Microsoft is retiring SMS and voice-based multifactor authentication in Entra ID. Passkeys become the default sign-in method on September 1, 2026. On February 1, 2027, Microsoft ends native SMS and voice delivery entirely, and passkey registration becomes mandatory with no opt-out.

This is the right call. Token theft and adversary-in-the-middle attacks have made SMS-based MFA a liability, and Microsoft's own numbers back the shift. But any big identity change opens a transition window, and attackers found this one before the announcement went out.

The mandate, in the dates that matter

The timeline pulled directly from Microsoft's July 13, 2026 security update:

The reason Microsoft gives is not vague. In the same post, Nadim Abdo, corporate vice president for identity and network access engineering, cites a Microsoft Threat Intelligence figure that AI-enabled phishing campaigns are hitting click-through rates as high as 54 percent, versus roughly 12 percent for traditional phishing. Microsoft says its own passkey rollout data shows 99 percent enrollment success, and a 95 percent sign-in success rate for synced passkeys versus 30 percent for legacy methods.

The direction is clear: passkeys work better for users and worse for attackers. The problem is not the destination. It is the six months between now and then.

What Entra passkeys actually are

An Entra passkey is a cryptographic key pair tied to a specific user identity in Microsoft Entra ID, replacing shared-secret authentication with public-key cryptography. Microsoft supports three forms of Entra passkeys: synced passkeys that ride your iCloud Keychain or Google Password Manager, device-bound passkeys inside Microsoft Authenticator or on the Windows device itself, and FIDO2 security keys for anyone who prefers hardware.

The security value comes from where the private key lives. It never leaves the user's device. A phishing site cannot capture what it cannot see. That is what "phishing-resistant" means in Microsoft's positioning of the change, and why the mandate framing is not marketing spin.

The attack already exploiting this rollout

The same week Microsoft announced the passkey mandate, Okta's threat intelligence team disclosed a campaign that targets exactly the workflow Microsoft is about to make familiar. The threat actor, tracked by Okta as O-UNC-066 and by Palo Alto's Unit 42 as CL-CRI-1147, is affiliated with the broader "Com" collective that includes Scattered Spider, ShinyHunters, and LAPSUS$.

The attack chain looks like this:

  1. The attacker calls the target by phone, claiming to be Microsoft support running a passkey enrollment.
  2. The target is directed to a phishing kit hosted on a domain that includes the word "passkey" (assignpasskey[.]com, deploypasskey[.]com, passkeydeploy[.]com, passkeyadd[.]com, and setpasskey[.]com have all been observed, often with victim-specific subdomains like victimcompany[.]setpasskey[.]com).
  3. The kit captures the username, password, and MFA response in real time, while a live operator relays the credentials into the real Microsoft portal.
  4. The target sees a screen that looks like a Microsoft passkey registration ceremony. Behind the scenes, the attacker registers their own passkey on the target's account.

The end state matters. A stolen password gets rotated on the next reset. A registered passkey on the attacker's device gives them persistent access that survives password changes, and often survives the account recovery workflow itself.

Microsoft's registration campaign feature, the same one that will start nudging users on September 1, is what makes the pretext credible. Users have never seen a real Microsoft passkey enrollment. They cannot compare a fake to something they have not seen.

Why this transition is different from every prior MFA rollout

Rolling out MFA to a company in 2019 was a training problem. Rolling out passkeys in 2026 is a training problem plus an AI problem, and the interaction between the two is what makes this rollout more dangerous than the last three.

Three factors compound:

Change fatigue plus an unfamiliar workflow plus AI-crafted deception is the widest attack window we have seen in identity in years. It will close by mid-2027, once enrollment has been done a few million times and muscle memory catches up. Between now and then, the security posture that mattered on July 12 is not the one that will matter on September 2.

What actually catches this, and what does not

The instinct is to reach for Entra Token Protection because "token" is right there in the name. Token Protection helps in a narrow scenario. It does not solve this problem.

Token Protection binds a token to the device it was issued on, so a stolen token cannot be replayed from a different machine. That works for Outlook, Teams, and the Microsoft 365 desktop apps on Windows. It does not cover browser sessions, and browser cookie replay is exactly where the adversary-in-the-middle attack volume lives. Treat Token Protection as one useful layer for desktop client traffic, not as your answer to token theft.

What actually blunts the fake-enrollment and consent-phish patterns:

The pre-flight checklist for the transition window

The gap between now and September 1 is short. What business owners should get done before the registration campaigns turn on:

  1. Pilot passkey enrollment with your IT and executive teams first. They need to know the real ceremony cold, so they can describe it to anyone else who calls asking questions.
  2. Train employees with screenshots of the actual Microsoft enrollment page and workflow. The training window is now, while the real workflow is still new. Do this before the attackers get their next campaign in front of your team.
  3. Turn on OAuth consent restrictions today. The microsoft-user-default-low policy is not tied to the passkey rollout. It closes the fake-app door regardless of the mandate. There is no reason to wait.
  4. Publish an internal channel for verifying IT calls. A shared Teams channel, a specific extension, a keyword. Employees should have a one-step way to confirm a suspicious call is real. The attacker's phone call is the weak link in the whole chain.
  5. Audit which users are still on SMS or voice. Those are your February 2027 casualties if nothing changes. Get ahead of the list now, not in January.
  6. Confirm mobile devices support passkeys. Microsoft supports synced passkeys through iCloud Keychain and Google Password Manager, device-bound passkeys through Microsoft Authenticator and Entra passkey on Windows, and FIDO2 security keys for anyone who prefers hardware.
  7. Have a plan for users without compatible devices. The Microsoft Security Store telecom option exists, but you will be paying for it directly. Budget for it or replace the devices.

For related context on the broader security posture question: our writeups on DLP for AI and where AI note takers send your data both touch the same "AI at machine speed" theme that drove Microsoft's decision here.

Round one of AI versus identity

Passkeys close the front door on phishing. Cryptographic key pairs are, by design, not a shared secret that can be tricked out of a user. The Microsoft numbers make that case cleanly.

What passkeys do not close is the door around the enrollment ceremony itself, or the door where an OAuth consent grant hands an attacker durable access to a mailbox. Those doors get harder to defend as AI takes over voice, video, and page generation, and the transition window is where they are widest.

The mandate is the right move. The next twelve months are the ones to prepare for.

What to do this week

Turn on the microsoft-user-default-low OAuth consent policy. Pilot a passkey enrollment with your IT team and screenshot the workflow for training. Publish a one-line verification channel for IT-related calls. Everything else can wait a few weeks. Those three cannot.