Microsoft Entra passwordless update: direct passkey onboarding

For years, a brand-new Entra ID user had to pass through the one factor security teams trust least — an SMS or voice code — on the way to a strong credential. That stepping-stone is going away. Eligible password-only users can now enrol straight into a phishing-resistant passkey, and the phone code is retired from the path entirely.

New to cloud? CAMPUX is a free, build-first course. Start here →

Here is the awkward part of nearly every "we rolled out MFA" story: the day a new hire set up their account, the strongest thing standing between an attacker and the tenant was a six-digit code texted to a phone number. Registration was the soft moment. Password first, then a phone method to "prove" it was really them, and only later — sometimes much later — a real passkey. Anyone running an attacker-in-the-middle page or a SIM-swap targeted exactly that window.

Microsoft's passwordless update closes the window. In Entra ID, an eligible password-only user — someone who has not yet registered a phone method — can be sent directly to a passkey at onboarding, skipping SMS and voice altogether. The result is less friction for the user and one fewer phishable factor for you to defend. The zero-trust lifecycle is secured from Day 1 instead of Day 90.

The old flow had a weak link in the middle

The legacy onboarding order looked sensible on a slide and dangerous in practice. A new user set a password, then registered SMS or voice as their second factor, then — eventually — a passkey. The problem is that the middle step is a shared secret sent over a channel you do not control. A code read aloud or typed into a convincing fake page is a code an attacker can replay. A number ported to a new SIM is a factor handed to the wrong person.

The new direct flow removes the middle box. There is no phone code to steal because there is no phone code in the path. A passkey is bound to the site it was created for and to the device that holds it, so a fake login page has nothing to capture and nothing to replay.

What "direct passkey onboarding" actually changes

The mechanism is not a new product — it is a change to who has to touch a weak factor first. Previously, security-info registration nudged users toward whatever method was cheapest to set up, and SMS won by default. Now, when a user has no phone method registered and your policies allow it, Entra can present passkey registration as the first and only step. They set up a passkey, satisfy a phishing-resistant policy, and are done.

Two things make this safe rather than merely convenient. First, it applies to eligible users — the ones without a legacy phone method already on file — so you are not silently downgrading anyone. Second, the credential they land on is genuinely phishing-resistant, not a slightly better password. That is the whole point: you are not making onboarding faster at the cost of security, you are making it faster because the secure path is now the short one.

What counts as a direct-to-passkey credential

"Passkey" is a family, not a single thing. Any of these can be the credential a user registers directly, and each one satisfies a phishing-resistant Conditional Access policy:

• Synced passkeys — stored and synced across a user's devices through iCloud Keychain, Google Password Manager, or a manager like Bitwarden. Best for people who move between a phone and a laptop and do not want a hardware key.
• FIDO2 security keys — hardware-bound keys (the kind on a lanyard or in a USB port). The right call for high-security roles and shared endpoints where the credential must never leave the device.
• Windows Hello for Business — the device-bound credential already built into a managed Windows machine. For most corporate Windows fleets this is the passkey users already have.
• macOS Platform SSO — native enterprise single sign-on on a managed Mac, so an Apple fleet gets the same phishing-resistant sign-in without a separate key.
• Microsoft Authenticator passkey — a passkey created inside the Authenticator app, for a mobile-first, no-extra-hardware rollout.

You do not have to pick one for the whole company. A common pattern is synced passkeys or Authenticator for the general population, and hardware FIDO2 keys for admins and anyone touching production.

The timeline you are working against

This is not a "someday" change — there are dates, and the phone methods are being retired on Microsoft's published schedule. Plan backwards from them:

• 1 September 2026 — Passkeys by default Automatic prompts start nudging SMS and voice users toward passkey registration when they sign in. Nothing is removed yet, but the default direction changes.
• 30 October 2026 — Telecom options open Admin configuration opens for third-party telecom providers, so teams that genuinely still need a phone fallback can wire one up before the native option ends.
• 1 February 2027 — Native SMS / voice retirement Microsoft-provided SMS and voice delivery fully ends. Phishing-resistant passkeys become the mandatory default rather than a phone code.

