Microsoft Entra ID Passkey Dynamic Migration Opt-Out

PowerShell script to check and configure the temporary opt-out from Microsoft's automatic passkey enablement and Registration Campaign rollout in Microsoft Entra ID.

The script uses Microsoft Graph and the passkeyDynamicMigration opt-out setting documented by Microsoft.

What does this script do?

The script:

1. Checks whether there is an active Microsoft Graph connection.
2. Connects to Microsoft Graph if required.
3. Verifies that the required Microsoft Graph permission is available.
4. Reads the current Microsoft Entra Authentication Methods Policy.
5. Checks the current value of passkeyDynamicMigration.
6. Applies the opt-out only if it is not already enabled.
7. Verifies the configuration after making the change.

The script is idempotent, so running it multiple times will not repeatedly modify the policy once the opt-out is already enabled.

Requirements

PowerShell

The script requires PowerShell with the Microsoft Graph PowerShell SDK installed.

If the Microsoft Graph PowerShell SDK is not installed, it can be installed with:

Install-Module Microsoft.Graph -Scope CurrentUser

Microsoft Graph permission

The following delegated Microsoft Graph permission is required:

Policy.ReadWrite.AuthenticationMethod

The script requests this permission when establishing the Microsoft Graph connection.

Microsoft Graph endpoint

The script uses the Microsoft Graph beta endpoint documented by Microsoft:

https://graph.microsoft.com/beta/policies/authenticationmethodspolicy

Usage

Check the current configuration

Use -CheckOnly to inspect the current configuration without making any changes:

.\Set-EntraPasskeyOptOut.ps1 -CheckOnly

The script reports whether passkeyDynamicMigration is currently enabled.

Apply the opt-out

Run the script without parameters to check the current configuration and enable the opt-out if necessary:

.\Set-EntraPasskeyOptOut.ps1

If the opt-out is already enabled, the script will not make another PATCH request.

Example output

When the opt-out is already configured:

Microsoft Entra ID - Passkey Dynamic Migration Opt-Out
========================================================

Microsoft Graph connection detected.
Connected to Microsoft Graph.

Reading Authentication Methods Policy...

Current configuration:
  passkeyDynamicMigration: True
  Status: Opt-out already enabled

No changes required.
The passkey dynamic migration opt-out is already enabled.

When the opt-out needs to be configured:

Current configuration:
  passkeyDynamicMigration: False
  Status: Opt-out not enabled

Applying passkey dynamic migration opt-out...
Opt-out configuration applied successfully.

Verifying configuration...

Verification result:
  passkeyDynamicMigration: True

SUCCESS: Passkey dynamic migration opt-out is enabled.

Configuration

The script configures the following Microsoft Graph property:

{
    "optOutSettings": {
        "passkeyDynamicMigration": true
    }
}

This is applied to the tenant's Authentication Methods Policy.

Check-only mode

The -CheckOnly parameter is useful when the script is being used as part of an assessment, validation or change-management process.

For example:

.\Set-EntraPasskeyOptOut.ps1 -CheckOnly

In this mode, the script:

• Connects to Microsoft Graph if required.
• Reads the current policy.
• Reports the current value.
• Does not modify the tenant configuration.

Important considerations

This setting is a temporary opt-out from Microsoft's automatic passkey enablement and Registration Campaign rollout.

It should not be treated as a permanent opt-out from the move away from Microsoft-provided SMS and voice authentication.

Microsoft's documented timeline provides a temporary opt-out period from September 1, 2026 until February 1, 2027.

Organizations using the opt-out should therefore use the additional time to review their authentication methods and plan the migration of affected users.

The opt-out is configured at the tenant level, not on a per-user basis.

Security considerations

The script requests the delegated Microsoft Graph permission:

Policy.ReadWrite.AuthenticationMethod

This is a privileged permission because it allows the script to modify authentication method policy settings.

For production use, review the permissions and execution context according to your organization's change-management and privileged-access requirements.

The script does not store credentials, access tokens or authentication information.

Related Microsoft documentation

Microsoft Learn:

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
• Temporarily opt out of the automatic passkey enablement

Disclaimer

This script is provided as a practical example for Microsoft Entra ID administration.

Always test changes in a controlled environment before applying them to production tenants and verify the current Microsoft documentation before using the script, particularly because the configuration uses a Microsoft Graph beta endpoint.

License

This project is licensed under the MIT License.

You are free to use, modify, and redistribute this script, including for commercial purposes.

Attribution to the original author and a link to the original repository are appreciated, but not required.

Copyright (c) 2026 Sergio Gómez (Shellgio)