ST-2026-083 · Authentication & identity
Microsoft documents a temporary beta API to defer Entra passkey auto-enablement
Microsoft documents a Microsoft Graph beta request that temporarily excludes public-cloud tenants from automatic passkey enablement and the registration campaign between 1 September 2026 and 1 February 2027.
Previous state
Before 1 September 2026, the automatic passkey enablement and registration-campaign change had not taken effect, and earlier guidance did not expose this exact opt-out request contract.
Current state
Public-cloud tenants can PATCH /beta/policies/authenticationmethodspolicy with optOutSettings.passkeyDynamicMigration set to true to defer automatic passkey enablement and the registration campaign until 1 February 2027. The setting does not defer the final enforcement after that date.
Affected users
Who needs to care
Microsoft Entra public-cloud tenants with users enabled for Microsoft-managed SMS or voice authentication who need additional transition time.
Required response
What to do
Use the beta request only after testing and appropriate approval, confirm Policy.ReadWrite.AuthenticationMethod permissions and an Authentication Policy Administrator or equivalent role, and complete migration before 1 February 2027.
Evidence boundary
What the source does not prove
The request is documented on the Microsoft Graph beta channel and is not a production-supported v1.0 contract. The stated timeline applies to public cloud only; other cloud environments follow a later schedule. There is no opt-out after 1 February 2027.
Lifecycle history
Dated event sequence
- Beta opt-out contract documented
Microsoft Learn published the endpoint, property and bounded deferral behaviour.
- Automatic passkey enablement begins
In-scope SMS and voice users are auto-enabled for passkeys and brought into the registration campaign unless the temporary opt-out is applied.
- Opt-out expires
Standard migration and enforcement apply regardless of the temporary setting, with no further opt-out.
Evidence ledger
First-party sources
- 01Microsoft Learn — Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Official product documentation · 2026-07-29
Open official source ↗ - 02Microsoft Graph documentation — Update authenticationMethodsPolicy
Official API reference · 2026-07-29
Open official source ↗