campaign. Organizations have a temporary window between September 2026 and February 1, 2027, to use the Microsoft Graph API to delay automatic registration and coordinate migrations. Passkeys utilize a cryptographic key pair where the private key remains securely on the user's device—often leveraging TPM 2.0 hardware—while the public key is stored on the service server. Authentication is typically completed via biometrics, such as facial recognition or fingerprints, or through a PIN via Windows Hello. Supported storage methods include Microsoft Authenticator, password managers, mobile devices, or physical security keys. For Windows 11 users, the implementation integrates with the operating system and Edge browser to provide a phishing-resistant experience. As part of this broader strategic push, Microsoft is testing a feature in the Edge browser Canary build designed to automatically detect and replace weak passwords with stronger ones. By February 1, 2027, Microsoft will permanently terminate native SMS and voice verification for all Entra ID accounts. After this deadline, no opt-out option will be available, and any users exclusively using the discontinued methods will be required to register a passkey to sign in.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.