What really stops the move to passkeys in Microsoft 365, and what changes by July 2027

The question

A passkey is the safest way to sign in to Microsoft 365 today: it can’t be stolen by phishing, and it doesn’t depend on a phone number. So why, tenant after tenant, do we still see users whose only MFA method is SMS?

What we tested

In a lab tenant we rebuilt the settings we meet most often at customers, and tried to register a passkey in Microsoft Authenticator on iOS and Android, with a new user who has only a password:

A Conditional Access policy on All resources that requires an app protection policy (MAM).
A policy that requires a phishing-resistant authentication strength for All resources.
A policy on Register security info that requires MFA.
Users who reset their own password (SSPR) with SMS.

We checked every result against Microsoft’s documentation, and compared it with what we see at customers.

What we found

A user without MFA is pushed to SMS first. Until now, a new user had to register SMS or a voice call before they could add a passkey. In practice, most employees stop there and stay on SMS. This changes from November 2026 (change 1 below).
A MAM policy on All resources blocks Authenticator. The app doesn’t support app protection grant controls, so registration fails. It’s the most common case in organisations that manage personal phones with MAM.
Requiring a passkey for All resources creates a loop. To add a passkey in Authenticator you have to sign in to the app, and the policy requires a passkey to sign in. The user is stuck.
Password reset is the part people forget. Even after every employee has a passkey, many still reset their password with SMS. After February 2027 that stops working.

What changes, and when

When	What changes
1 September 2026	Passkeys are turned on automatically for users enabled for SMS or voice, and they’re asked to register one at their next sign-in.
30 October 2026	Organisations that must keep SMS can choose a paid telephony provider through Microsoft Security Store.
Nov 2026 – Feb 2027	Change 1: a passkey can be the first MFA method, with no SMS first. In two phases: first synced passkeys, Entra passkeys on Windows and FIDO2 keys; then Windows Hello for Business, macOS Platform SSO and passkeys in Authenticator.
November 2026	Change 2: a new resource, Microsoft Authenticator Credential Registration, that you can exclude from Conditional Access.
1 February 2027	Change 3: Microsoft-provided SMS and voice end for all users, password reset included, except Global Administrators and external users. Anyone without another method must register a passkey at sign-in.
1 July 2027	The same for Global Administrators and external users.

What this solves, and what it doesn’t

Finding 1 is solved by change 1: a new employee can register a passkey straight away. No action is required, but update your guidance for users.
Findings 2 and 3 are solved by change 2, but only if you do it yourself: create the Microsoft Authenticator Credential Registration service principal in your tenant (the request below), and exclude it from every All resources policy that blocks registration.
Finding 4 doesn’t solve itself. Change 3 only forces you to deal with it. The temporary opt-out (passkeyDynamicMigration) delays only the automatic enablement until February 2027, not the retirement.

POST https://graph.microsoft.com/v1.0/servicePrincipals
{ "appId": "6aa00308-ea33-4caa-90d6-ae905d8cb51b" }

What to do now

Find who still depends on SMS, for sign-in and for password reset, with Microsoft’s script (entra-sms-voice-usage-analyzer) and the Authentication methods activity report.
Turn on passkeys with a passkey profile for the right groups. Authenticator needs Android 14 or iOS 17 and later.
Go through every All resources policy that requires MAM or a passkey, and add the new exclusion.
Protect registration with a policy on Register security info that requires MFA.
Start with admins and emergency accounts, then everyone else, with notice in advance.
On Android with a work profile, users need a passkey in each profile.

On the SMS retirement itself, who it affects and what happens if you do nothing: SMS and voice are retired in Entra ID.

Want to know where your tenant stands? Griffin31 checks whether SMS is still enabled, whether passkeys are turned on, and whether admins and all users must use phishing-resistant MFA.

Book a demo