Insights

Microsoft Entra Passkeys by Default: What UAE Businesses Should Prepare Before 2027

July 23, 2026

Microsoft is changing the default authentication experience in Microsoft Entra ID. From September 1, 2026, passkeys begin becoming the default sign-in experience for users still enabled for SMS or voice authentication. From February 1, 2027, Microsoft-provided SMS and voice authentication delivery retires in Entra ID.

Clear Microsoft deadline

Organizations still depending on SMS or phone-call MFA need a migration plan before the 2027 retirement date.

Phishing-resistant sign-in

Passkeys reduce exposure to SIM swap, fake login pages, social engineering, and code theft.

User readiness matters

The rollout affects communication, helpdesk scripts, devices, security keys, and account recovery.

Admins should move first

Privileged roles should be protected with stronger authentication before general-user rollout.

What Microsoft announced

Microsoft says passkeys will become the default phishing-resistant authentication method in Microsoft Entra ID. Users who are enabled for SMS or voice authentication may be automatically enabled for passkeys during the rollout, and they may be prompted to register a passkey the next time they complete multifactor authentication.

The key dates are:

September 1, 2026: Microsoft begins rolling out passkeys as the default Entra ID authentication experience for users enabled for SMS or voice.
September 18, 2026: Microsoft plans to share more information about supported telecom providers and commercial terms for organizations that still need SMS or voice.
October 30, 2026: Admins may be able to select and configure supported telecom providers through the Microsoft Security Store.
February 1, 2027: Microsoft-provided SMS and voice authentication delivery retires in Microsoft Entra ID.
After February 1, 2027: Users whose only available MFA method is SMS or voice may be required to register a passkey before they can continue signing in.

Why SMS and voice MFA are being phased out

SMS and voice MFA helped many organizations move beyond passwords, but they remain phishable. Attackers can target users through SIM swap, social engineering, fake login pages, MFA fatigue, and telecom interception.

Passkeys use public-key cryptography. The private key stays with the user device or credential provider, and the sign-in is tied to the real service. That makes passkeys much stronger against phishing than one-time codes delivered through SMS or phone calls.

What this means for Microsoft 365 tenants

If users still rely on SMS or voice for MFA, treat this as a migration project, not a last-minute settings change. The practical impact can include registration prompts, helpdesk calls, device-readiness questions, Conditional Access updates, and recovery-path planning.

The highest-risk mistake is waiting until 2027, then discovering that key users still have SMS or voice as their only usable MFA method.

The readiness checklist

1. Identify who still uses SMS or voice

Review Microsoft Entra authentication methods and identify users enabled for SMS or voice authentication. Separate normal users, executives, administrators, shared accounts, service desk users, frontline workers, and third-party users.

2. Decide which passkey model fits your workforce

Microsoft Entra ID supports synced and device-bound passkeys. Synced passkeys can be convenient for general users, while device-bound methods such as Microsoft Authenticator passkeys, Windows Hello for Business, and FIDO2 security keys are often better for administrators, executives, and regulated roles.

3. Enable passkey policies with groups, not guesswork

Use targeted groups and passkey profiles instead of enabling everything broadly without a plan. Start with IT and a small pilot group, then expand to departments.

4. Run a registration campaign before Microsoft forces the conversation

Microsoft Entra registration campaigns can prompt users to register a passkey during sign-in. This helps adoption happen gradually instead of during a disruption.

5. Communicate in simple language

Most users do not care about FIDO2, WebAuthn, or public-key cryptography. They need to know what will change when they sign in, why SMS and phone-call MFA are being retired, and where to get help.

6. Protect break-glass and recovery paths

Before broad rollout, review break-glass admin accounts, Conditional Access exclusions, emergency access documentation, helpdesk identity verification, device-loss procedures, and backup authentication methods for critical users.

A 90-day execution view

Days 1-30: identify exposure and pilot scope

Start by finding users still enabled for SMS or voice MFA, then separate them by risk, department, role, and device type. Admins and executives should be reviewed first because they carry the highest identity risk.

Days 31-60: run a controlled passkey pilot

Test passkey registration with IT and a friendly user group. Validate Microsoft Authenticator passkeys, Windows Hello for Business, FIDO2 keys, mobile behavior, browser support, and helpdesk recovery steps before wider rollout.

Days 61-90: expand with monitoring and support

Expand by group, monitor registration completion, track support tickets, and remove unnecessary SMS or voice dependency where the business is ready. Keep exceptions visible and time-bound.

Governance and measurement

Governance should make ownership clear: who approves authentication methods, who handles exceptions, who supports locked-out users, and who reviews privileged-account posture. Without that ownership, authentication changes become a helpdesk surprise.

Useful measures include SMS or voice usage reduction, passkey registration rate, admin-account hardening, failed-registration tickets, exception count, and the number of users with at least one reliable recovery path.

Questions leaders should ask

Which users still depend on SMS or voice MFA today?
Which authentication methods should be allowed for general users, executives, admins, and third parties?
Which devices, browsers, and mobile policies could block passkey adoption?
How will the helpdesk verify identity when a user loses a device?
What must be complete before February 1, 2027?

Common mistakes to avoid

Waiting until Microsoft prompts users without preparing communication.
Moving general users before protecting privileged accounts.
Allowing passkeys without deciding synced versus device-bound policy.
Forgetting break-glass and recovery procedures.
Treating passkeys as only an IT setting instead of a user rollout.

Vivolution view

Passkey readiness is strongest when identity security, user communication, device readiness, and helpdesk ownership are planned together. The technical setting matters, but the rollout experience decides whether users adopt it cleanly.

Practical next steps

Run an authentication-methods review in Microsoft Entra ID.
Prioritize admins and high-risk users.
Choose passkey types by role.
Prepare a pilot group and simple user communication.
Track adoption until SMS and voice usage is gone or properly justified.

Sources

Where this connects

For organizations reviewing Microsoft 365 security, this topic connects directly with Vivolution services and solution areas:

Teams that want to move carefully can begin with an authentication-methods review, a small pilot, and a clear rollout plan before the retirement date becomes urgent.