Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

Microsoft sent us an email and has a blog post where they say

To address these evolving threats, Microsoft Entra ID is updating its authentication experience by making passkeys the default phishing-resistant authentication method, helping customers reduce reliance on phishable methods such as SMS and voice.

I asked Gemini at aistudio.google.com, "How do I Identify users who still use SMS or voice in portal.azure.com?"

Gemini suggested

1. Method 1 - The Authentication Methods Activity Dashboard in Azure portal -  portal.azure.com > Microsoft Entra ID > Security > Authentication methods > Monitoring > Activity, "Click the Usage tab to see a high-level visual chart of which authentication methods are actually being used to sign in across your tenant"
2. Method 2 - Export a Report using Microsoft Graph PowerShell
3. Method 3: Check Actual Usage via Sign-in Logs - portal.azure.com > Microsoft Entra ID > Sign in logs, look at the Authentication Details tab

I asked Gemini,

I get the message "Migrate to the converged Authentication methods policy"

"Please migrate your authentication methods off the legacy MFA and SSPR policies by September 2025 to avoid any service impact."

What does that mean, and how do I do it?

Gemini replied, 

What does this mean?

Historically, Microsoft Entra ID (formerly Azure AD) had two separate, disconnected portals for managing how users prove their identity:

1.  The Legacy MFA Portal: Used to control methods for Multi-Factor

    Authentication (MFA).

2.  The SSPR Portal: Used to control methods for Self-Service Password Reset

    (SSPR).

Because managing these in two different places was confusing, Microsoft created a unified "Authentication methods policy." This new policy is a single, converged dashboard where you manage all authentication methods (Microsoft Authenticator, SMS, Voice, FIDO2, Passkeys, etc.) for both MFA and Password Resets.

Microsoft is retiring the old legacy portals by September 30, 2025. The message you are seeing is a warning that your tenant is still relying on the old legacy settings, and you need to manually flip a switch to tell Microsoft to use the new modern policy instead.

If you don't do this before the deadline, you risk service disruption (users

might not be able to register or use their MFA/SSPR methods properly) once

Microsoft turns off the old portals.

How do I do the migration?

Migrating doesn't mean your users have to set up their MFA again; it simply

means you, as the administrator, are changing where the rules are managed.

Here is the step-by-step process to migrate safely:

Step 1: Audit your existing legacy settings

Before you switch over, you need to see what methods you currently allow so you

can match them in the new portal.

1.  Sign in to the Microsoft Entra admin center as a Global Administrator or

    Authentication Policy Administrator.

2.  Check your Legacy SSPR Settings: Go to Protection > Password reset >

    Authentication methods. Note which boxes are checked (e.g., Mobile app code,

    Email, Mobile phone).

3.  Check your Legacy MFA Settings: Go to Users > All users > Click Per-user MFA

    at the top. On the new page, click service settings at the top. Note which

    verification options are checked (e.g., Text message, Call, Notification).

Step 2: Configure the new Converged Policy

Now, you must replicate those allowed settings in the new unified portal.

1.  In the Entra admin center, go to Protection > Authentication methods >

    Policies.

2.  You will see a list of methods (Microsoft Authenticator, SMS, Voice call,

    FIDO2 security key, etc.).

3.  Click into each method you want to allow (based on your notes from Step 1).

4.  Toggle the Enable switch to Yes, set the Target to All users (or specific

    groups), and hit Save. (Note: It is highly recommended to enable Microsoft

    Authenticator and Temporary Access Pass, as Microsoft is pushing toward

    modern/phishing-resistant methods).

Step 3: Change the Migration State

Once your new policy matches your old settings, you are ready to flip the

switch.

1.  Still in Protection > Authentication methods > Policies, look near the top

    of the page for a banner or a button labeled Manage migration.

2.  A flyout menu will appear on the right side of your screen with three

    options:

      - Pre-migration: (Where you are currently) - Only legacy policies are

        respected.

      - Migration in progress: - Both policies are respected, but the new

        converged policy is evaluated first.

      - Migration Complete: - The legacy policies are completely ignored, and

        only the new converged policy is used.

3.  Select Migration in progress and click Save.

4.  Take a few days to ensure your users can still sign in, use MFA, and reset

    their passwords without issue.

5.  Once you confirm everything works, go back to the Manage migration menu,

    select Migration Complete, and click Save.

That's it! Once you hit "Migration Complete," the warning message in your portal

will disappear, your tenant will be fully modernized, and you will be safe from

the September 2025 deprecation deadline.

It was in the Migration in progress state. And all the methods are shown as not enabled. I asked Gemini if I should enable them.

Gemini said, Yes, absolutely. Because you are in the Migration in progress state, Microsoft is currently looking at both your old legacy settings and the new portal. If a method is turned on in either place, your users can use it.

Here is a screenshot of the authentication methods page, after I enabled some of them. 

I'm detailing the creation and use of passkeys on Linux / Android in another post.