Entra ID Retires SMS MFA: Your Roadmap to September 1, 2026

Table of Contents

• What Microsoft decided: the timeline at a glance
• Why SMS MFA is falling: NIST, BSI, and AI phishing
  • NIST SP 800-63B-4: telephone-network methods are restricted
  • The BSI assessment: SIM swapping and real-time phishing
  • Microsoft's numbers: 54 percent click-through for AI phishing
• What happens in your tenant from September 1, 2026
  • Auto-enablement and the Registration Campaign
  • From February 2027: the blocking registration prompt
  • Temporary opt-out via the Graph API
• Your action plan in five steps
• The sovereignty question: who determines the pace and method mix?
• Passkeys in Authentik: what already works today
• Decision matrix: Entra-only, coexistence, or a sovereign layer
• Managed Authentik at authhost
• Conclusion: one month to the deadline
• Sources

What Microsoft decided: the timeline at a glance

The announcement came on July 13, 2026, via the Microsoft Security Blog; the author is Nadim Abdo, Corporate Vice President, Identity and Network Access Engineering [2]. The details are in the Entra documentation, last updated on July 29, 2026 [1]. German-language trade press coverage includes heise online and Borncity [13][14].

The core in one sentence: Entra ID makes passkeys the default and ends Microsoft-provided SMS and voice call authentication, including Self-Service Password Reset (SSPR) [1]. These dates belong in your calendar:

On scope: the retirement affects the public cloud only. Azure AD B2C is out of scope, and Entra External ID will get a separate announcement later. B2B guest users are in scope; passkey support for them is planned by the end of 2026. MFA via external third-party methods is unaffected [1].

Why SMS MFA is falling: NIST, BSI, and AI phishing

The decision follows a line that standards bodies and security agencies have been drawing for years.

NIST SP 800-63B-4: telephone-network methods are restricted

NIST published the final revision 4 of SP 800-63B on August 26, 2025 [4]. Section 3.1.3.3 states that use of the public switched telephone network (PSTN) for out-of-band verification, meaning SMS and voice calls, is restricted. Section 3.2.9 adds the obligations: organizations should consider risk indicators such as device swap, SIM change, and number porting, and must ensure that alternative authenticator types are available [4].

The BSI assessment: SIM swapping and real-time phishing

In its assessment of two-factor methods, Germany's BSI is clear: email and SMS TAN as well as TOTP do not protect against phishing attacks that happen in real time [5]. In the assessment tables (as of June 29, 2026), SMS TAN receives a poor rating in several attack scenarios, among them real-time phishing; as risks, the BSI explicitly names SIM swapping, obtaining a replacement SIM without authorization, and phone number reassignment [6]. On the other side it states verbatim that the two passkey methods are resistant to common phishing attacks [5].

Microsoft's numbers: 54 percent click-through for AI phishing

Microsoft itself points to observations by Microsoft Threat Intelligence: AI-enabled phishing campaigns reach click-through rates of up to 54 percent, compared with roughly 12 percent for traditional campaigns [2]. The more convincing the phishing, the more dangerous any factor that can be intercepted or handed over. The course toward phishing-resistant passkeys is therefore well founded. The critical question concerns not the goal but the pace and the deadlines, more on that in a moment.

What happens in your tenant from September 1, 2026

Auto-enablement and the Registration Campaign

On September 1, 2026, Microsoft automatically enables passkeys for all users enabled for SMS or voice in the Authentication Methods Policy or the legacy MFA settings; the associated profile allows all passkey types [1]. In parallel, the Registration Campaign settings switch to the Microsoft Managed state targeting passkeys: affected users are prompted to register a passkey at their next MFA sign-in; by default the nudge can be snoozed an unlimited number of times [1]. Nothing is blocked in September, but the nudge appears for every affected user, which is why your communication should be in place beforehand.

From February 2027: the blocking registration prompt

On February 1, 2027, Microsoft's own SMS and voice delivery ends completely, including SSPR [1]. After that, users whose only available MFA method is SMS or voice must register a passkey at sign-in. This prompt is blocking, there is no opt-out, and the rule applies to all tenants [1]. Accounts are not deactivated, access is blocked until the passkey registration is completed [1]. For the helpdesk it still matters, because every unmigrated user becomes a support case from that date.

