Microsoft Entra Passkey Dynamic Migration: The Setting You Won't Find in the Portal

July 30, 2026 · 6 min read · Roy Klooster

Entra ID Authentication Passkeys MFA Security

Microsoft-provided SMS and voice authentication are retiring from Microsoft Entra ID on February 1, 2027. Before that, on September 1, 2026, Microsoft starts enabling eligible SMS and voice users for passkeys and brings them into a Microsoft-managed passkey registration campaign.

That is the part administrators need to notice. You can review the visible Registration campaign and System-preferred authentication settings in the Entra admin center and still miss the control over Microsoft’s automatic rollout. The temporary opt-out is a Microsoft Graph property named optOutSettings.passkeyDynamicMigration.

This is not an article about a new switch to turn on. It is about avoiding two bad surprises: users receiving passkey prompts before your support and communication plan is ready, or an organisation assuming that an opt-out keeps Microsoft-provided SMS working after February 2027.

Table of Contents

Start with the change Microsoft is making
The hidden control: passkey dynamic migration
The portal controls: registration and sign-in preference
How the settings work together
What should my tenant do?
Four checks before you change anything

Start with the change Microsoft is making

The timeline explains why the Graph property matters.

Date	What Microsoft changes	What an administrator should do
September 1, 2026	Microsoft moves the Registration campaign to Microsoft managed state and targets passkeys for users still enabled for SMS or voice. It also auto-enables those users for passkeys in the Authentication Methods Policy.	Identify those users, prepare their registration route, and communicate the change.
February 1, 2027	Microsoft-provided SMS and voice are retired. If no customer-managed telecom provider is configured, a user whose only available MFA method is SMS or voice must register a passkey before they can continue signing in.	Move users to a phishing-resistant method. If you need a Registration campaign to target Authenticator rather than passkeys, set its state to Enabled and choose Microsoft Authenticator.

The September action does not silently create a passkey. It changes policy and campaign scope. At a later MFA sign-in, the user is nudged to register the credential themselves. The February prompt is different: it cannot be skipped.

The hidden control: passkey dynamic migration

Microsoft publishes the temporary opt-out for the September rollout through Microsoft Graph. Put plainly: this control is not a portal setting alongside Registration campaign or System-preferred authentication. It is a tenant-wide property on the authentication methods policy.

Do not treat it as a third three-state policy. Its useful values are simpler:

Tenant position	What happens
Not temporarily opted out	Microsoft can apply the September automatic passkey enablement and Microsoft-managed registration-campaign rollout to eligible SMS/voice users.
`passkeyDynamicMigration` set to `true`	The tenant is excluded from that automatic rollout from September 1, 2026 until February 1, 2027, while it completes transition work.
February 1, 2027 and after	The SMS and voice retirement applies regardless of this property. It is not an opt-out from the deadline.

Use the property when you need to control the timing of Microsoft’s automatic passkey rollout while you move SMS and voice users to the authentication method you selected. That might be passkeys, a different registration-campaign target such as Microsoft Authenticator, or a customer-managed telecom provider for a defined population.

Check the current value

It requires Policy.Read.AuthenticationMethod and either the Global Reader or Authentication Policy Administrator role.

Connect-MgGraph -Scopes 'Policy.Read.AuthenticationMethod' -NoWelcome

$policy = Invoke-MgGraphRequest `
    -Method GET `
    -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy'

$policy.optOutSettings | Format-List

An absent property or a value other than true means the tenant has not used this temporary opt-out. It does not say that SMS and voice are safe after February 2027.

Apply the temporary opt-out

If you want to temporarily opt out, use Policy.ReadWrite.AuthenticationMethod. Authentication Policy Administrator is the least-privileged built-in role.

Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod' -NoWelcome

$body = @{ optOutSettings = @{ passkeyDynamicMigration = $true } } |
    ConvertTo-Json -Depth 4

Invoke-MgGraphRequest `
    -Method PATCH `
    -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' `
    -ContentType 'application/json' `
    -Body $body

The endpoint is under Graph /beta. Recheck Microsoft’s retirement guidance before making a production change, and record the approval, response, and exit plan.

