Recently I posted about how Microsoft announced that starting September 1, 2026, users who are enabled for SMS or voice authentication will be automatically enabled for passkeys. Microsoft will also move the Registration Campaign to a Microsoft-managed configuration for these users, which means they can start receiving prompts to register a passkey when they sign in and complete MFA.

For organizations that are already ready for passkeys, this is probably not a problem. But there are environments where the security team may need more time to migrate users, review authentication methods, or deal with specific operational requirements.