Lookout Ma - the passkeys are-a-comin'!

I spent longer than I'd like to admit assuming passkeys were genericised marketing paint over the Face ID thing my phone has done for a decade. It isn't, and if you're in the same boat you've got about five months to get across it.

On the 1st of this month, Microsoft started rolling out passkeys as the default authentication experience in Entra ID. By the 1st of February 2027, Microsoft-provided SMS and voice MFA will be gone. Not deprecated. Gone. And there's no opt out from that one.

OK, then what are passkeys?

Forget biometrics for a second, because that's the part that confuses everyone - a passkey is a pair of cryptographic keys. When you register one, your device generates a private key that stays on the device and hands the website a matching public key. The site stores the public key. That's all it ever has. When you sign in, the site sends your device a random challenge. Your device signs it with the private key. The site checks the signature against the public key and lets you in.

Notice what didn't happen?!?Nothing reusable crossed the wire, and the site never held a secret worth stealing. A password is the opposite of that - a shared secret, where anyone who ends up with either copy can be you.

So where does Face ID come in?

Face ID is not the credential. Face ID is thelock on the drawer where the credential lives.

When you use Face ID to open your banking app today, all you've done is unlock something locally. The app then authenticates the old way behind the scenes with a stored token or password. The bank never sees your face and never sees a credential it didn't already hold.

With a passkey the gesture is identical - same face, same fingerprint, same PIN - but it's releasing your private key so it can sign the challenge. The gesture provesyou'restanding there. The key proves it'syourdevice.

A rose by any other name? No. The user experience is nearly identical, which is where I think a lot of the confusion lies, but it's what sits underneath that makes all the difference....

They can't be phished

A passkey is bound to the origin it was created for. Your Microsoft passkey will only ever sign a challenge from Microsoft. Put a user on a pixel-perfect fake login page and their device simply won't produce a signature, because the domain doesn't match. They don't need to spot the dodgy URL. They can't be talked into handing it over, because there's nothing to hand over.

Hold that against SMS. A texted code can be read aloud to someone pretending to be the service desk, relayed through an attacker-in-the-middle proxy in real time, or lifted via a SIM swap. It was never phishing-resistant. We tolerated it because everyone has a phone. AI-assisted phishing at volume has ended that tolerance.

Two flavours, and the difference matters

Passkeys come in two types and you can't tell them apart from the sign-in screen:

Asyncedpasskey gets an encrypted copy stashed in a cloud vault, so it follows the user onto every device they own. iCloud Keychain, Google Password Manager, 1Password. New laptop, sign in, the passkey is already there.

Adevice-boundpasskey is generated inside a secure chip and has no export function. It cannot leave. Windows Hello, a passkey in Microsoft Authenticator, a YubiKey. New laptop means a new enrolment.

Synced is cheap and users already have it working, but Apple or Google ends up holding an encrypted copy of a credential to your tenant. Device-bound is stronger and is the only type that supports attestation, which is Entra verifying what actually created the key. Microsoft's own position is synced for most staff, device-bound for regulated environments and privileged accounts.

The dates

• 1st of September 2026- users enabled for SMS or voice are auto-enabled for passkeys and nudged to register after MFA sign-in. Unlimited snoozes by default, so expect slow drift rather than a hard stop
• 18th of September 2026- Microsoft publishes supported telecom providers, pricing and terms via the Microsoft Security Store
• 30th of October 2026- the point from which you can actually select and configure a third-party telecom provider, if you genuinely still need SMS or voice
• 1st of February 2027- Microsoft-provided SMS and voice retired. Users whose only MFA method is SMS or voice hit ablockingpasskey registration prompt. No opt out, all tenants

A temporary opt-out exists for September through January, set via an API call to Graph on the authentication methods policy. It buys migration time, not an exemption from February.

Check this one before you do anything else

We're already seeing organisations where users get nudged to enrol a passkey and the registration then quietly fails. Nothing obvious, no clear error, just a prompt that goes nowhere.

The common thread is tenants that had deliberately turned FIDO2 off or locked it down. The auto-enablement on the 1st of September drops in-scope users into a passkey profile and flips your Registration Campaign to Microsoft managed, but a passkey campaign has hard prerequisites - the Passkey (FIDO2) method enabledand"Allow self-service setup" ticked in the method configuration. Microsoft also documents that a registration error just shows a skip screen, so failures don't block sign-in and never surface as a support ticket.

Go and look atEntra ID > Authentication methods > Policies > Passkey (FIDO2)and confirm the method state and the self-service toggle.

What I'd do

1. Find who's still on SMS or voice. Microsoft publishes a PowerShell analyser for exactly this. Do it this week
2. Fix the FIDO2 policy state and the self-service toggle before the nudge reaches you
3. Decide your position on synced versus device-bound, then run your own registration campaign on your timetable before you're faced with an enforced service desk tsunami
4. Sort out recovery first. It's the bit everyone skips and it's the bit that generates the tickets. What happens when someone's phone falls into the Yarra (or gets thrown there if the Hawks somehow fumble a home prelim)?

The only certainty is change

Spare a thought for the people who finally got the memo...My parents spent fifteen years being nagged into twelve characters with a number and a symbol, got there, felt quietly proud of themselves, and are now being told the password barely matters and they should just look at their phone. That's not a small ask. If your change comms are a Teams post with a Learn link, expect a queue at the service desk. Educate them to your particular implementation, with screenshots, and ensure your EUC teams are well across how it works and why.

The passkey revolution is upon us. And now that you (and I) know exactly what they are, it's time to embrace the security benefits they bring!