Microsoft Passkey Enablement Opt Out: A PowerShell Script for Entra ID Tenant Admins

Microsoft is about to make a change inside your tenant that many Northeast Ohio IT teams will not see coming. Starting September 1, Microsoft is rolling out automatic passkey enablement for Microsoft Entra ID (Azure AD) tenants. The change is tied to the broader retirement and change of SMS and voice MFA, and it can alter how your users sign in without anyone on your team pressing a button.

We built a small PowerShell script to give tenant admins a clear choice: check the current state of your tenant, and opt out of the automatic passkey migration before it lands on your users. Here is what the change means, why it matters, and exactly how to use the script.

What Microsoft is changing on September 1

Microsoft has been clear about the direction: SMS and voice call MFA are being retired or changed as primary verification methods. You can read the official guidance in Microsoft's SMS and voice retirement documentation:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

The replacement path pushes organizations toward phish-resistant methods, including passkeys and Microsoft Authenticator. Passkeys are stronger than a one-time SMS code, and that is a good thing for security. Phishing-resistant authentication removes the reusable code or password that attackers can steal, which is why the industry is moving in this direction.

The challenge for tenant admins is not the technology itself. The challenge is the word automatic. As part of this rollout, Microsoft is automatically enabling passkeys in Microsoft Entra ID (Azure AD) tenants. That means a tenant can be migrated or enabled for passkeys without an admin explicitly turning the feature on. For many organizations, the first warning sign will be a user asking why their sign-in screen changed.

Why a silent authentication change creates problems

Authentication is one of the few areas of IT where surprise is rarely welcome. When Microsoft silently changes sign-in behavior, three predictable problems follow.

First, help desk tickets spike. A production worker in a Cleveland manufacturing plant who has never seen a passkey prompt does not know whether to approve it, deny it, or call IT. That call is a good security instinct, but it is still an interruption during a shift.

Second, users confuse legitimate prompts with phishing. Many Northeast Ohio organizations train employees to treat unexpected login screens as a red flag. A surprise passkey prompt can look exactly like the attack those trainings warn about.

Third, security and compliance reviews get blindsided. Healthcare teams answer to HIPAA, financial services teams answer to regulators, and professional services firms answer to their clients. An unplanned change to authentication methods can raise questions about access controls, documentation, and change management that nobody scheduled time to answer.

Here is how that lands across the industries we serve:

• Manufacturing: shift workers and plant-floor devices need predictable sign-in, not a new prompt at 6 a.m.
• Healthcare: HIPAA compliance depends on controlled, documented access changes, not surprises.
• Higher education: students and faculty sign in from many devices, which makes unexpected authentication changes noisy.
• Professional services: law, accounting, and consulting firms handle confidential client data and need stable, explainable sign-in flows.
• Financial services: auditors and examiners expect change management discipline around authentication.

Our view at Local Network Solutions is simple: proactive beats reactive. The time to decide whether your tenant should be opted in or out is before September 1, not after your users are already seeing the prompts.

What our PowerShell script does

We put together a PowerShell script for tenant admins that flips the opt-out setting so your tenant is not automatically migrated or enabled for passkeys.

The script applies this exact setting:

` "optOutSettings": "passkeyDynamicMigration": true `

That is the opt-out flag that tells Microsoft not to auto-migrate or enable passkeys in the tenant. The script is hosted here:

https://pastebin.com/RMPAC7k6

We kept the script narrow on purpose. It has three things admins need to know about:

• A -ReportOnly flag that checks whether the setting is already enabled without making changes. Run this first.
• A -TenantId contoso.onmicrosoft.com parameter that lets you target a specific tenant when you manage more than one.
• Important notes at the top of the script that admins must read before running anything.

We deliberately did not add extra settings, cmdlets, or capabilities beyond this scope. The script does one job: give you visibility and control over the passkey dynamic migration opt-out.

Opting out does not mean rejecting passkeys forever. It means choosing the timing. Many of the teams we work with want to roll out passkeys deliberately: test with a pilot group, update user training, notify the help desk, and align the change with an audit or compliance cycle. The opt-out setting gives you that runway.

How to use the script

Treat this like any tenant-level authentication change. Go slow, verify state, and document what you did.

1. Read the notes at the top of the script first. They cover prerequisites, permissions, and what the script will and will not do.
2. Run the script with the -ReportOnly flag first. This tells you whether "optOutSettings": "passkeyDynamicMigration": true is already in place, so you understand your current state before you change anything.
3. If you manage multiple tenants, use the -TenantId parameter to target the correct one. For example: -TenantId contoso.onmicrosoft.com.
4. After you review the report, run the script to apply the opt-out setting.
5. Verify the change in your tenant and record it for your audit trail and compliance documentation.

A quick reminder: this is an administrative control. Make sure you are running it with the right permissions and against the right tenant, especially in delegated or multi-tenant scenarios.

Where this fits in a zero gaps approach

This is the kind of change that exposes fragmented IT. When one vendor manages the firewall, another handles Microsoft 365 licensing, and a third is on call for support, nobody owns the authentication roadmap. The result is a gap, and the September 1 rollout is exactly the kind of silent change that slips through it.

Our approach is different. Local Network Solutions is an independent, locally owned Northeast Ohio company, and we cover all six critical IT pillars under one roof and one SLA: WAN connectivity, cybersecurity, network infrastructure, IT infrastructure, UPS backup, and backup and disaster recovery. We have served Northeast Ohio for more than 10 years and protect more than 500 businesses with 24/7 monitoring and support.

That unified view matters for a change like this. The same team that watches your firewalls, your backups, and your identity settings can catch the Microsoft rollout before it becomes a Monday morning surprise for your users. We serve Cleveland, Akron, Canton, Youngstown, and all of Northeast Ohio.

Schedule Your Consultation Before September 1

If you want us to review your tenant's authentication settings, run the opt-out across your environment, or build a documented plan before the passkey rollout, we can help.

Schedule Your Consultation today. Email us at hello@localnetworksolutions.com or call (216) 658-6988, and we will make sure the September 1 change does not catch your organization off guard.