Microsoft announced in July 2026 that passkeys would become the default authentication experience in Microsoft Entra ID as the company continued rolling out the change from September.
Passkeys are designed to resist phishing because authentication is tied to the legitimate service and device rather than relying on a reusable password that can simply be typed into a fake website.
That is a meaningful change in how people sign in.
It also creates an important education problem: users need to understand that a passkey prompt appearing inside a scam is still a scam.
The technology can protect the authentication process, but social engineering can still trick users into interacting with an attacker-controlled process.
For users, the practical lesson is to learn what legitimate passkey prompts look like on the services you use.
If a stranger tells you that you need to register a passkey immediately, stop and verify the request.
Strong authentication works best when combined with strong verification habits.