On September 1, 2026, Microsoft auto-enables passkeys and flips your registration campaign to Microsoft-managed. There is a tenant-level opt-out — passkeyDynamicMigration — that delays it. Here’s what it actually buys you, why setting it safely needed a script rather than a one-line PATCH, and why February 1, 2027 is the date that can’t be postponed.
Microsoft is making passkeys the default sign-in and retiring native SMS and voice MFA. MC1426371 sets the clock: passkeys auto-enable September 1, 2026, and Microsoft-provided telecom delivery ends February 1, 2027. Here’s what changes on its own, what quietly changes underneath you, and the two decisions every MSP has to make before the dates arrive.
I went into the SC-900 confident. Working at an MSP, I use Entra and Defender every day. What I didn’t expect was how much the exam would reveal about the edges of what I actually knew.
I recently passed the Microsoft Applied Skills credential for Entra identities and access. This one stood out for a simple reason — it felt like real work.
A walkthrough of configuring a Conditional Access Policy in Microsoft Entra to require compliant devices when accessing sensitive data via Authentication Context.