Microsoft's Shift to Passkeys: A Revolutionary Move in Identity Security
Microsoft is making a bold move in the realm of identity security, marking a significant shift in how it handles authentication for its core access management product, Entra ID. Starting September 1, 2026, passkeys will become the default authentication method for users enabled for SMS or voice authentication, reflecting a broader industry trend away from text message and voice-based checks.
This change is not just a technical update; it's a strategic response to the evolving threat landscape, particularly the increasing sophistication of AI-enabled phishing campaigns. According to Microsoft, passkeys, which use public-key cryptography, are designed to resist phishing, offering a more secure alternative to shared secrets. The company's Threat Intelligence data highlights alarming click-through rates in AI-enabled phishing campaigns, emphasizing the need for stronger authentication methods.
The transition to passkeys is a comprehensive strategy, addressing the limitations of traditional SMS and voice authentication. Microsoft is ending its telecom delivery for these methods, shifting customers to third-party providers available through the Microsoft Security Store. This move is not just about security; it's about user experience, making the authentication process more seamless and user-friendly.
One of the key advantages of passkeys is their ability to automate the authentication process, eliminating the need for manual intervention. This automation is crucial in today's fast-paced digital environment, where security must be both robust and efficient. By making passkeys the default, Microsoft is not just enhancing security but also streamlining the user experience.
The migration path is well-defined, with clear timelines and fallback options. Administrators are advised to prepare for the passkey rollout, identifying users still relying on SMS or voice, and choosing the appropriate passkey types for their device estate and workflows. User communications will be essential, ensuring that employees understand the changes and the benefits of the new authentication method.
For organizations that still require SMS or voice for regulatory, technical, or business reasons, Microsoft provides a solution. These organizations can select a telecom partner through the Microsoft Security Store, ensuring compliance and continuity. The transition is designed to be predictable, with clear dates and fallback options, ensuring a smooth migration process.
The timetable for the passkey rollout is as follows: On September 18, 2026, more information on supported telecom providers, deployment guidance, pricing, and commercial terms will be shared. From October 30, 2026, administrators can select and configure a supported telecom provider through the Microsoft Security Store. After February 1, 2027, users will be required to register a passkey before signing in, with no opt-out.
This shift to passkeys is a significant step in Microsoft's commitment to enhancing identity security. By making passkeys the default, the company is not just addressing the current threat landscape but also preparing for the future. The use of public-key cryptography and automation in passkeys positions Microsoft at the forefront of secure authentication, setting a new standard in the industry.
In conclusion, Microsoft's decision to make passkeys the default in Entra ID is a strategic move that addresses the evolving threat landscape, enhances security, and improves user experience. As the company navigates this transition, it sets a precedent for the industry, demonstrating the power of innovation in identity security.
