On September 1, 2026, Microsoft will automatically update tenant configurations to set passkey registration campaigns to Microsoft-managed for any users relying on SMS or voice MFA. Because this rollout directly coincides with Fall semester onboarding and move-in weeks, institutions that do not proactively manage or temporarily disable this dynamic migration risk an immediate spike in Helpdesk support requests as end-users encounter unexpected sign-in nudges.
| Target Date | System Behavior | Suggested Action |
|---|---|---|
| Sept 1, 2026 | Passkey Nudges Begin: Passkeys auto-enabled in AMP; registration campaigns set to Microsoft-managed for SMS/Voice users. | Assess helpdesk capacity; execute temporary Graph opt-out if nudge suppression is needed. |
| Feb 1, 2027 | Permanent Telephony Retirement: Microsoft-provided SMS/Voice disabled globally. | Complete migration to modern authenticators. |
Threat Model & Targeting Mechanics
- Driver & Standards: PSTN out-of-band authenticators are vulnerable to SIM-swapping, SS7 redirection, and AiTM phishing. Deprecation aligns with NIST SP 800-63B §5.1.3.1.
- Target Scope: Users are targeted if SMS/Voice remains enabled in the tenant Authentication Methods Policy (AMP) or legacy MFA policies, regardless of active sign-in habits.
- Exclusions & Behavior: Excludes users who have an active passkey, use Microsoft Authenticator (push/passwordless), or satisfy MFA exclusively via an External Authentication Method (EAM). Note: If SMS remains enabled for an EAM user in tenant policy, they remain in-scope for nudges whenever Entra native MFA is invoked.
Administrative Control: Temporary Opt-Out Execution
To suppress the September 1st nudges through January 31st, 2027, ensure you have the Microsoft Graph “Policy.ReadWrite.AuthenticationMethod” permission and update your authentication methods policy using Microsoft Graph to set the “passkeyDynamicMigration” property to “true”.
Caution: Microsoft has said there will be no further opt-outs after the Jan 31st deadline. If the following opt-out is used, please ensure you have a process in place to have all users migrated by Jan 31.
HTTP:
PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json
{
"optOutSettings": {
"passkeyDynamicMigration": true
}
}
IAM Engineering Considerations
- Self-Service Password Reset (SSPR): Disabling SMS in AMP does not auto-update SSPR. Legacy telecom recovery options in SSPR will break on Feb 1st, 2027 if not audited and updated in parallel.
- Shared Workstations (Labs & Podiums): Platform passkeys (Windows Hello, Touch ID) bind to a single device profile and cannot roam across shared computers. Route lab/podium users to portable authenticators (FIDO2 hardware keys, software TOTP, or mobile push).
- External Authentication Methods (EAM): Verify third-party IdPs process MFA challenges natively at the IdP layer so Conditional Access policies do not fall back to Entra telephony.
- Customer-Managed Carrier (BYOC): Telephony via Microsoft Security Store (late Oct 2026) is an available option for SMS replacement but incurs per-message carrier fees and maintains underlying security risks. REN-ISAC does not recommend replacing legacy MFA options with an alternative legacy vendor.
References and Additional Reading
- Microsoft Learn:Passkeys by default and SMS/Voice retirement
- Microsoft Learn:SMS/Voice retirement FAQ
- Microsoft Learn: Passkey Registration Campaign
- MC1440968 - Microsoft Entra ID: Optimizations for passkey registration experience
- NIST SP 800-63B:Digital Identity Guidelines, §5.1.3.1 (Out-of-Band Authenticators)
- Microsoft Is Retiring SMS and Voice MFA in Entra ID:Your Migration Playbook (and How to Buy More Time)
- Afterthoughts:I said SMS and voice were being removed