I'm trying to understand the scope of the September 1, 2026 passkey enrollment change related to SMS and Voice MFA deprecation. In our Entra Authentication Methods Policy, SMS is enabled for all users, but only a small percentage currently has SMS registered in their authentication methods. I initially assumed this meant there was little we needed to do. However, Microsoft's FAQ says that users enabled for SMS or Voice in the policy will be automatically enabled for passkeys. Does "users enabled" mean everyone within the policy scope, even if they have never registered an SMS or Voice method? For example, would a user who is eligible for SMS but currently has only Microsoft Authenticator configured still receive the passkey enrollment nudge?
3 Answers
The nudge is reportedly snoozable until February 2027, but you may still want to control the rollout yourself. You could opt out of the automatic nudge and run a staged passkey enrollment campaign using groups or deployment rings. If SMS and Voice are enabled only for something like self-service password reset and nobody is actually using them, verify that first and then consider disabling those methods.
We found users who had no registered method other than SMS, so it’s worth checking the registration reports before disabling anything. Even if SMS has been called deprecated for a while, some organizations still rely on it for contractors, frontline staff, or people who cannot use a managed device or install work apps on a personal phone.
Yes. The important distinction is between being eligible for SMS or Voice under the Authentication Methods Policy and actually having that method registered. If the policy is scoped to all users, the passkey nudge can apply to all of them, including users whose only registered method is Microsoft Authenticator. The eligibility scope matters more than the methods each person currently uses.
That’s helpful. We’ll check actual registrations and usage first, then decide whether to disable SMS or manage the passkey rollout separately.