The honest read: if your onboarding still tells new hires to register a phone number, you have until early 2027 to change that — and every month you wait is another cohort onboarded onto the factor you are about to remove.

A 4-step checklist for identity and security teams

1. Audit your authentication method policies. In the Entra admin center, enable the Passkey (FIDO2) method and scope it to the right groups. Confirm which of the five credential types your devices actually support before you promise users a path.
2. Review your Conditional Access rules. Make sure security-info registration and sign-in policies do not block a password-only user on a valid, trusted device from reaching passkey registration. A well-meant "require MFA to register security info" rule can quietly break the direct flow.
3. Update the HR and IT onboarding docs. Delete the lines that tell new hires to register a phone number first. The fastest way to keep provisioning weak factors is to keep handing people instructions that ask for them.
4. Deploy a passkey registration campaign. Configure Entra's native Registration Campaign to prompt existing SMS and voice users to add a passkey, and let it run to move your population across well before the retirement dates — not in a panic the week of.

The safest moment in an account's life should not be the one you defend with a text message.

Why this is a zero-trust win, not just a UX one

It is tempting to file this under "nicer sign-in." It is bigger than that. Onboarding is the point where an identity is at its most trusted and least verified — a fresh account, a helpdesk that wants to unblock someone, a user who will click whatever gets them working. Putting a phishing-resistant credential at that exact moment removes the SIM-swap and attacker-in-the-middle risk from the part of the lifecycle where it did the most damage. You are not bolting security on after the fact; you are starting from it.

The move for a cloud or security engineer is simple to state and worth doing this quarter: enable passkeys, fix the Conditional Access rule that would block a password-only user, rewrite the onboarding doc, and switch on the registration campaign. Do that, and the next person who joins never touches the weak factor at all.

Questions people also ask

How do I set up direct passkey onboarding in Entra ID?

In the Entra admin center, open Authentication methods and enable the Passkey (FIDO2) method for your target users, then run a Registration Campaign that prompts eligible sign-ins to enrol a passkey. Password-only users who have no phone method registered can go straight to a passkey, so you do not have to route new hires through SMS or voice first. Check your Conditional Access and security-info registration policies so they do not block a password-only user on a trusted device.

What is phishing-resistant authentication in Entra ID?

Phishing-resistant authentication uses credentials bound to the site and the device, so they cannot be replayed by a fake login page or an attacker-in-the-middle proxy. In Entra ID that means passkeys and FIDO2 security keys, Windows Hello for Business, and certificate-based authentication. Because there is no code to read aloud or type, there is nothing for a phishing page or a SIM-swap to steal.

Can I remove SMS MFA in Entra ID?

Yes. You can disable the SMS and voice methods in Authentication methods once your users have registered a stronger credential, and Microsoft is retiring its own SMS and voice delivery on a published timeline anyway. The safe order is to enable passkeys, run a registration campaign to move users across, confirm coverage in the sign-in logs, and only then turn the phone methods off so no one is locked out.

What credentials support direct-to-passkey registration in Entra?

Five kinds count as a phishing-resistant passkey you can register directly: synced passkeys stored in iCloud, Google, or a manager like Bitwarden; hardware FIDO2 security keys; Windows Hello for Business on a managed Windows device; macOS Platform SSO on a managed Mac; and a passkey created in the Microsoft Authenticator app. All of them satisfy a phishing-resistant Conditional Access policy.

When is Microsoft retiring SMS and voice MFA?

On Microsoft's published timeline, passkeys become the default prompt for SMS and voice users from 1 September 2026, admin options for third-party telecom fallback open on 30 October 2026, and Microsoft-provided SMS and voice delivery ends on 1 February 2027. After that final date, phishing-resistant passkeys are the mandatory default rather than a phone code.