Passkeys for Microsoft 365 businesses: what is changing and when
Passkeys become the default sign-in method in Microsoft Entra ID from 1 September 2026, and Microsoft retires its built-in SMS and voice authentication on 1 February 2027. Passkeys are phishing-resistant, included in every Entra ID licence at no extra cost, and satisfy the online-services MFA requirement of Essential Eight Maturity Level 2.
Microsoft announced the change on 14 July 2026 (message centre notice MC1426371). SMS and voice are not being abolished as MFA methods: Microsoft is withdrawing its own telecom delivery of them, and from February 2027 they survive only if a business pays a third-party telecom provider through the Microsoft Security Store. For most Australian businesses the practical answer is a planned move to passkeys, done deliberately rather than reactively.
The timeline at a glance
From 1 September 2026, Microsoft begins auto-enabling passkeys for users who are enabled for SMS or voice in the tenant's authentication methods policy, and switches the registration campaign to nudge users toward passkeys. Prompts are skippable at this stage. On 1 February 2027, Microsoft-provided SMS and voice delivery is retired, and users whose only method is SMS or voice hit a blocking registration prompt. Microsoft has stated there will be no further extensions. The dates apply to the Entra ID public cloud. Full detail, including who is in scope and the temporary opt-out, is on our SMS and voice retirement page, and in Microsoft's own retirement notice on Microsoft Learn.
Why passkeys, not just better push MFA
The dominant Microsoft 365 attack pattern in 2025 and 2026 is adversary-in-the-middle phishing: the user is relayed through a proxy to the real Microsoft login, completes MFA legitimately, and the attacker steals the resulting session token. SMS codes, authenticator codes and Authenticator push, with or without number matching, do not stop this, because the login genuinely succeeds. Passkeys defeat it structurally: the credential is cryptographically bound to the real service address, so there is nothing for a fake login page to relay. Microsoft's Digital Defense Report 2025 measured AI-generated phishing campaigns achieving click-through rates as high as 54 per cent, against roughly 12 per cent for traditional phishing. The phishing is getting better at the same moment push MFA is standing still.
What it costs
Registering and using passkeys is included in every Entra ID tier, including the free tier, so no licence upgrade is needed to start. Enforcing them through Conditional Access authentication strengths requires Entra ID P1, which Microsoft 365 Business Premium already includes. Windows Hello for Business, the companion control for signing in to the computer itself, is included with Windows and Entra ID at no extra charge. The only optional hardware cost is FIDO2 security keys for a small minority of users, covered in our passkeys vs security keys comparison.
Start here
Is Microsoft retiring SMS and voice MFA, and what are the deadlines?
Do passkeys meet the Essential Eight Maturity Level 2 MFA requirement?
Passkeys vs security keys: which does your business actually need?
How Blue Arc IT Solutions helps
We audit each tenant's authentication methods policy for SMS and voice exposure before the September 2026 prompts begin, then run a staged passkey rollout: pilot, report-only enforcement, workforce enrolment, and enforcement starting with administrator accounts. We have supported Australian businesses since 2004, deliver nationally from Canberra, and our latest client survey recorded 96 per cent satisfaction with response time, 94 per cent with resolution and 97 per cent overall. For the compliance side, see Essential Eight compliance, or if you run Microsoft 365 Business Premium, what Business Premium covers.
Last reviewed: 20 July 2026. Microsoft is still publishing detail on the SMS and voice retirement (telecom provider list, pricing and the opt-out API land between August and October 2026); check the Microsoft Learn link above for the latest.
Frequently asked questions
Do passkeys cost extra on Microsoft 365 Business Premium?
No. Registering and using passkeys is included in every Microsoft Entra ID tier, including the free tier. Business Premium includes Entra ID P1, which adds the ability to enforce passkeys through Conditional Access authentication strengths, so Business Premium tenants already own everything needed to deploy and mandate them.
Is Microsoft Authenticator push MFA being retired too?
No. Push notifications in Microsoft Authenticator remain available after February 2027. Only Microsoft-provided SMS and voice delivery is being retired. Push is still not phishing-resistant, though, so it does not satisfy Essential Eight Maturity Level 2.
What happens if we do nothing before February 2027?
From 1 February 2027, any user whose only sign-in methods are SMS or voice is blocked at sign-in until they register a passkey. Registration prompts start appearing from 1 September 2026 regardless, so doing nothing also means unmanaged prompts and avoidable helpdesk calls.