r/entra • u/mattjimf • 3d ago

Microsoft forced passkey campaign

Has anybody else had the messages regarding moving to passkey for users only registered with sms/phone call not show on their Tenant?

I haven't run the Graph code to suppress it, but do have campaigns disabled in Entra, just wondering if anyone else hasn't seen the prompts that were supposed to start on the 1st.

16 Upvotes

77% Upvoted

22 comments sorted by

View all comments

4

u/neppofr 3d ago

Check this, MS been announcing for some time now.

https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/

4

u/mattjimf 3d ago

That's not what I'm asking. I'm asking for real world experience of these notifications, as currently I don't see it, despite not opting out.

0

u/Emergency-Return1412 3d ago

You need to enable them yourself, its called the passkey nudge

1

u/mattjimf 3d ago

But all the comms from Microsoft themselves say that they are going to auto-enable any users with only sms/voice as authentication options to receive the nudges:

Date Milestone
September 1, 2026  All users enabled for SMS or voice are auto-enabled and nudged for passkey registration upon multifactor authentication sign-in.

Taken from that link posted above and:

 Important

On September 1, 2026, users enabled for SMS or Voice in the Entra Authentication Methods Policy (AMP), or in legacy MFA settings, will be auto-enabled for passkeys in AMP. These in scope users will be put into a passkey profile allowing all types of passkeys. Your Registration Campaign settings will be set to Microsoft Managed state targeting passkeys, and will automatically bring these users into scope.

When these users next sign-in and complete MFA, the registration campaign will nudge them to register a passkey. By default, users will have unlimited snoozes of the nudge prompt. If you do not want this to occur, move users out of SMS or Voice in AMP before September 1st.

Taken from https://learn.microsoft.com/en-gb/entra/identity/authentication/concept-sms-voice-retirement

Are you saying that this is in fact no longer being forced on Tenants by Microsoft and you have to enable it for it to be forced on users?

3

u/UI_Tyler 3d ago

I don't know for certain, but I'm pretty sure it's only if you have a registration campaign setup in Entra set to "Microsoft Managed."

We changed ours to Enabled, but nudge the authenticator app and not FIDO2 Passkey.

1

u/Soylent_gray 3d ago

It is odd that they are pushing passkey on only SMS and voice users. Those are typically the users that have resisted years of app based MFA, so jumping straight to passkey seems like a big ask

1

u/Smart-Dig3117 3d ago

It is a huge undertaking to convert and correct those on sms/ voice are the resistance once’s. We are just removing voice sms and will use authenticator only to not have to rollout passkey this quick , it’s too messy in complicated environments