Passkey Adoption Hits Inflection Point as UAE Bans SMS OTP and Microsoft Auto-Enables Entra Profiles
The UAE mandates all banks abandon SMS OTP by March 31 while Microsoft auto-enables passkey profiles across Entra ID, as FIDO Alliance data shows 87 percent of enterprises now deploying passkeys.
Overview
Two converging developments in March 2026 signal that passkey adoption has crossed from early-adopter enthusiasm into institutional mandate. The Central Bank of the UAE has imposed a March 31 deadline for all licensed financial institutions to eliminate SMS and email one-time passwords, making it the first country to outright ban OTP-based authentication in its banking sector. Simultaneously, Microsoft has begun auto-enabling passkey profiles across Entra ID tenants, shifting millions of enterprise accounts toward phishing-resistant credentials by default rather than by opt-in.
These moves arrive against a backdrop of accelerating global adoption. The FIDO Alliance’s latest data shows 15 billion online accounts now support passkeys, 87 percent of surveyed enterprises have deployed or are actively deploying them, and passkey logins achieve a 93 percent success rate compared to 63 percent for traditional methods.
The UAE’s OTP Ban
The Central Bank of the UAE issued Notice 2025/3057 in May 2025, directing all UAE-licensed banks, insurers, payment providers, and exchange houses to phase out SMS and email OTPs and static passwords for customer authentication. The compliance deadline of March 31, 2026 is now days away.
The directive recognizes four categories of compliant replacements: FIDO2 passkeys, in-app push approvals, biometric verification including the Emirates Face Recognition system, and hardware or software cryptographic tokens. All share one property that SMS OTPs lack: they are cryptographically bound to the user and the authenticating domain, making them resistant to phishing, SIM-swap, and SS7 protocol exploits.
The regulation also introduces a liability shift. Financial institutions are now responsible for reimbursing customers for fraud losses linked to OTP interception. If a code is captured during a phishing or SIM-swap attack, the bank bears the cost. This reversal of the traditional liability model gives institutions a direct financial incentive to migrate away from OTPs as fast as possible.
The UAE is the first country to impose such a sweeping mandate, but it will not be the last. India has set an April 2026 deadline for similar measures in its financial sector, and the Philippines is targeting June 2026.
Microsoft Shifts to Passkey-by-Default
Microsoft’s move takes a different path to the same destination. Beginning in March 2026, the company is auto-enabling passkey profiles in Entra ID, its cloud identity platform used by enterprises worldwide. Tenants that have not manually configured passkey policies will receive default configurations automatically applied to their accounts.
The rollout includes two capabilities reaching general availability. Passkey Profiles give administrators policy-based control over how passkeys are registered and enforced across users and groups. Synced Passkeys allow credentials to be securely synchronized across devices using supported password managers, including Apple iCloud Keychain, Google Password Manager, 1Password, and Bitwarden.
Previously, Entra ID supported only device-bound passkeys locked to a single device and unable to transfer across ecosystems. The synced option removes this constraint, addressing one of the most persistent adoption barriers: users changing devices or reinstalling operating systems. While synced passkeys are marginally weaker than device-bound passkeys from a strict security standpoint, they remain phishing-resistant and substantially more secure than SMS, OTP, or push-based methods vulnerable to adversary-in-the-middle attacks.
Microsoft is also shifting registration campaigns toward passkey enrollment rather than traditional MFA app setup, signaling that the company views passkeys not as an alternative to multi-factor authentication but as its successor.
The Numbers Behind the Shift
The FIDO Alliance’s 2025 Passkey Index documents the performance gap driving enterprise adoption. Passkeys achieve a 93 percent login success rate, compared to 63 percent for traditional authentication. Average login time drops from 31.2 seconds with conventional MFA to 8.5 seconds with passkeys, a 73 percent reduction. Organizations report 81 percent fewer sign-in-related help desk calls after deployment.
Individual platform data reinforces these findings. Google reports over 800 million accounts using passkeys, with 30 percent higher sign-in success rates and 20 percent faster logins than passwords alone. Amazon has 175 million passkey-enabled customers experiencing authentication six times faster than traditional methods.
Enterprise case studies show that implementation strategy matters as much as the underlying technology. eBay saw adoption jump 102 percent when it automatically prompted passkey enrollment after biometric verification, rather than burying the option in account settings. HubSpot reported a 25 percent improvement in login success rates and login times reduced to one-quarter of the password-plus-MFA duration after making passkeys the primary authentication option.
Expanding the Identity Perimeter
The push toward passkeys is part of a broader rethinking of digital identity infrastructure. The FIDO Alliance launched a Digital Credentials Working Group in late 2025 to extend its standards work beyond authentication into verifiable digital credentials and identity wallets, recognizing that proving who you are during login is only one piece of the identity puzzle.
New approaches to assuring digital identity are also emerging at the system level. Behavioral biometrics, which continuously monitor interaction patterns such as typing rhythm and device handling, are being layered on top of passkey authentication to detect account takeover even after initial login succeeds. The Coalition for Content Provenance and Authenticity is developing open standards for establishing content origin, extending identity verification from users to the artifacts they produce.
These developments reflect a consensus that static credentials of any kind, whether passwords or one-time codes, are insufficient for a threat landscape in which deepfakes, AI-generated social engineering, and credential-stuffing attacks operate at scale.
What Comes Next
The March 31 UAE deadline will serve as a real-world test of how quickly an entire financial sector can abandon a decades-old authentication method. The outcome will likely influence regulatory decisions in other jurisdictions weighing similar mandates.
Microsoft’s auto-enable approach answers a different question: whether making passkeys the default rather than the option is enough to drive enterprise adoption past the tipping point. The company’s installed base across Entra ID gives it the scale to shift industry norms through sheer inertia.
Gartner projects that passkeys will become the primary authentication method by 2027. The developments of March 2026 suggest that timeline may prove conservative.