Microsoft Entra ID Makes Passkeys Default from September 2025

What happened

Microsoft has announced that passkeys will become the default authentication method for Entra ID, its cloud-based identity and access management platform, beginning 1 September 2025. The move effectively ends the era of optional passwordless authentication for enterprise Microsoft customers and sets a firm deadline for legacy methods: SMS and voice-based authentication provided by Microsoft will be discontinued on 1 February 2027.

The transition gives organisations a phased runway — roughly six months of rollout before the new default takes hold, and a further period before legacy fallbacks disappear entirely. Microsoft's direction of travel is clear: passkeys are no longer a security enhancement organisations can elect to adopt; they are becoming the baseline expectation for anyone operating within the Entra ID ecosystem.

The urgency behind the shift is partly competitive and partly threat-driven. Security professionals have highlighted that AI is now being used to automate phishing campaigns at scale, generate convincing fraudulent login pages, and industrialise credential theft — making traditional SMS one-time passwords an increasingly weak link in enterprise security chains.

Why it matters

For customer experience and service-design practitioners, authentication is a front-line interaction — often the first moment of friction a user encounters. Passwords and SMS codes carry well-documented behavioural costs: forgotten credentials, abandoned sessions, support-desk load, and the anxiety that comes from uncertainty about whether a login page is genuine. Passkeys, which rely on device-bound cryptographic keys rather than shared secrets, remove several of these pain points simultaneously. The login experience becomes faster, more consistent, and — critically — harder to spoof, which reduces the cognitive load associated with security vigilance.

From a behavioural economics perspective, Microsoft's decision to make passkeys the default rather than an opt-in is a textbook application of choice architecture. Default effects are among the most robust findings in behavioural science: the majority of users and administrators accept defaults rather than actively reconfiguring them. By shifting the default, Microsoft is leveraging inertia in the direction of better security outcomes — a reminder that how a choice is structured often matters more than the information provided to support it.

By the numbers

• 1 September 2025 — date from which passkeys become the default authentication method in Microsoft Entra ID.
• 1 February 2027 — deadline after which Microsoft-provided SMS and voice authentication will be permanently retired.
• ~17 months — the transition window organisations have between the default change and the hard cut-off for legacy methods.

The Renascence take

Most commentary on this announcement will focus on the cybersecurity rationale. That framing, while valid, undersells the more consequential story: a major platform vendor is using default architecture — not persuasion, not awareness campaigns — to reshape the authentication experience for millions of enterprise users simultaneously.

The lesson here is not about passkeys specifically; it is about the power of defaults as a service-design instrument. Organisations that wait for users to voluntarily adopt better behaviours will always lag. What Microsoft is doing — deliberately and at scale — is what customer-obsessed operators should be doing inside their own platforms: audit every opt-in that should be an opt-out, every friction point that persists only because no one redesigned the default. The February 2027 deadline also carries a warning for enterprise CX teams: if your customer-facing authentication still relies on SMS OTPs, the clock is running, and the transition plan needs to start now, not when the cut-off is imminent.