Passwords remain one of the weakest points in enterprise security. They can be phished, guessed, reused across services, and exposed in data breaches. Microsoft is now steering Microsoft Entra ID away from password-based sign-in and toward phishing-resistant, passwordless methods. For organizations, this changes how identities and access to cloud applications are protected, not just how users log in.
Where Entra ID Stands Today
Entra ID already supports several passwordless methods: passkeys, Windows Hello for Business, Microsoft Authenticator, and FIDO2 security keys. Two recent changes make passkeys the clear priority:
- Passkey enablement. From September 1, 2026, users who are enabled for SMS or voice authentication are automatically enabled for passkeys. They may be prompted to register one when they complete an MFA sign-in.
- SMS and voice retirement. Microsoft is retiring its own SMS and voice authentication in favor of methods that resist phishing and one-time-code attacks.
What Is a Passkey?
A passkey is a passwordless credential built on public-key cryptography. Rather than typing a password, the user verifies their identity with a fingerprint, face scan, device PIN, or security key. No reusable secret is sent to the service, so there is nothing for an attacker to capture and replay.
Entra ID supports two types:
- Synced passkeys are stored in a supported credential manager and available across the user’s devices.
- Device-bound passkeys stay tied to a single device or security key.
Why Microsoft Is Retiring SMS and Voice
SMS codes have long been a common second factor. They are stronger than a password alone, but they are not phishing-resistant. Attackers can use a fake sign-in page to capture a code in real time, and SIM-swapping gives them a way to intercept messages altogether.
The retirement of Microsoft-provided SMS and voice authentication follows this timeline:
| Group | Retirement date |
|---|---|
| Most users in scope | February 1, 2027 |
| Global Administrators and external users | July 1, 2027 |
Organizations with a legitimate need to keep SMS or voice can configure a customer-managed telecommunications provider. Even so, every Entra ID tenant should review how its users currently authenticate.
What Changes for Users
For employees, the sign-in flow can get simpler. Instead of entering a username, a password, and an SMS code, a user enters a username and approves the sign-in with a passkey, whether by fingerprint, face, or PIN.
On Windows, Windows Hello for Business and FIDO2 security keys offer similar experiences and can authenticate users to Entra ID and to Entra-joined or hybrid-joined devices. The result is a sign-in that is both easier to use and harder to phish.
Passwordless Does Not Mean Password-Free Overnight
Adopting passwordless authentication does not require removing passwords from every account and application at once. Most organizations move in stages: introduce passkeys or Windows Hello, enroll users, track adoption, and then use Conditional Access to require stronger authentication for specific users, applications, or risk conditions. Microsoft recommends a full phishing-resistant deployment plan rather than a single administrative switch.
Recommended Steps for IT Administrators
- Assess current usage. Identify users who depend on passwords, SMS, or voice authentication.
- Choose target methods. Move suitable users to passkeys, Windows Hello for Business, Microsoft Authenticator, or FIDO2 security keys.
- Use registration campaigns. Entra ID can prompt users at sign-in to register a passkey or Microsoft Authenticator, which allows gradual rollout without forcing everyone to change at once.
- Enforce with Conditional Access. As adoption grows, require stronger authentication where it matters most.
Passwordless authentication is also a core element of a Zero Trust strategy. The goal is not only to eliminate passwords but to verify identity more reliably before granting access to company resources.
Account Recovery and Help Desk Readiness
Passwordless authentication does not remove every identity risk. Lost or replaced phones, forgotten PINs, and lost security keys still need a defined process. Recovery matters even more once passwords are gone: if a user loses their authentication device, the organization needs a secure way to verify them and restore access without creating a weaker fallback that attackers can exploit. Microsoft has emphasized securing recovery workflows and removing weak authentication fallbacks as part of this transition.
Traditional identity security assumed that users prove who they are by knowing a secret. Modern approaches rely on stronger signals: cryptographic credentials, trusted devices, biometrics, security keys, and risk-based access policies. Passkeys are quickly becoming central to that model.
For organizations already using Microsoft 365, Entra ID, Intune, and Conditional Access, this is an opportunity to build an authentication environment that evaluates both identity and device, rather than leaning on a password.
Passwordless adoption is more than a feature to turn on. It touches identity, devices, security policy, user training, help-desk processes, and account recovery. Organizations that begin planning now can move users off weaker methods at a measured pace and give employees time to get comfortable with passkeys before the SMS and voice retirement dates arrive.