What changed

Microsoft’s retirement article states that starting 1 September 2026, passkeys become the default authentication experience and are automatically enabled for users enabled for SMS or voice. Its Important box is more specific: users enabled for SMS or voice in the Entra Authentication Methods Policy, or in legacy MFA settings, are auto-enabled for passkeys in that policy and placed into a passkey profile allowing all types of passkeys, and the tenant’s Registration Campaign settings are set to Microsoft Managed state targeting passkeys, which brings those users into scope automatically. At their next sign-in with multifactor authentication the campaign nudges them to register, and Microsoft states that by default users have unlimited snoozes of the nudge. A separate milestone falls on 1 February 2027, when Microsoft-provided telecom delivery for SMS and voice is retired; from that date a user whose only available method is SMS or voice receives a blocking registration prompt and must register a passkey before signing in, and Microsoft states in two places that there is no opt out from the February behaviour and that it is enforced for all tenants. The accompanying FAQ confirms the timeline applies to public cloud environments only, that the retirement applies across Entra including self-service password reset, that Azure AD B2C is out of scope, and that migrating users to passkeys carries no additional cost while a telecom provider is priced per message.

The risk is not that people lose access tomorrow, because they do not. It is that a change to how the organisation authenticates arrives on a date the organisation did not choose, lands on a setting the organisation owns, and reaches users through a prompt nobody warned them about. A service desk that has not been told will spend Tuesday explaining a message it has never seen, and the population most likely to be affected is the one still using text messages, which in most organisations means the people least comfortable being surprised by a security prompt.

What the term means in plain language

A passkey is a cryptographic credential bound to a device or to a synced credential store, used instead of a shared secret. Microsoft Entra ID supports two kinds: synced passkeys held in a platform credential manager such as iCloud Keychain or Google Password Manager and synchronised across a user’s devices, and device-bound passkeys created and held on one device, which covers the passkey in Microsoft Authenticator, Entra passkeys on Windows and FIDO2 hardware keys. The relevant contrast is with SMS and voice, where a one-time code is sent over the telephone network and can be intercepted, replayed, or obtained by persuading a mobile operator to move a number to a new SIM. The Registration Campaign is a separate mechanism: a tenant setting that prompts a user to enrol a specified method the next time they complete multifactor authentication.

This distinction matters because product status is not the same as business readiness. Availability, support and compatibility are separate questions. A service can be available but unsupported, supported but capacity-constrained, or technically updated while a customer-specific process has stopped working.

Why this matters to a South African organisation

South African teams often operate with tight specialist capacity, rand-sensitive budgets and business processes that cannot be paused while a replacement is sourced. Localisation, regional cloud capacity and long procurement lead times can narrow the recovery options. The practical response is to use the available test window before it becomes an emergency window.

The consequence belongs to the business process, not only the technology team. Finance month-end, customer transactions, data pipelines and ERP extensions all cross technical and operational ownership. A change should therefore be accepted only when the service owner and the business owner can see the same evidence.

The hidden exposure

From 1 September 2026, passkeys become the default authentication experience in Microsoft Entra ID. Users enabled for SMS or voice are automatically enabled for passkeys, and Microsoft states that the Registration Campaign settings in your tenant are set to Microsoft Managed state and pointed at those users. The temporary opt-out is a Microsoft Graph call against the beta endpoint rather than a switch in the portal, and it has to be made before the date.

Normal operation is weak evidence. It proves only that yesterday’s combination of platform, configuration and workload completed. It does not prove that the next capacity allocation, lifecycle enforcement or major release will preserve the same result. An owner needs an inventory, a representative test and a dated decision.

Decision path

Read the two dates separately, because almost everything that goes wrong with this change comes from treating them as one. Tomorrow is an enablement and a prompt that can be snoozed without limit. February is a block. Nothing stops working tomorrow, and any internal message that says otherwise will be contradicted by the first user who clicks snooze. What actually happens tomorrow is narrower and, for a cautious organisation, more interesting: Microsoft changes a setting inside your tenant. That is Microsoft’s own statement, not an inference, and the Registration Campaign is a control an administrator would normally scope, schedule and communicate before switching on. The real decision is therefore about sequencing rather than direction, because the destination is not in dispute and passkeys are materially stronger than a code sent by text. If the organisation is ready, doing nothing is a defensible choice and the only work is telling the service desk what users will see. If it is not ready, the opt-out exists, and this is the part that deserves attention before the end of today: it is not a toggle in the Entra admin centre. It is a PATCH against the Microsoft Graph beta endpoint requiring the Policy.ReadWrite.AuthenticationMethod permission, which for many South African organisations means it is a task for a partner or a senior administrator rather than something the service desk can action this afternoon. There is one further asymmetry worth naming. If you have a genuine regulatory or operational need to keep a telephone channel, the replacement route is a customer-managed telecom provider through the Microsoft Security Store, and Microsoft’s own dates put the provider options at 18 September 2026 and the ability to select and configure one at 30 October 2026. That is two months after the default changes, so between tomorrow and the end of October the only available answers are passkeys, another phishing-resistant method, or the opt-out.

Record the alternatives that were rejected and why. That prevents the next reviewer from reopening the entire question without context. Where the preferred path cannot be completed inside seven days, approve a time-bound exception with a responsible owner, expiry date and compensating control.

