The biggest authentication shift in Microsoft Entra ID history is here. On July 13, 2026, Microsoft announced that passkeys will become the default phishing-resistant authentication method in Entra ID, with Microsoft-provided SMS and voice MFA being fully retired by February 2027. This isn’t a suggestion or a recommendation — it’s a forced transition with no opt-out.

Alongside this blockbuster announcement, Microsoft also formally announced the retirement timeline for Custom Controls in Conditional Access (MC1422061), giving organizations a hard deadline to migrate to External MFA.

Let’s break down both announcements, the timelines, and exactly what your organization needs to do.

1. Passkeys Become the Default Authentication Method in Entra ID

Announced: July 13, 2026 Source: Microsoft Security Blog Cloud: Public cloud (other clouds to follow on separate timeline)

The Big Picture

Microsoft is executing a multi-phase transition away from SMS and voice-based MFA toward passkeys — and they’re not leaving it up to individual organizations to decide whether to participate. The rollout is automatic, Microsoft-managed, and ultimately mandatory.

The reasoning is clear from the threat intelligence Microsoft cites:

  • AI-enabled phishing campaigns now achieve click-through rates as high as 54%, compared to roughly 12% for traditional phishing campaigns
  • Microsoft observes over 4,000 password-based attacks per second
  • SIM swapping and MFA bypass techniques have become more accessible and repeatable, amplified by AI tooling

SMS and voice authentication rely on shared secrets and channels that attackers increasingly intercept, phish, or manipulate. Passkeys, based on public-key cryptography, are phishing-resistant by design — they cannot be intercepted, replayed, or socially engineered in the way SMS codes can.

The Timeline: Four Key Dates

September 1, 2026 — Passkeys Become Default

Microsoft begins a gradual rollout across all Entra ID tenants in the public cloud. As the rollout reaches each organization:

  • Users currently enabled for SMS or voice authentication are automatically enabled for passkeys
  • The next time those users perform MFA, they’ll be prompted to register a passkey during sign-in
  • A Microsoft-managed Registration Campaign targeting passkeys will be enabled for all eligible tenants to drive adoption

No admin action is required to trigger this — it happens automatically as the rollout reaches your tenant.

September 18, 2026 — Telecom Partner Details Published

Microsoft will share information about supported telecom providers, including:

  • Pricing and commercial terms
  • Deployment guidance and technical documentation
  • A list of supported carriers available through the Microsoft Security Store

This is for organizations that have a regulatory, technical, or business requirement to keep SMS or voice authentication. If you can move everyone to passkeys, you can ignore this entirely.

October 30, 2026 — Telecom Partner Configuration Opens

Administrators can now select and configure a supported telecom provider through the Microsoft Security Store. Key points:

  • Customers contract directly with supported carriers
  • Customers are responsible for all telecom-related costs charged by the provider
  • Microsoft will no longer absorb SMS/voice delivery charges
  • Organizations should test configurations with a pilot group before broad rollout

February 1, 2027 — Microsoft-Provided SMS and Voice Retired

This is the hard deadline:

  • Microsoft-provided telecom delivery for SMS and voice authentication ends
  • SMS and voice are no longer offered as a native Microsoft Entra ID capability
  • Users who still rely on SMS or voice for MFA will be required to register a passkey before they can sign in
  • Automatic passkey registration prompts will be enforced for all users in all tenants
  • There will be no opt-out option

Any continued use of SMS or voice after this date must run through a customer-configured telecom partner via the Security Store.

Supported Passkey Types in Entra ID

Microsoft Entra ID supports several types of passkeys, giving organizations flexibility in their deployment:

Synced passkeys:

  • Stored in platform credential managers like iCloud Keychain and Google Password Manager
  • Available across a user’s devices
  • Generally available in Entra ID since June 2026

Device-bound passkeys:

  • Microsoft Authenticator passkeys — stored in the Authenticator app on a specific device
  • Entra passkeys on Windows — registered directly in the Windows Hello container, work with Windows Hello biometrics or PIN
  • FIDO2 security keys — hardware-based keys from vendors like Yubico

All of these function as FIDO2 credentials and are managed through passkey profiles in the authentication methods policy, which became generally available in June 2026.

Why This Matters for Your Organization

If your organization still has users on SMS or voice MFA — and many do, particularly for frontline workers, break-glass accounts, or users in regions with limited smartphone adoption — this transition is coming for you whether you’re ready or not.

The good news: Microsoft has built the infrastructure to make this relatively painless. The passkeys framework, registration campaigns, system-preferred authentication, and passkey profiles are all already in place and generally available. The auto-enablement means you don’t have to manually flip switches for every user.

The bad news: if you have genuine regulatory or operational requirements for SMS/voice, you’re looking at a new vendor relationship, new costs, and a configuration deadline of October 30, 2026. And if you miss the February 2027 deadline, your users will be locked out until they register a passkey.

How to Prepare

Step 1: Audit Your Authentication Methods (Do This Now)

Review your Authentication Methods policy in the Entra admin center. Identify which users and groups are still enabled for SMS or voice authentication. Classify them by business function, risk level, and whether they have a genuine regulatory/operational need to stay on SMS/voice.

