Small business owners and freelancers: Microsoft just moved passkeys to default authentication in Entra ID, quietly changing how you defend against stolen logins.
What happened
Microsoft’s official guidance indicates that on September 1, 2026, passkeys became the default authentication method for users who had SMS or voice MFA enabled in Entra ID. A Microsoft-managed passkey registration campaign prompts users to set up a passkey, and over time SMS and voice methods will be retired from Entra ID. This is part of a broader move toward phishing-resistant, passwordless authentication (FIDO2/WebAuthn).
Why it matters
This change matters because passkeys eliminate passwords for many sign-ins, reducing the risk of credential stuffing and phishing. Passkeys are phishing-resistant and designed to work across devices without exposing a password. For small businesses, this can mean fewer password-related help desk requests and faster logins for staff. For IT-minded readers, it helps align with a zero-trust identity approach and simplifies secure access across apps and services.
In practice, you should plan a gradual rollout: enable passkeys as the default method, retire legacy SMS/Voice authentication where possible, and clearly communicate the plan to users. This aligns with guidance from security researchers and standards groups advocating phishing-resistant MFA as a core defense against credential abuse.
For context, see and reference the official Microsoft Entra documentation and the FIDO Alliance on passkeys: Microsoft Learn: Passkeys by default and retirement of SMS/Voice authentication and FIDO Passkeys.
Practical steps you can take now
- Step 1 — Review your authentication method policy: In the Microsoft Entra admin center, go to Identity > Security > Authentication methods. Confirm passkeys are enabled as a primary method and check the registration campaign settings. If your tenant isn’t ready, start with a pilot group.
- Step 2 — Plan the retirement of SMS/Voice MFA: In AMP, disable or restrict SMS/Voice for most users, or set a retirement timeline. Ensure you have a backup admin account protected with passkeys or another phishing-resistant factor.
- Step 3 — Enroll admins in passkeys: Add passkey MFA to all admin accounts and test sign-ins from multiple devices to ensure reliability.
- Step 4 — Run a quick 10-minute account-ownership check: Do a fast audit of your most critical accounts (domain admin, primary admin, high-value email). Verify MFA is enabled, ensure a passkey is active, confirm backups exist, and review sign-in activity for the past week.
- Step 5 — Notify and educate users: Share a short guide on how to register a passkey on their devices and what to do if the option doesn’t appear.
- Step 6 — Monitor and adjust: Track sign-in success rates and support requests. A staged rollout reduces friction while improving security.
For more context, see the official guidance on passkeys by default in Entra ID and general passkey information from the FIDO Alliance. Microsoft Learn: Passkeys by default and retirement of SMS/Voice authentication and FIDO Passkeys.
Final thought
Moving to phishing-resistant, passwordless authentication is a practical step you can take this month to reduce credential abuse. If you’d like help planning a safe, low-friction rollout, consider working with an IT security partner who can tailor a passkey deployment to your environment.