Technical test plan

Start with the count, because it determines whether any of this applies to you. Microsoft points at a PowerShell script published at github.com/microsoft/entra-sms-voice-usage-analyzer and states that running it requires one of the Global Reader, Authentication Policy Administrator or Security Reader roles. The FAQ is unusually blunt about how to read the result: any non-zero result means you are in scope. Run it today rather than tomorrow, because the value of the output is that it records the position before the change rather than after it. If you intend to opt out, the request is a PATCH to https://graph.microsoft.com/beta/policies/authenticationmethodspolicy with a body setting optOutSettings.passkeyDynamicMigration to true, and it requires the Policy.ReadWrite.AuthenticationMethod permission. Two properties of that call deserve to be understood before it is made. It is against the beta endpoint, which is not where a change-controlled organisation usually likes to make an authentication policy change, and it is temporary by construction: Microsoft states that from 1 February 2027 the standard passkey migration and enforcement timelines apply regardless of the setting. Opting out buys five months of scheduling, not an exemption. If you would rather move users yourself than be moved, the mechanism is the same one Microsoft will otherwise apply on your behalf. Confirm that Passkey (FIDO2) is enabled as an authentication method, ensure the SMS and voice users are inside a passkey-enabled authentication methods policy, then configure a registration campaign under Entra ID, Authentication methods, Registration campaign, setting State to Microsoft Managed and targeting the security group of SMS and voice users identified by the script. Doing it deliberately gives you the choice of when, and lets communications go out first. Two scope questions come up locally and both have clear answers in the FAQ. Self-service password reset is in scope, which matters because SMS is the most common second factor on SSPR in many organisations and password reset is exactly the moment a user has no other way in. And external MFA methods are not in scope unless the user is also enabled for SMS or voice, so a tenant that has already moved to an external provider is largely unaffected.

Use production-representative conditions without exposing production data unnecessarily. Capture the starting configuration, exact version, time of test and expected result. A pass requires evidence from the real workflow, not only a successful login or an unchanged dashboard.

Primary owner

Primary owner: Whoever owns the Entra authentication methods policy, normally the identity or Microsoft 365 administrator, together with the service-desk lead who will take the calls.

The named owner coordinates platform, application, commercial and business-process decisions. Contributors may perform the work, but accountability cannot be distributed across a meeting invite. The owner closes the test, exception and evidence record.

Action within seven days

Action within seven days: Run Microsoft’s SMS and voice usage analyzer against the tenant today and keep the output; any non-zero result means you are in scope. Then decide before tomorrow between three courses: let the change proceed and tell the service desk what users will see, move those users onto a phishing-resistant method yourself, or apply the temporary opt-out through Microsoft Graph. Warn the service desk whichever you choose, because the first prompt arrives at each user’s next multifactor sign-in.

Start with the highest-consequence workload. Assign the people, date and pass criteria before the test begins. If the first test fails, record the failure as evidence and open remediation with a deadline rather than hiding it behind a general project status.

Evidence to retain

Evidence to retain: The dated output of the usage analyzer showing which users were enabled for SMS or voice before 1 September 2026, a record of the authentication methods policy and the Registration Campaign state as they stood on that date, and, where the opt-out was applied, the Graph request and the response it returned.

Store the evidence with the platform or change record. Include source exports and machine-readable results where possible. The next reviewer should be able to reproduce the conclusion without rebuilding it from email, chat or memory.

Frequently asked questions

Will anyone be locked out tomorrow?

No. Microsoft states that users are auto-enabled for passkeys and nudged to register at their next multifactor sign-in, and that by default they have unlimited snoozes of that prompt. The blocking prompt is a separate event on 1 February 2027.

What exactly changes in our tenant on 1 September?

Microsoft states that users enabled for SMS or voice in the Authentication Methods Policy, or in legacy MFA settings, are auto-enabled for passkeys and placed in a passkey profile allowing all passkey types, and that the tenant’s Registration Campaign settings are set to Microsoft Managed state targeting passkeys, which brings those users into scope automatically.

Does this apply to a South African commercial tenant?

Yes. The FAQ states that the timeline applies to public cloud environments only, and that other cloud environments follow on a later schedule. A commercial tenant in the public cloud is in scope wherever it is operated from.

How do we opt out, and how long does it last?

By setting optOutSettings.passkeyDynamicMigration to true through a PATCH against the Microsoft Graph beta authentication methods policy endpoint, which needs the Policy.ReadWrite.AuthenticationMethod permission. Microsoft states it covers the period from 1 September 2026 to 1 February 2027 and that standard timelines apply from February regardless of the setting.

Is self-service password reset affected?

Yes. Microsoft states that the retirement of native SMS and voice applies across Entra, including SSPR, and that organisations can still use an SMS and voice telecommunications provider through the Security Store.

We have a regulatory reason to keep SMS. What are our options?

A customer-managed telecom provider through the Microsoft Security Store. Microsoft’s dates are that provider options and terms publish on 18 September 2026 and that customers can select and configure a provider from 30 October 2026, so the route is not available on the day the default changes.

What does it cost?

Microsoft states that migrating SMS and voice users to passkeys incurs no additional cost. A telecom provider through the Security Store is charged by the provider, typically per message, and varies by volume, region and provider.

Are Azure AD B2C or External ID tenants affected?

Microsoft states that Azure AD B2C is out of scope and unaffected, and that for Microsoft Entra External ID the change comes next year with a separate announcement.

The Braintree view

Microsoft’s announcement supplies the platform fact. The customer control begins after that fact: identify the exposed process, name the owner, test the real dependency and retain a decision that can survive audit or staff turnover. Braintree can help structure the inventory, build the representative test and translate the result into a controlled implementation plan.

Use the seven-day action as the entry point. Do not wait for a renewal, support refusal or enforced update to reveal work that can be measured now.