Step 2: Plan Your Passkey Rollout

Enable passkeys (FIDO2) in your authentication methods policy if you haven’t already. Choose the passkey types that best fit your users’ devices and workflows. Use Registration Campaigns to nudge users to register passkeys during sign-in — this is the same mechanism Microsoft will use for the automatic rollout, so you can get ahead of it.

Step 3: Prepare User Communications

Your users need to know what’s changing, when they’ll see passkey prompts, and how to complete registration on their device. This is especially critical for frontline workers and non-technical users who may be unfamiliar with passkeys. Provide step-by-step guidance and support resources.

Step 4: Handle Residual SMS/Voice Requirements

For users who genuinely cannot use passkeys (regulated scenarios, legacy devices, specific operational needs):

  1. Document the affected user segments and use cases
  2. Starting October 30, 2026, select and configure a supported telecom provider in the Microsoft Security Store
  3. Test with a pilot group before broad rollout
  4. Complete cutover before February 1, 2027

Step 5: Leverage System-Preferred Authentication

Entra ID’s system-preferred authentication (extended to first-factor in June 2026) automatically selects the strongest registered authentication method for each user. As users register passkeys, the system will naturally prefer them over weaker methods — potentially enabling passwordless sign-in for users with strong passkey credentials.

Several June 2026 Entra ID updates provide the foundation for this transition:

  • Synced passkeys GA — The passkey type most users will encounter first
  • Passkey profiles GA — Admin framework for managing different passkey configurations per user group
  • Registration campaigns support passkeys — The nudging mechanism Microsoft will use
  • System-preferred authentication expanded to first-factor — Automatic preference for stronger methods
  • SSPR requiring registered methods (September 7, 2026) — Complementary change ensuring password reset only uses registered methods
  • Conditional Access enforcement during credential registration (July 6, 2026) — Closes security gaps during Windows Hello and macOS Platform SSO enrollment

2. Retirement of Custom Controls in Conditional Access

Announced: July 9, 2026 (MC1422061) Source: M365 Message Center Act by: April 30, 2027

What’s Happening

Microsoft is formally retiring Custom Controls in Conditional Access — the legacy framework for integrating third-party MFA providers with Entra ID policies. The replacement is External MFA (formerly called External Authentication Methods or EAM), which is already generally available and provides a modern, standards-based integration using OpenID Connect.

The Timeline

September 2026: Administrators will no longer be able to create new Custom Controls or modify existing Custom Controls in Conditional Access policies. Existing Custom Controls continue to function.

May 2027: Custom Controls are fully retired and no longer supported. All Conditional Access policies using Custom Controls must be migrated to External MFA before this date.

Who Is Affected

Organizations currently using Custom Controls in Conditional Access policies — typically those integrating third-party MFA providers like Duo Security, Okta, or other identity verification solutions. If you’re not using Custom Controls, no action is needed.

Migration Path

  1. Review your Conditional Access policies and identify any that use Custom Controls
  2. Configure your third-party MFA provider as an External Authentication Method in Entra ID
  3. Update affected Conditional Access policies to use the standard “Require multifactor authentication” grant control (which now supports External MFA)
  4. Validate authentication flows and confirm successful migration
  5. Remove all Custom Control references after migration is complete

Why This Matters

Custom Controls were a useful bridge for integrating third-party MFA, but they had limitations — they didn’t integrate deeply with Conditional Access, couldn’t participate in system-preferred authentication, and operated outside the modern authentication framework. External MFA solves all of these problems by using OpenID Connect standards and providing native integration with Conditional Access policy evaluation.

Combined with the passkeys-by-default announcement, this means organizations using third-party MFA providers need to make two decisions:

  1. Can you move to passkeys instead of your third-party MFA? If yes, you can skip External MFA entirely and use native Entra ID passkeys.
  2. If you need to keep your third-party MFA provider, migrate from Custom Controls to External MFA before September 2026 (when you can no longer modify Custom Controls) and definitely before May 2027.

The Bigger Picture: Microsoft’s Authentication Endgame

These two announcements, taken together, reveal Microsoft’s strategic direction for authentication in Entra ID:

  1. Phishing-resistant authentication is becoming the default, not the premium option. Passkeys are free, automatic, and eventually mandatory. There’s no additional license required.

  2. Phishable authentication methods are being sunset, not deprecated — retired. SMS and voice aren’t getting a warning label; they’re being removed from the platform entirely (for Microsoft-provided delivery).

  3. The ecosystem is being consolidated around standards. Custom Controls (proprietary integration) → External MFA (OpenID Connect standards). SMS/voice (telecom-based) → Passkeys (FIDO2/WebAuthn standards). Microsoft is reducing the number of authentication paths and converging on industry standards.

  4. The transition is Microsoft-managed, not admin-managed. The passkeys rollout happens automatically. Registration campaigns are Microsoft-enabled. System-preferred authentication auto-selects the strongest method. Admins don’t have to manually transition users — Microsoft does it for them.

For organizations, the message is clear: the era of “we’ll get to passkeys eventually” is over. The transition is happening, the timeline is published, and the deadlines are hard. The time to plan is now.

Resources

About the author: Kevin Kaminski is the founder of Big Hat Group Inc., a 20+ year Microsoft partner specializing in AI and cloud technologies. Follow him on X at https://x.com/kkaminsk for the latest Microsoft infrastructure and security insights.