Microsoft is moving authentication toward passkeys. Here’s what organizations should do now.

The rollout is now active: what administrators should verify

Microsoft’s September 1 change is no longer a future planning item. Users enabled for SMS or voice are being brought into the passkey experience, so administrators should verify the tenant’s authentication-method configuration before relying on the Microsoft-managed rollout.

1. Identify SMS and voice users. Review the Authentication Methods Policy and current registration data so you know which populations are affected.
2. Review the passkey profile. Decide whether all supported passkey types are appropriate for your organization or whether privileged populations need a more restrictive profile.
3. Review the registration campaign. Confirm the Microsoft-managed state and understand which users will receive registration prompts.
4. Prepare Temporary Access Pass and recovery. Document how users will bootstrap or recover strong authentication without falling back to weak identity verification.
5. Separate registration from enforcement. Use Conditional Access authentication strengths where sensitive applications or administrator workflows should explicitly require phishing-resistant MFA.
6. Track exceptions now. February 1, 2027 is the retirement date for Microsoft-provided SMS and voice delivery; users who cannot migrate need an intentional plan rather than a last-minute exception.

Why passkeys are a meaningful security improvement

Passkeys use FIDO2 public-key cryptography and are bound to the legitimate sign-in origin. Unlike passwords, SMS codes, and other shared secrets, there is no reusable credential for a phishing site to capture and replay.

Microsoft Entra supports both device-bound passkeys and synced passkeys. Device-bound credentials stay on a specific authenticator or device. Synced passkeys can follow a user through a supported credential provider, improving usability and recovery.

Inventory who still relies on SMS or voice

Before changing policy, identify users enabled for SMS and voice authentication and understand why those methods are still in use. Separate ordinary users from administrators, executives, service scenarios, frontline populations, and users with legitimate accessibility or technical constraints.

Choose the right passkey model for each population

Pilot before you make passkeys the default experience

Create a representative pilot group and validate registration, day-to-day sign-in, mobile and desktop behavior, account recovery, device replacement, help-desk procedures, and access to critical applications.

1. Configure passkey profiles. Define which passkey types are appropriate.
2. Target a pilot group. Include IT plus representative business users.
3. Test registration and recovery. A strong authentication method still needs a workable lifecycle.
4. Expand in waves. Track registration coverage and support issues before each expansion.

Use stronger requirements for privileged access

Microsoft Entra Conditional Access authentication strengths can require phishing-resistant MFA for selected applications, users, or administrative scenarios. For privileged identities, consider a separate passkey profile and policies that explicitly require phishing-resistant authentication.

Design recovery before deployment

Define recovery and re-registration procedures before broad rollout. Help-desk personnel should know how to validate identity, remove lost authentication methods, issue approved bootstrap credentials such as Temporary Access Pass where appropriate, and recognize social-engineering attempts targeting the recovery process.

What this means for Microsoft 365 Business Premium customers

Business Premium organizations are well positioned for this transition because the subscription includes Microsoft Entra ID P1 capabilities used for Conditional Access. Passkeys themselves are available across Microsoft Entra editions, while Entra ID P1 enables Conditional Access controls such as authentication strengths.

For a broader tenant hardening plan, see the Microsoft 365 Business Premium Security Checklist and our Identity & Zero Trust guidance.

A practical passkey migration checklist

• Inventory users currently enabled for SMS and voice authentication.
• Identify administrators and other high-value identities that need stricter requirements.
• Decide where synced versus device-bound passkeys are appropriate.
• Configure passkey profiles and begin with a controlled pilot group.
• Document enrollment, device replacement, and account-recovery procedures.
• Use Conditional Access authentication strengths where phishing-resistant MFA should be mandatory.
• Review emergency-access accounts before changing authentication policies.
• Measure registration coverage and exceptions before reducing legacy methods.
• Communicate the migration timeline before each rollout wave.

The strongest outcome is not simply compliance with a Microsoft deadline. It is an identity environment where phishable authentication is the exception rather than the default.

Passkey deployment does not eliminate identity social engineering

Microsoft has observed attackers using passkey-themed IT-support lures to steer victims into AiTM and device-code authentication, then adding authentication methods and accessing Microsoft 365 data. Read our passkey phishing and Microsoft 365 identity attack guide for the controls to review beyond deployment.

Microsoft guidance

This guide is based on Microsoft’s current Entra documentation for passkeys, passkey profiles, Conditional Access authentication strengths, and the retirement of Microsoft-provided SMS and voice authentication. See Microsoft’s SMS and voice retirement guidance. Because rollout dates and capabilities can change, validate current Microsoft documentation during implementation.