Microsoft will begin making passkeys the default authentication method in Microsoft Entra ID from 1 September 2026, marking a major change in how organisations protect user accounts as AI-powered phishing and identity attacks continue to grow.