Windows Hello for Business and Entra passkey on Windows: after Entra SMS and voice MFA retire
Short answer: Users who already sign in with Windows Hello for Business can keep using it after the retirement, and Microsoft lists it as a phishing-resistant method. The credential is tied to one device, so users also need a portable method such as a passkey for other devices. On PCs that aren't Entra joined or registered, Microsoft Entra passkey on Windows stores a device-bound passkey in the local Windows Hello container, but it can't sign in to Windows itself.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| Windows Hello for Business | ✓ yes | Corporate PCs that are Microsoft Entra joined or hybrid joined. Gives device sign-in and single sign-on. | One device only, up to 10 enrollments per device, and not for shared-account kiosks. |
| Microsoft Entra passkey on Windows | ✓ yes | Unregistered, personal or shared PCs, and several Entra accounts on one PC. | No Windows device sign-in. Registration fails if a Windows Hello for Business credential already exists for that account. |
| Portable passkey (security key, Authenticator or synced) | ✓ yes | Signing in on other devices and bootstrapping Windows Hello for Business on a new PC. | Register it before you remove SMS or voice, so a replaced PC doesn't strand the user. |
What to do
- Deploy Windows Hello for Business with the cloud Kerberos trust model when users sync from on-premises Active Directory, as Microsoft recommends.
- On a new Microsoft Entra joined PC, users can sign in with a TAP during setup to join the device and register Windows Hello for Business without a password. On already joined or hybrid joined devices they first sign in with another method.
- Make sure each user also has a portable credential. Microsoft recommends at least two methods, for example a passkey plus Windows Hello for Business.
- To allow Entra passkey on Windows, add a passkey profile with Passkey types set to Device-bound and Target specific AAGUIDS with Behavior Allow, then select + Add AAGUID > Windows Hello. Don't enforce attestation in this profile.
- Assign that profile to the right group on Enable and target.
- After users test their new methods, remove them from the SMS and Voice calls policy scope to stop passkey nudges.
Watch out
- A Windows Hello for Business credential stops the passkey nudge on Windows only. The same user is still nudged on macOS, iOS or Android.
- To allow only hardware-backed Windows passkeys, allow the Windows Hello Hardware and VBS Hardware Authenticator AAGUIDs and leave out the Software one.
- On the latest Windows 11 versions, certutil -deletehellocontainer removes Windows Hello for Business and any passkeys stored on that PC.
- Windows Hello for Business can't be used for self-service password reset.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
- Microsoft Learn: Microsoft Entra authentication overview
- Microsoft Learn: Windows Hello for Business overview
- Microsoft Learn: Windows Hello for Business Frequently Asked Questions (FAQ)
- Microsoft Learn: Enable Microsoft Entra passkey on Windows
- Microsoft Learn: Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
- Microsoft Learn: Configure a Temporary Access Pass in Microsoft Entra ID to register passwordless authentication methods
- Microsoft Learn: Run a Registration Campaign to Set Up a Passkey or Microsoft Authenticator
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement