System-Preferred Authentication and September 1st Passkey Change

📢A Quick PSA

It’s not news now that Microsoft is rolling out Passkeys as default authentication by deprecating SMS. Yes, you can still use SMS post deprecation provided if you have your own telecom provider to handle the SMS messages and obviously that comes with a pay.

👉🏼What Do We Know?

• Microsoft has mentioned the official roadmap of removing SMS from Entra ID as an Authentication Method.
• They have outlined what they will perform and the end user nudge.
• They have outlined the controlled Passkey rollout if you need to start the work now without waiting.
  So, you run the registration campaign, user gets the nudge, they register the Passkey.

‼️Awareness and Comms

Sure, you have seen this, after the Passkey registration and from the next login onwards user will be prompted to use the Passkey but not the previously used methods. This will override the MS Authenticator method even if that’s setup as the default and can be legit user impact if they don’t know what to do next.

‼️Why Is This Happening?

System-preferred Authentication determines what method to prompt to complete the authentication request.
This has 3 states – Microsoft Managed, Enabled, Disabled

🚧Microsoft managed – Will push the most secure method as the 1st factor to complete the authentication. AKA Passkey will be presented by default once the user registered for one. This overrides MS Authenticator.
🚧Enabled – Will push the most secure method as the 2nd factor
🚧Disabled – Will go back to the user default.

User’s Authentication methods in Entra ID

💡Users can still cancel the Passkey mode, select sign in from another method and select previously registered method (ie: MS Authenticator)

You can scope MS Managed and Enabled behaviors to All Users or selected group. Users who are not in the group will go back to the user default method.

In Closing

🚩Do your PILOT rollout
🚩Understand the authentication method behaviour
🚩User awareness and comms
🚩Complete rollout before 1 Sep or prepare for the change