What Microsoft is deploying — and when
Microsoft has scheduled two distinct deadlines around passkeys and passwordless authentication. Confusing them is the main source of error among administrators trying to regain control.
- September 1st: automatic activation of passkeys and display of prompts ("nudges") to end users, across all eligible tenants.
- February 1st, 2027: definitive retirement of SMS authentication (SMS OTP). This date applies to all tenants, without exception.
Do not confuse the two deadlines
The opt-out described in this article only delays the automatic activation in September. It has no effect on SMS retirement on February 1st, 2027. Plan now for the migration of your users who rely on this method.
What the opt-out does — and what it does not do
The opt-out available via Microsoft Graph Beta allows an administrator to request that Microsoft not automatically enable passkeys on their tenant in September. Specifically:
- ✅ Prevents auto-activation of passkeys on September 1st
- ✅ Removes user prompts related to this rollout wave
- ❌ Does not block SMS retirement in February 2027
- ❌ Is not a permanent solution
It is a window of reprieve to organize your deployment at your own pace — not an off-ramp.
Endpoint in beta
The command relies on the /beta endpoint of Microsoft Graph. This endpoint was active as of August 1st at the time of its initial documentation. Its behavior may evolve when transitioning to general availability (GA).
Prerequisites before executing the command
Before running the script, verify the following:
- You have an account with the Authentication Policy Administrator or Global Administrator role on the target tenant.
- The Microsoft.Graph (or Microsoft.Graph.Beta) module is installed in your PowerShell environment.
- You are running PowerShell as an administrator.
- You have access to the tenant you wish to configure.
To install the module if not already done:
1Install-Module Microsoft.Graph -Scope CurrentUser -ForceProcedure: opt-out via PowerShell
Connect to Microsoft Graph
Launch PowerShell as an administrator, then authenticate to your Microsoft 365 tenant with the required rights.
1Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"A login window opens. Enter your administrator credentials and grant the requested permissions.
Apply the opt-out on the tenant
Execute the following command to disable the auto-activation of passkeys planned for September. This command targets the /beta endpoint of Microsoft Graph.
1$body = @{2 passkeyEnabled = $false3 excludeTargets = @()4} | ConvertTo-Json -Depth 55 6Invoke-MgGraphRequest -Method PATCH `7 -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2" `8 -Body $body `9 -ContentType "application/json"Verify that the configuration is properly applied
Query the endpoint to confirm that the value has been properly taken into account.
1Invoke-MgGraphRequest -Method GET `2 -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2"Verify in the output that state indicates disabled or that passkeyEnabled is indeed set to false depending on the response returned by the endpoint at the time of your execution.
Validation via the portal
You can also confirm the status in the Microsoft Entra portal: Protection > Authentication methods > FIDO2 security key. If the method appears as disabled for your tenant, the opt-out is active.
What you must prepare in parallel
The opt-out buys time. This time must be used to structure your strong authentication strategy. Here are the priority areas:
- Inventory SMS users: identify in Microsoft Entra ID the accounts that use SMS as their only MFA method. These are your at-risk accounts for February 2027.
- Pilot passkeys: deploy passkeys to a pilot group before global deployment. FIDO2 keys and the Microsoft Authenticator application (passkey version) are the two main vectors.
- Test legacy applications: some older applications or ADFS authentication flows may require adjustments before migration.
- Train users: passkey adoption rarely fails on the technical side. It fails on change management.
Non-negotiable deadline
The retirement of SMS on February 1st, 2027 contains no known opt-out options at this time. Any account still dependent on SMS OTP at that date will lose this authentication method without further notice.
Key points to remember
- The auto-activation of passkeys in September can be blocked via a call to the Microsoft Graph Beta API.
- The retirement of SMS OTP on February 1st, 2027 is permanent and applies to all tenants.
- The command requires a minimum of Authentication Policy Administrator role and the Microsoft.Graph module.
- The endpoint used is in beta: verify its stability at the time of production execution.
- The opt-out is a temporary measure — not a strategy. Migration to passkeys or another SMS-free method remains essential.
