Microsoft is making passkeys the default in Entra ID

Microsoft is making Passkeys the default authentication method in its Entra ID service, effective from September 1, 2026. The change will gradually roll out, with users who have previously relied on SMS or voice call-based multi-factor authentication (MFA) automatically enabled for Passkeys and prompted during their next MFA login. Microsoft encourages organizations to transition to Passkeys or other phishing-resistant methods as soon as possible. The shift marks a major update to how users authenticate themselves within Microsoft’s cloud identity and access management platform. Passkeys are cryptographic credentials designed to replace traditional passwords. They allow users to log in using biometric data such as fingerprint scans, facial recognition, or device PINs. This technology adheres to the FIDO2 and WebAuthn standards, which are widely recognized for their robust security against phishing attacks. Entra ID, formerly known as Azure Active Directory, serves as Microsoft's central hub for managing digital identities and access controls across enterprise environments. A key driver behind this move is the increasing threat posed by AI-powered phishing campaigns. According to Microsoft, these advanced attacks can achieve click-through rates of up to 54 percent, significantly higher than the approximately 12 percent seen with conventional phishing attempts. As cyber threats evolve, so too must the tools used to defend against them. By adopting Passkeys, Microsoft aims to provide a more secure and user-friendly alternative to password-based systems. In parallel, Microsoft is expanding support for device-bound and synchronized Passkeys while enhancing administrative tools for managing these keys. These improvements are intended to make passwordless logins easier to implement and manage through policy settings. This approach aligns with broader industry trends toward eliminating passwords, reducing the risk of credential theft and improving overall account security. Additionally, Microsoft plans to phase out its own SMS and voice call-based MFA services. Starting February 1, 2027, these options will no longer be available natively within Entra ID. Organizations wishing to continue using these methods will need to integrate third-party providers via the Microsoft Security Store, at their own expense. This decision reflects a strategic pivot away from legacy authentication methods that are increasingly vulnerable to exploitation. For businesses, the transition to Passkeys presents both opportunities and challenges. While the new system offers enhanced security and convenience, it requires careful planning and implementation. IT administrators will need to ensure compatibility with existing infrastructure, educate end-users on the new process, and monitor for potential issues during the rollout. Microsoft has emphasized that early adoption is recommended to avoid disruptions during the migration period. Looking ahead, the continued evolution of authentication technologies will likely shape future cybersecurity strategies. As AI-driven attacks become more sophisticated, the demand for resilient, password-free solutions will grow. Microsoft’s commitment to advancing secure authentication practices underscores its role as a leader in the ongoing battle against cyber threats. The upcoming changes to Entra ID represent a critical step in this direction, setting a precedent for others in the tech sector to follow.