Sketchy behaviour from Microsoft on MFA - what gives?

Your concern is whether existing Authenticator/OATH users are being forced into passkeys after a tenant policy change. Microsoft's current SMS/voice retirement FAQ states that TOTP remains supported for existing and new registrations after February 1, 2027, subject to organizational policy. Users who register and use TOTP for MFA do not receive the blocking passkey prompt aimed at SMS/voice-only users.

The rollout scope checks whether users remain enabled for SMS or voice in authentication-method or legacy MFA policies. After testing their replacement method, remove unnecessary SMS/voice scope to prevent further nudges. Also review registration-campaign targeting and effective passkey profiles per tenant.

Synced passkeys remain phishing-resistant; their recovery and synchronization risks do not make them equivalent to phishable OTP codes. Device-bound profiles provide a different control when required.

I cannot establish why your explicitly Disabled campaign changed without tenant audit evidence. Preserve before/after policy exports and change timestamps for Microsoft support.