Microsoft Changes Entra ID default Authentication Method to Passkeys, Replacing Passwords

Microsoft is retiring phishable SMS and voice-based multifactor authentication in Microsoft Entra ID, replacing them with passkeys as the default sign-in method starting September 1, 2026. The move responds to a surge in AI-enabled phishing campaigns that Microsoft Threat Intelligence has observed achieving click-through rates as high as 54%, compared to roughly 12% for traditional phishing attempts. Beginning September 1, 2026, users currently enabled for SMS or voice authentication will be automatically enrolled in passkeys, receiving a registration prompt the next time they perform multifactor authentication. Entra ID default Authentication Passkeys Microsoft’s rollout plan is structured around several key...

Read the full article at the source.