Microsoft Urges Entra ID Admins to Move Users to Passkeys

Why Microsoft is pushing passkeys now

In early 2024 Microsoft announced that it will retire SMS and voice authentication for Entra ID in February 2027. The company says the change is driven by the growing number of phishing attacks that exploit one‑time codes sent by text or call. By moving organizations to passwordless, phishing‑resistant methods such as passkeys, Microsoft hopes to protect billions of identities and avoid future sign‑in outages.

Understanding passkeys and their security benefits

Passkeys are cryptographic credentials stored on a user’s device. When a user signs in, the device creates a signed response that proves ownership of the private key without exposing a secret that can be intercepted. This model eliminates the need for passwords, OTPs, or security questions.

Key security advantages include:

• Phishing resistance – a forged login page cannot request the private key because the credential is bound to the legitimate service.
• Device‑centric protection – private keys never leave the device and are often stored in secure hardware such as a TPM or Secure Enclave.
• Reduced credential reuse – each service receives a unique public key, so a breach at one site does not compromise other accounts.

What the retirement timeline looks like

Microsoft has laid out a clear schedule for the phase‑out:

1. 2024 – Notification to administrators and release of migration tools.
2. 2025 – Mandatory enrollment in at least one passwordless method for all privileged accounts.
3. 2026 – Decrease in support for SMS and voice for non‑critical users.
4. February 2027 – Complete removal of SMS and voice authentication from Entra ID.

Organizations that do not begin the migration early may face sudden lockouts when the older methods are disabled.

Steps for Entra ID administrators

Microsoft provides a set of best practices to help admins transition smoothly:

1. Assess current authentication landscape

Run a usage report in the Entra ID portal to identify how many users rely on SMS or voice OTPs. Separate privileged accounts from regular users, as the former often require stricter controls.

2. Enable passkey registration policies

In the Azure portal, navigate to Authentication methods and turn on the passkey option. Configure conditional access rules that require passkey usage for high‑risk sign‑ins.

3. Communicate the change to end users

Prepare clear messaging that explains why passkeys are safer and how users can enroll using their smartphones or Windows Hello. Provide step‑by‑step guides and video tutorials.

4. Pilot the rollout

Start with a small group of power users. Collect feedback on enrollment friction, device compatibility, and help‑desk tickets. Adjust policies before expanding organization‑wide.

5. Monitor and enforce compliance

Use the Microsoft Passkey documentation to set alerts for users who have not completed enrollment after a defined period. Enforce multi‑factor authentication for any remaining legacy accounts.

Common challenges and how to address them

While passkeys simplify the user experience, administrators may encounter obstacles:

• Device diversity – Not all devices support the WebAuthn standard required for passkeys. Provide fallback options such as Windows Hello for Business or FIDO2 security keys for older hardware.
• User resistance – Some users may be hesitant to replace familiar OTPs. Emphasize that passkeys reduce the need to type codes and protect against phishing.
• Help‑desk volume – Initial enrollment can generate support tickets. Prepare a knowledge base and train staff on common enrollment errors.

Impact on broader cybersecurity posture

Adopting passkeys aligns with recommendations from the National Institute of Standards and Technology (NIST) for stronger digital identity protection. NIST’s Digital Identity guidelines encourage the use of public‑key cryptography to replace shared secrets.

Organizations that complete the migration can expect:

• Lower incidence of credential‑based phishing attacks.
• Reduced reliance on third‑party SMS gateways, which are often targeted by SIM‑swap fraud.
• Improved compliance with regulations that require strong authentication, such as GDPR and CCPA.

Industry response and similar moves

Other major cloud providers are following a comparable path. Google announced a plan to phase out password‑based login for Workspace accounts, while Apple has integrated passkey support across iOS and macOS. The trend reflects a growing consensus that passwordless authentication is the next standard for enterprise security.

Recent coverage from technology news outlets highlights the urgency of the shift. For example, ZDNet reported on Microsoft’s timeline and the potential impact on organizations that have not yet begun migration.

Preparing for the post‑2027 environment

Even after SMS and voice are retired, passkeys will not be the only option. Microsoft continues to support other passwordless methods such as Windows Hello, FIDO2 security keys, and certificate‑based authentication. Administrators should design a flexible strategy that can incorporate multiple methods based on user needs and device capabilities.

Key takeaways for a resilient identity program:

1. Start migration early to avoid last‑minute disruptions.
2. Leverage Microsoft’s built‑in reporting to track enrollment progress.
3. Educate users about the security benefits of passkeys.
4. Maintain a backup authentication method for devices that cannot support passkeys.

By following these steps, Entra ID administrators can safeguard their environments, reduce phishing risk, and stay ahead of the February 2027 deadline.