Microsoft has switched on passkeys as the default sign-in method for Microsoft 365 and Entra accounts from 1 September 2026, changing how staff log in.

• What it is: Passkeys (a fingerprint, face scan or device PIN) now replace passwords and SMS codes as the primary sign-in method across Microsoft Entra.
• Who is affected: All Microsoft 365 and Entra ID organisations, particularly those still relying on SMS or phone-call based multi-factor authentication.
• What the risk is: This is a security improvement, not a threat. The main risk is disruption: businesses still using old-style telephony MFA need to set up a new provider before that method is retired in February.
• What to do: Review which MFA methods your staff use. If you rely on phone-based verification, register a customer-managed telecom provider through the Microsoft Security Store (available from 30 October 2026) well ahead of the retirement date.

Passkeys are a genuine step up in security and we recommend moving staff to them where practical. Source: Microsoft Partner Center announcements.