How to Temporarily Opt Out of Passkeys by Default in Microsoft Entra ID

Recently I posted about how Microsoft announced that starting September 1, 2026, users who are enabled for SMS or voice authentication will be automatically enabled for passkeys. Microsoft will also move the Registration Campaign to a Microsoft-managed configuration for these users, which means they can start receiving prompts to register a passkey when they sign in and complete MFA.

For organizations that are already ready for passkeys, this is probably not a problem. But there are environments where the security team may need more time to migrate users, review authentication methods, or deal with specific operational requirements.

Microsoft has now documented a temporary opt-out for this transition so I’ll explain how can you opt-out and verify if you have already opted-out.

Requirements

Microsoft states that the following Microsoft Graph permission is required:

Policy.ReadWrite.AuthenticationMethod

The documented API request uses the Microsoft Graph beta endpoint:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy

Microsoft Graph request

The request body is:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json

{
   "optOutSettings": {
      "passkeyDynamicMigration": true
   }
}

The relevant property is:

optOutSettings.passkeyDynamicMigration

Setting this property to true excludes the tenant from the automatic passkey enablement and Registration Campaign rollout during the temporary opt-out period.

There is an important detail here: the documentation describes this as a tenant-level opt-out. The request is made against the tenant’s authentication methods policy, rather than configuring an exception for individual users.

What does the opt-out actually prevent?

The opt-out prevents the automatic changes associated with the September 1 transition.

According to Microsoft’s documentation, once the setting is applied, the tenant is excluded from:

• Automatic passkey enablement.
• Automatic Registration Campaign rollout.

This applies during the temporary opt-out period.

In other words, this is useful if you are not ready for Microsoft to automatically move your SMS and voice users into the passkey registration experience on September 1.

It should not be interpreted as a way to permanently opt out of Microsoft’s move away from Microsoft-provided SMS and voice.

The opt-out has an expiration date

This is probably the most important operational detail.

The opt-out only delays the transition. It does not remove the February 1, 2027 enforcement.

Microsoft explicitly states that, beginning February 1, 2027, the standard passkey migration and enforcement timelines apply regardless of the opt-out setting.

There is no opt-out from that February 1 behavior.

Microsoft-provided SMS and voice authentication will be retired, and users who only have SMS or voice available for MFA will be required to register a passkey during sign-in before they can continue.

How to opt-out step by step

Using Graph Explorer

Go to Graph Explorer and log-in with your admin account:

To verify if you have opted-out select method as GET and URL https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy and then run the query. If optOutSettings is null you haven’t opted-out yet

To enable the opt-out set the method to PATCH and this JSON as the body:

{        
  "optOutSettings": {
    "passkeyDynamicMigration": true
  }
}

If you get a 403 error this most likely caused by insufficient permissions. Go to the Modify permissions tab and grant yourself Policy.ReadWrite.AuthenticationMethod:

Run the query and you should receive a 204 response

With the new setting added as true if you verify again with the GET method you should see the new setting:

Using PowerShell

First, connect to Microsoft Graph with permissiones to read and write authentication methods:

Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"

When you login, you may be prompted for permissions. If your account doesn’t have enought permissions to approve those permisisions you’ll need and admin to approve them for you ask your Global Admin or Application Administrator.

After login run this to verify if you have already opt-out:

(Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy").optOutSettings

If it doesn’t return anything it means you haven’t opted out

To opt-out run the following:

Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"
$body = @{
    optOutSettings = @{
        passkeyDynamicMigration = $true
    }
} | ConvertTo-Json

Invoke-MgGraphRequest `
    -Method PATCH `
    -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy" `
    -Body $body

It won’t return anything as a result but if you verify your opt-out status again it should return that passkeyDynamicMigration has the value True

My PowerShell script

I’ve created a PowerShell script to perfom the opt-out or just verify if the opt-out is enabled. The script verify if the opt-out is enabled before doing so.

You can check it out in my Github: set-EntraIDPasskeysDefaultOptout

Sources

• Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
• YouTube: Microsoft Entra / Passkeys by default