Microsoft Ends SMS Auth: Passkeys Now Default

Microsoft is set to transition Entra ID authentication to passkeys as the default by September 1, 2026. This significant shift is part of a broader strategy to enhance security against advanced cyber threats.

Further reinforcing this initiative, SMS and voice call authentication codes for Entra ID will be phased out starting February 1, 2027. This retirement aims to encourage widespread adoption of passwordless sign-in methods among business users.

The company highlights the growing threat posed by AI-assisted phishing, noting a 54% click-through rate for such campaigns, compared to 12% for traditional ones. Passkeys offer enhanced security as they require physical access to the user's device, making phishing attempts considerably less effective.

While passkeys become the default, alternative sign-in options such as Windows Hello for Business and FIDO2 security keys will continue to be supported. Microsoft emphasizes that the current threat environment necessitates stronger, phishing-resistant authentication methods to secure AI adoption at scale.