Passkeys in Microsoft Authenticator: after Entra SMS and voice MFA retire
Short answer: A passkey in Microsoft Authenticator is a device-bound, phishing-resistant passkey kept on the user's iOS or Android phone. Microsoft lists Android 14 or later and iOS 17 or later as requirements. It is separate from Authenticator push notifications and verification codes, which still work for MFA but aren't on Microsoft's list of phishing-resistant methods.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| Passkey in Microsoft Authenticator | ✓ yes | Users with a company or personal phone on Android 14 or later or iOS 17 or later. | Cross-device use needs Bluetooth and internet on both devices, and access to the endpoints Microsoft lists. |
| Authenticator push notification | no | Existing MFA, and also an SSPR method. | Not phishing-resistant. Push notifications on Android don't work in China. |
| Authenticator verification code (TOTP) | no | Backup that works without connectivity and keeps the user out of the blocking passkey prompt. | Doesn't satisfy Conditional Access that requires phishing-resistant authentication. |
What to do
- Enable passkeys (FIDO2) and opt in to passkey profiles in the Authentication methods policy.
- Under Passkey (FIDO2) > Configure, select + Add profile, name it (for example Authenticator passkeys), set Passkey types to Device-bound, select Target specific AAGUIDS with Behavior Allow, and add Microsoft Authenticator.
- If you add the AAGUIDs by hand, use
de1e552d-db1d-4423-a619-566b625cdc84for Android and90a3ccdf-635c-4729-a248-9b709135078ffor iOS. - On Enable and target, assign the profile to a pilot group, then widen it.
- Users add their work or school account in Authenticator and tap Create a passkey, which Microsoft calls the recommended flow. They can also start from Security info with Add sign-in method > Passkey in Microsoft Authenticator. Users without MFA can sign in to Authenticator with a TAP.
- Run a registration campaign that targets Passkey (FIDO2) to nudge users after MFA.
Watch out
- A Conditional Access policy that requires a passkey for All resources can trap users in a loop when they add a passkey in Authenticator. Target specific apps, or use a separate mobile policy that also accepts a TAP.
- Require approved client app or Require app protection policy on All resources blocks passkey registration in Authenticator.
- With attestation enforced, the WebAuthn flow from Security info can't be used, and registration depends on platform attestation services being available.
- On Android, a passkey works only from the profile (work or personal) where it was created.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: Enable and support passkeys in Authenticator for Microsoft Entra ID
- Microsoft Learn: Register passkeys in Authenticator on Android and iOS devices
- Microsoft Learn: Microsoft Authenticator authentication method
- Microsoft Learn: Microsoft Entra authentication overview
- Microsoft Learn: OATH tokens authentication method
- Microsoft Learn: Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
- Microsoft Learn: Run a Registration Campaign to Set Up a Passkey or Microsoft Authenticator
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
Did this fix it?
Other situations
- Users without a smartphone
- Shared and kiosk Windows PCs
- Frontline workers and shared mobile devices
- B2B guests and internal guest users
- FIDO2 security keys and passkey profiles
- Windows Hello for Business and Entra passkey on Windows
- Break-glass accounts and Global Administrators
- Self-service password reset (SSPR)