Microsoft’s Passkey Rollout: What Your Business Needs to Do Now

Thursday, October 8, 2026

If your team has started seeing a “create a passkey” prompt when signing in to Microsoft 365, it isn’t a glitch. On September 1, 2026, Microsoft began making passkeys the default sign-in method in Microsoft Entra ID, and the clock is now running on text-message and phone-call verification codes. Starting February 1, 2027, Microsoft will stop delivering SMS and voice MFA codes for most users, and anyone who relies only on those methods will be blocked at sign-in until they register a passkey.

Here’s what’s changing, why Microsoft is doing it, and what Michigan businesses and nonprofits should do over the next few months.

What Is a Passkey?

A passkey replaces the six-digit verification code with cryptography. When a user registers one, their device creates a matched key pair: a private key that stays on the device or in the user’s secure credential manager, and a public key stored with Microsoft. To sign in, the user unlocks the passkey with the same fingerprint, face scan, or PIN they already use on their phone or laptop.

Because there’s no code to type, there’s nothing for an attacker to intercept, guess, or talk an employee into reading aloud. A passkey is also bound to the genuine Microsoft sign-in page, so it won’t work on a fake one.

Microsoft supports two kinds:

• Synced passkeys — stored in a credential manager like iCloud Keychain or Google Password Manager and available across a user’s devices. A good fit for most staff.
• Device-bound passkeys — stored on one device, such as Microsoft Authenticator, Windows Hello on a company laptop, or a FIDO2 hardware security key. The better fit for administrators, executives, and other high-risk roles.

Why Microsoft Is Making This Change

SMS and voice codes travel over the phone network, and that’s the weakness. Attackers hijack phone numbers through SIM swapping, intercept text messages in transit, or call employees while posing as IT and ask them to read back a code. None of this requires sophisticated tools, which is why phone-based MFA keeps turning up in real-world breaches.

Microsoft’s position is that phishing-resistant authentication should be the default, not an optional upgrade that administrators have to remember to turn on. That matters more every year as AI makes phishing emails and impersonation calls more convincing and cheaper to produce at scale. Retiring Microsoft-delivered SMS and voice codes is how Microsoft makes the stronger option the standard.

The Benefits for Your Business

• Phishing resistance — Credential phishing and MFA-code theft, two of the most common ways business email accounts are compromised, stop working against a passkey.
• Faster, more reliable sign-ins — No waiting on a text that arrives late or not at all. Microsoft reports far higher sign-in success rates for synced passkeys than for legacy methods.
• Fewer lockouts — Lost phones, changed numbers, and poor cell coverage stop being sign-in problems, which means fewer support tickets and less lost time.
• No added licensing cost — Passkeys are included in all Microsoft Entra plans.
• A stronger risk posture — Phishing-resistant MFA increasingly comes up on cyber insurance applications and compliance reviews. Moving early puts you on the right side of that question.

Key Dates: What to Expect

• September 1, 2026 — Rollout began. Users enabled for Microsoft-provided SMS or voice authentication are automatically enabled for passkeys, and Microsoft’s Registration Campaign prompts them to register one at their next MFA sign-in. During this grace period, users can skip the prompt.
• October 30, 2026 — Organizations with a genuine regulatory or operational need to keep SMS or voice codes can begin selecting a third-party telecom provider through the Microsoft Security Store. These providers bill per message.
• February 1, 2027 — Microsoft-provided SMS and voice authentication is retired for all users except Global Administrators and external users. Users whose only MFA method is SMS or voice will hit a blocking prompt and must register a passkey to continue. There is no opt-out from this enforcement.
• July 1, 2027 — The same retirement applies to Global Administrators and external users.

“Our Team Isn’t Ready for This” — Common Concerns

Most hesitation about passkeys comes down to a handful of real-world situations. Each one has a straightforward answer.

Staff who don’t have a company smartphone

A passkey doesn’t require a phone. Employees who work at a shared desk or prefer not to use a personal device can sign in with Windows Hello on their work computer or with a FIDO2 security key on a keyring. Security keys are inexpensive and well suited to front-desk, warehouse, and shared-workstation roles.