Temporary opt-out via the Graph API

Anyone who cannot make the September date, for example because a telecom provider needs to be configured first, can temporarily exclude the tenant from auto-enablement and the Registration Campaign rollout [1]:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json

{
  "optOutSettings": {
    "passkeyDynamicMigration": true
  }
}

The opt-out only works between September 1, 2026, and February 1, 2027; from then on, the enforcement stage applies regardless of this setting [1]. It buys time for an orderly rollout, it does not replace one.

Your action plan in five steps

1. Inventory affected users. Microsoft provides the PowerShell script entra-sms-voice-usage-analyzer on GitHub for this; one of the roles Global Reader, Authentication Policy Administrator, or Security Reader is sufficient to run it [3]. The result shows the size of your migration task.
2. Define your passkey strategy. Clarify which passkey variants fit your device fleet and your policies, and define the order: privileged accounts first, then the broad rollout.
3. Plan the communication. The nudge appears from September 1, 2026, at the next MFA sign-in, and unlimited snoozing is the default [1]. Users who know what is coming register instead of snoozing for months.
4. Steer the Registration Campaign actively. Do not wait for the Microsoft Managed default; set the campaign's target groups and schedule yourself, aligned with your rollout waves.
5. Clarify the special cases. Check SSPR dependencies and B2B guest users [1] as well as any regulatory SMS requirement. If SMS has to stay: provider information is available in the Security Store from September 18, 2026, selection and configuration from October 30, 2026, with costs typically per message [1].

The sovereignty question: who determines the pace and method mix?

The passkey course itself is right, and this article does not argue otherwise: away from interceptable codes, toward phishing-resistant methods, in line with NIST and the BSI [4][5]. The real lesson lies one level deeper. Whoever places their identity entirely in someone else's cloud service adopts that provider's roadmap: Microsoft determines the method catalog, the deadlines, and the pricing for exceptions, because after February 1, 2027, SMS is only available via a telecom provider you pay yourself [1]. Per tenant these decisions are not negotiable, and even the opt-out is explicitly time-limited [1].

With a self-operated identity provider like Authentik, this authority sits with the operator. You define flows and policies per group, per application, per risk class: passkeys for administrators immediately, TOTP for shared workshop machines for now, email OTP for rarely used partner accounts. New Authentik releases appear about every three months, and security fixes go to the current version plus one back [10]; the operator decides when to update and which methods are permitted at login. Sovereignty here does not mean knowing better than Microsoft, it means setting pace, method mix, and exceptions yourself. The same structural dependency exists with other US cloud IdPs, as our comparison of the Okta alternative Authentik shows; the coexistence strategy with Microsoft is examined in Authentik vs. Entra ID.

For regulated companies there is a compliance dimension on top. NIST and the BSI provide the technical rationale for replacing SMS independently of Microsoft's deadlines [4][5]; how NIS2 MFA obligations can be implemented with Authentik is shown in NIS2: MFA and access control with Authentik. GDPR adds the question of where identity and log data reside and who acts as processor. This article is a technical assessment, not legal advice; the case-by-case evaluation belongs with your data protection and compliance team.

Passkeys in Authentik: what already works today

Authentik already ships the building blocks for a self-determined passkey rollout. The WebAuthn Authenticator Setup stage controls registration in detail: user verification as require, prefer, or discourage, a resident-key requirement as the basis for passwordless login, authenticator attachment (platform, cross-platform, or unrestricted), duplicate prevention, and device restrictions via AAGUIDs [7]. For the login itself, Authentik supports passkey autofill: linking the Identification stage to a WebAuthn-capable Authenticator Validation stage lets the browser offer passkeys directly in the login form (WebAuthn Conditional UI) [7].

With version 2026.5, released on May 22, 2026, and currently at patch 2026.5.6 from July 22, 2026 [9], the WebAuthn stage adds the hints parameter from the WebAuthn Level 3 specification (security-key, client-device, hybrid) to signal the preferred authenticator type [8]. The same release brought Account Lockdown as an enterprise feature for immediate response to compromised accounts [8]; details are in our article on the Authentik Account Lockdown.

