The era of the shared secret is officially winding down. In a move that signals a massive shift in how corporate America—and, by extension, much of the global workforce—logs into work, Microsoft has announced that passkeys will now be the default authentication method for Microsoft Entra ID.

For the uninitiated, Microsoft Entra ID (formerly Azure Active Directory) is the invisible engine behind the scenes for countless organizations, managing the digital identities and permissions of millions of employees. Up until now, if your company required multifactor authentication (MFA), you likely received a six-digit code via SMS or a phone call to prove you were who you said you were. But starting September 1, 2026, Microsoft will begin automatically nudging users toward passkeys instead.

To understand why this matters, you have to look at how the threat landscape has shifted over the last couple of years. We’ve all been told for a decade that SMS-based two-factor authentication is better than nothing, and it was. It stopped basic, automated hacking attempts in their tracks. But in the era of weaponized AI, traditional MFA is showing its age.

According to Microsoft’s latest Digital Defense Report, AI-driven phishing campaigns are currently seeing click-through rates as high as 54%. Compare that to the 12% click-through rate of old-school, poorly translated phishing emails of yesteryear. Attackers are no longer just guessing passwords; they are using sophisticated, automated tactics to intercept SMS codes, pull off SIM-swapping scams, or deploy “adversary-in-the-middle” attacks that trick users into handing over their session tokens. Once a single corporate identity is compromised, an AI-powered cyberattack can automate privilege escalation and lateral movement across a company’s network faster than a human security team can even register the alert.

This is where passkeys come in. Built on public-key cryptography, passkeys are inherently phishing-resistant. Unlike a password or a text code, there is no “secret” shared between you and the server that a bad actor can intercept or trick you into typing onto a fake website. The private key stays securely on your device—whether that’s your phone, a laptop, or a physical hardware key—and unlocks using your biometric data (like a fingerprint or facial scan) or a local PIN. If a hacker directs you to a pixel-perfect replica of your company’s login page, a passkey simply won’t work because the cryptography ties the login directly to the legitimate web domain. It completely breaks the mechanics of modern phishing.

Microsoft’s rollout plan is aggressive but calculated. When the September deadline hits, users who still rely on SMS or voice authentication will automatically have passkeys enabled on the backend. The next time they log in and trigger an MFA prompt, they’ll be guided through a registration campaign to set up a passkey on their device.

But the real kicker comes a few months later. On February 1, 2027, Microsoft is entirely retiring its native, telecom-provided SMS and voice delivery system. It’s a bold line in the sand. If an organization has a strict regulatory, technical, or operational reason to keep legacy SMS or voice verification alive, they will have to go out of their way to contract with a third-party carrier through the Microsoft Security Store and foot the bill for the telecom costs themselves.

For the average employee, this transition will likely feel like a rare security upgrade that actually makes life easier. Instead of scrambling for a phone, waiting for a text message, and racing to type in a crumbling six-digit code before it expires, logging in will look a lot like unlocking a smartphone—a quick glance at a camera or a thumbprint on a sensor, and you’re in.

Security professionals have spent years preaching that the best security is the kind that users don’t actively try to bypass. By making the most secure method also the most seamless, Microsoft isn’t just updating a default setting; they’re fundamentally rewriting the playbook on corporate cybersecurity for the AI era.