Passkeys for Microsoft 365 businesses: what is changing and when
Passkeys became the default sign-in method in Microsoft Entra ID on 1 September 2026, and Microsoft retires its built-in SMS and voice authentication on 1 February 2027. Passkeys are phishing-resistant, included in every Entra ID licence at no extra cost, and satisfy the online-services MFA requirement of Essential Eight Maturity Level 2.
Microsoft announced the change on 14 July 2026 (message centre notice MC1426371). SMS and voice are not being abolished as MFA methods: Microsoft is withdrawing its own telecom delivery of them, and from February 2027 they survive only if a business pays a third-party telecom provider through the Microsoft Security Store. The retirement reaches further than MFA prompts, too: it also covers self-service password reset, so a business relying on SMS or voice to reset forgotten passwords needs an alternative in place before the same deadline. Blue Arc IT Solutions does not recommend paying to keep SMS or voice alive. Our position is a planned move to passkeys, done deliberately rather than reactively, and we are moving clients as early as their environment allows rather than treating February 2027 as the target.
The timeline at a glance
The first milestone has passed. Since 1 September 2026, Microsoft has been auto-enabling passkeys for users enabled for SMS or voice in the tenant's authentication methods policy or legacy per-user MFA settings, and has switched the registration campaign to Microsoft-managed state targeting passkeys. Prompts are skippable at this stage, with unlimited snoozes. Still ahead: 18 September 2026, telecom provider options and pricing appear in the Microsoft Security Store; 30 October 2026, admins can configure a customer-managed provider; 1 February 2027, Microsoft-provided SMS and voice delivery is retired and users whose only method is SMS or voice hit a blocking registration prompt. Microsoft has stated there is no opt out from the February behaviour and that it will be enforced for all tenants. The dates apply to the Entra ID public cloud. Full detail, including who is in scope, the guest-account trap and the temporary opt-out, is on our SMS and voice retirement page, and in Microsoft's own retirement notice on Microsoft Learn.
Why passkeys, not just better push MFA
The dominant Microsoft 365 attack pattern in 2025 and 2026 is adversary-in-the-middle phishing: the user is relayed through a proxy to the real Microsoft login, completes MFA legitimately, and the attacker steals the resulting session token. SMS codes, authenticator codes and Authenticator push, with or without number matching, do not stop this, because the login genuinely succeeds. Passkeys defeat it structurally: the credential is cryptographically bound to the real service address, so there is nothing for a fake login page to relay. Microsoft's Digital Defense Report 2025 measured AI-generated phishing campaigns achieving click-through rates as high as 54 per cent, against roughly 12 per cent for traditional phishing. The phishing is getting better at the same moment push MFA is standing still.
What it costs
Registering and using passkeys is included in every Entra ID tier, including the free tier, so no licence upgrade is needed to start. Enforcing them through Conditional Access authentication strengths requires Entra ID P1, which Microsoft 365 Business Premium already includes. Windows Hello for Business, the companion control for signing in to the computer itself, is included with Windows and Entra ID at no extra charge. The only optional hardware cost is FIDO2 security keys for a small minority of users, covered in our passkeys vs security keys comparison. There is also a time cost most businesses never measure: Microsoft's own analysis of consumer account sign-ins found password sign-in taking up to 24 seconds on average, against roughly 8 seconds for a device-bound passkey and roughly 3 seconds for a synced passkey. That figure is drawn from consumer accounts rather than enterprise fleets, so treat it as indicative rather than a guaranteed result for your business, but the direction matches what we see after a rollout.
Start here
What is a passkey, and how does it work?
Is Microsoft retiring SMS and voice MFA, and what are the deadlines?
Do passkeys meet the Essential Eight Maturity Level 2 MFA requirement?
Passkeys vs security keys: which does your business actually need?
How Blue Arc IT Solutions helps
We audit each tenant's authentication methods policy for SMS and voice exposure, report which users September has already caught and which will be blocked in February, then run a staged passkey rollout: pilot, report-only enforcement, workforce enrolment, and enforcement starting with administrator accounts. We have supported Australian businesses since 2004, deliver nationally from Canberra, and our latest client survey recorded 96 per cent satisfaction with response time, 94 per cent with resolution and 97 per cent overall. For the compliance side, see Essential Eight compliance, or if you run Microsoft 365 Business Premium, what Business Premium covers.
Last reviewed: 11 September 2026, against Microsoft's Learn retirement article (updated 10 August 2026) and its retirement FAQ (updated 4 September 2026). The 1 September 2026 passkeys-by-default milestone has passed and this cluster reflects that. Remaining milestones: telecom provider options and pricing 18 September 2026, provider configuration 30 October 2026, retirement 1 February 2027.
Frequently asked questions
Do passkeys cost extra on Microsoft 365 Business Premium?
No. Registering and using passkeys is included in every Microsoft Entra ID tier, including the free tier. Business Premium includes Entra ID P1, which adds the ability to enforce passkeys through Conditional Access authentication strengths, so Business Premium tenants already own everything needed to deploy and mandate them.
Is Microsoft Authenticator push MFA being retired too?
No. Push notifications in Microsoft Authenticator remain available after February 2027. Only Microsoft-provided SMS and voice delivery is being retired. Push is still not phishing-resistant, though, so it does not satisfy Essential Eight Maturity Level 2.
What happens if we do nothing before February 2027?
From 1 February 2027, any user whose only sign-in methods are SMS or voice is blocked at sign-in until they register a passkey. Registration prompts have been appearing since 1 September 2026 regardless, so doing nothing already means unmanaged prompts and avoidable helpdesk calls.