Employees who travel or work in low-signal areas

SMS codes fail when there’s no cell signal. A passkey doesn’t depend on the phone network at all, so a team member at a job site or on a flight can sign in as long as they have an internet connection.

Executives and administrators

These accounts are the highest-value targets in any organization. They should move first and use device-bound passkeys or hardware security keys rather than synced passkeys, so the credential can’t be copied to another device.

Team members who already use Microsoft Authenticator

If SMS or voice is still enabled for a user, even as a backup method, that user is in scope for the rollout. Authenticator can store a passkey directly, so for many of these employees the switch takes about a minute.

How to Opt In Now (Before Microsoft Does It for You)

Waiting means Microsoft decides the timing and your staff decide whether to click “skip.” Moving on your own schedule lets you pilot with a small group, prepare your team, and avoid a wave of lockouts in February. The process looks like this:

1. Find who’s still on SMS or voice. Microsoft publishes a PowerShell script on GitHub that lists users enabled for phone-based methods. The Authentication methods Activity report in the Microsoft Entra admin center shows who has actually registered them.
2. Enable passkeys. In the Microsoft Entra admin center, open Authentication methods and enable the Passkey (FIDO2) method for a pilot group. Choose whether to allow synced passkeys, device-bound passkeys, or both.
3. Turn on the Registration Campaign. Target the same group so users are prompted to register a passkey at their next sign-in.
4. Tell your team before the prompt appears. Attackers take advantage of any transition users don’t understand. Staff should know that a legitimate passkey prompt appears only during a normal Microsoft sign-in, never through an email link or a text message.
5. Retire SMS and voice. Once your users have registered passkeys, disable phone-based methods so they can’t be used as a weaker fallback.

Can Your Business Postpone the Passkey Rollout?

Yes, but only temporarily. Microsoft offers an opt-out that pauses the automatic passkey enablement and the Microsoft-managed Registration Campaign for your organization between September 1, 2026 and February 1, 2027. It’s configured through the Microsoft Graph API rather than a simple toggle in the admin center.

The opt-out does not move the February 1, 2027 deadline. It buys preparation time, nothing more. If you use it without a migration plan, you’ll reach February with the same unprepared users, just less time to fix it.

Organizations with a documented requirement to keep text or voice codes can contract a third-party telecom provider through the Microsoft Security Store. For most businesses, though, passkeys are the simpler, safer, and less expensive path.

Frequently Asked Questions

Will passkeys cost us anything?
No. Passkeys are included in every Microsoft Entra plan. Only the optional third-party telecom providers carry a per-message cost.

What happens if an employee keeps skipping the prompt?
Until February 1, 2027, they can keep postponing. After that, if SMS or voice is their only MFA method, they won’t be able to sign in until they register a passkey.

Does this affect self-service password reset?
Yes. The retirement of Microsoft-delivered SMS and voice codes applies to self-service password reset as well, so update those settings as part of the same project.

Does every employee need a smartphone?
No. Windows Hello on a work computer or a FIDO2 security key both work as passkeys without a phone.

Can we keep SMS for some users?
Only through a third-party telecom provider, and only if there’s a real business or regulatory need. Microsoft itself is getting out of delivering those codes.

Is the passkey prompt my staff are seeing legitimate?
If it appears right after a normal Microsoft 365 sign-in, it’s very likely the real rollout. If a passkey request ever arrives by email, text, or phone call, staff should treat it as phishing and report it to IT.

Get Ahead of the Deadline

Passkey readiness is a short project when it’s planned and a disruptive one when it’s rushed. Identifying who’s still on SMS, piloting passkeys with the right group, preparing staff, and shutting off phone-based codes before February is exactly the kind of proactive work Total Technology Confidence™ is built around.

Learn more about our Cybersecurity & Risk Management services and Microsoft 365 Services & Support, or talk with our team about a passkey readiness review for your business.