The Graph setting decides whether Microsoft temporarily performs its automatic rollout. The following portal settings have different jobs and their own states.

Registration campaign: ask users to register

A registration campaign is an adoption tool. After a targeted user completes MFA, Entra can prompt them to register a passkey or Microsoft Authenticator. For a passkey campaign, passkeys (FIDO2) and self-service setup must already be enabled.

State	What it means
Disabled	No registration campaign prompt.
Enabled	The administrator chooses the target method, targets, snooze period, and whether registration is required after the allowed snoozes.
Microsoft managed	Microsoft chooses the campaign values. The target can move from Authenticator to passkeys. Microsoft also controls the snooze and enforcement settings. Administrators can still manage inclusion and exclusion.

A campaign asks a user to register. It does not create a passkey, make it their default sign-in choice, or remove SMS and voice. Microsoft’s registration-campaign guidance has the exact prerequisites and nudge behaviour.

System-preferred authentication: offer a method that exists

System-preferred authentication is a sign-in selection rule. If a user has a password, Authenticator, and a passkey, Entra can offer the passkey first. If they have not registered a passkey, there is nothing to offer.

State	What it means
Disabled	Entra’s normal sign-in selection logic continues.
Enabled	Entra applies system-preferred selection at second factor only.
Microsoft managed	Entra applies it at first and second factor as Microsoft’s rollout reaches the tenant.

Users can choose Sign in another way. Conditional Access and authentication strengths still take precedence. Microsoft documents the current ordering and limitations.

How the settings work together

These are the three user paths that matter:

A deliberate rollout: You set Registration campaign to Enabled for a pilot group. The user completes MFA, sees the passkey prompt, and registers a passkey. With System-preferred authentication enabled, that passkey can be offered first at a later sign-in.
Microsoft-managed migration: The user is still enabled for SMS or voice on September 1, 2026 and the tenant has not opted out. Entra enables passkeys for the user and brings them into a Microsoft-managed passkey campaign. At their next qualifying MFA sign-in, they see the nudge and choose whether to complete registration. System-preferred authentication can only offer the passkey after it exists.
Temporary opt-out: passkeyDynamicMigration is true. Microsoft does not perform the automatic September policy and campaign rollout for the tenant during the opt-out period. Your own campaign and system-preferred settings remain separate decisions. The February retirement date does not move.

Dynamic migration changes policy and campaign scope → the campaign prompts registration → system-preferred authentication changes a later sign-in experience

What should my tenant do?

Situation	Recommended action
You want users to move to passkeys before February 2027.	Leave dynamic migration available, use a passkey campaign to drive adoption, and use system-preferred authentication to offer registered passkeys first.
You want the campaign to register Microsoft Authenticator instead of passkeys.	Set Registration campaign to Enabled and target Microsoft Authenticator. This changes the campaign experience. It does not change the SMS and voice retirement date.
You need time to move a defined SMS/voice population to another method or to configure a customer-managed provider.	Temporarily opt out only if the automatic September rollout would conflict with that transition work.
You have not decided how SMS/voice users will move off those methods.	Start with the SMS/voice user inventory. Do not treat the opt-out as the plan itself.

Four checks before you change anything

“Our users already have Authenticator, so the September rollout does not apply.” Not necessarily. Microsoft scopes the automatic rollout to users who are enabled for SMS or voice in the Authentication Methods Policy or legacy MFA settings. Authenticator registration alone does not remove that scope.
“System-preferred authentication will create the passkey.” No. It offers the strongest suitable method the user has already registered. Use a Registration campaign when you need users to create a new method.
“The Registration campaign migrates users.” It asks them to register after MFA. The user still completes passkey registration, or postpones the prompt where the campaign allows it.
“Opting out means SMS will still work after February 2027.” It only delays Microsoft’s September automatic passkey enablement and campaign rollout. It does not extend Microsoft-provided SMS or voice.

References

← back to all posts next: Language Pack Deployer: Deploy Language Settings... →