A side note for Keycloak users: since version 26.4, released on September 30, 2025, passkey support including WebAuthn Conditional UI (autofill) is official [11][12]; it is not active by default, though, the administrator has to configure the WebAuthn passwordless policy [11]. Phishing-resistant methods have thus arrived in open-source IAM, not only at the hyperscalers. How the two projects differ fundamentally is shown in the Keycloak alternative Authentik.

Decision matrix: Entra-only, coexistence, or a sovereign layer

A sober comparison helps to classify your own situation:

When Entra ID alone is enough: your users are exclusively employees in a Microsoft 365 landscape, the passkey rollout is feasible by February 2027, and you need neither SMS beyond the cutoff nor protocols like LDAP or RADIUS. Then the Entra rollout is the direct path.

When Authentik is worthwhile in addition or instead: you run customer, partner, or app logins outside Microsoft 365 (OIDC, SAML, LDAP, SCIM, RADIUS), you want pace and method mix under your own control, data residency in Germany and a data processing agreement are hard requirements, or you plan a coexistence: Entra ID for the workforce, Authentik as a self-controlled layer for everything else. The strategic trade-off is explored in Authentik vs. Entra ID.

Managed Authentik at authhost

Anyone who does not want to operate the sovereign layer themselves gets it from authhost as a managed service: a dedicated Authentik instance on infrastructure in Germany, with automatic backups and updates, a data processing agreement included, no setup fee, and monthly cancellation. The Starter plan costs EUR 99.90 per month plus VAT in the Germany region, with unlimited users, SSO via OIDC, SAML, LDAP, SCIM, and RADIUS, plus MFA with TOTP, WebAuthn/passkeys, and email OTP; Business is available from EUR 199.90 per month, Enterprise on request. Details are in the feature overview and the pricing overview. To stay honest: for a pure Microsoft 365 environment without external applications, you do not need a second identity provider. The trial runs for seven days and requires a credit card.

→ View plans and pricing | → Start a 7-day trial

Conclusion: one month to the deadline

Three things to get done in the coming weeks. First, run the inventory with the Microsoft analyzer script to see how many users are affected [3]. Second, prepare communication and the Registration Campaign before the nudge appears on September 1, 2026 [1]. Third, clarify the special cases: SSPR, B2B guests, and any regulatory SMS requirement via the Security Store [1].

The move to passkeys is the right step, as NIST and the BSI confirm independently of Microsoft [4][5]. The strategic question is who decides about such transitions in the future. For everything that does not live in Microsoft 365, you can take that decision back: with Authentik as a self-controlled identity layer on German infrastructure, with a passkey rollout at your own pace.

Start Managed Authentik now →

Sources

1. Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (as of Jul 29, 2026): learn.microsoft.com
2. Microsoft Security Blog, Jul 13, 2026, Nadim Abdo: Passkeys are the default authentication method in Entra ID (AI phishing click-through rates): microsoft.com
3. Microsoft: PowerShell inventory script entra-sms-voice-usage-analyzer (required roles): github.com
4. NIST SP 800-63B-4 (final, Aug 26, 2025), sections 3.1.3.3 and 3.2.9 (PSTN restricted): pages.nist.gov
5. BSI: Assessment of two-factor methods (real-time phishing, passkey classification): bsi.bund.de
6. BSI: Assessment tables for two-factor methods (PDF, as of Jun 29, 2026, SMS TAN ratings, SIM swapping): bsi.bund.de
7. Authentik: WebAuthn Authenticator Setup stage (user verification, resident keys, AAGUID, Conditional UI): docs.goauthentik.io
8. Authentik Release Notes 2026.5 (WebAuthn Level 3 hints, Account Lockdown): docs.goauthentik.io
9. Authentik GitHub Releases (2026.5.0 from May 22, 2026, patch 2026.5.6 from Jul 22, 2026): github.com
10. endoflife.date: Authentik release cycle and support window: endoflife.date
11. Keycloak: Passkeys support in Keycloak 26.4 (Conditional UI, configuration required): keycloak.org
12. Keycloak 26.4.0 released (Sep 30, 2025): keycloak.org
13. heise online: Microsoft makes passkeys the default in Entra ID: heise.de
14. Borncity: Microsoft Entra ID: Passkeys werden ab September Pflicht: borncity.com