CIAM at mid-year 2026: passkeys as default, agents as identities, and the B2C hangover

What changed in eight months

Four things that were still roadmap language in late 2025 are now on the shortlist questions a serious CIAM buyer asks in the first meeting.

Passkeys stopped being optional. W3C proposed WebAuthn Level 3 as a Recommendation on 20 July 2026. PRF, related origins, the Signal API, and conditional create are in browsers ahead of the document. Microsoft will auto-enable passkeys for Entra ID users still on SMS or voice from 1 September 2026. The remaining CIAM question is orchestration quality, not protocol support. See the passkey orchestration ranking and the Level 3 guide.

Agent identity became a product. Auth0 for AI Agents went GA in November 2025. Auth for MCP followed on 6 May 2026. Stytch, now inside Twilio, is pitching agent identity as the reason the deal happened. WorkOS is publishing MCP step-up patterns. Descope already treated MCP as a first-class surface. If a vendor's 2026 pitch is still "we have OAuth," they are late.

SMS OTP is leaving the serious bar. NIST SP 800-63-4 already pushed SMS outside AAL2. Entra's SMS/voice retirement path makes that a calendar event, not a white paper. Recovery design is now the passkey rollout's hard part, not registration.

Heritage B2C is consolidating, not vanishing. Azure AD B2C P2 retired on 15 March 2026. Remaining B2C tenants are supported until at least May 2030, frozen. Akamai Identity Cloud is sunsetting. ForgeRock remains a Ping product line with a confused new-logo story. Twilio closed Stytch on 14 November 2025. Greenfield buyers land in the developer-first tier. Installed-base buyers have a migration, not a refresh.

Deepak's take

The 2025 annual report was about agentic identity arriving and passkeys tipping. Mid-2026 is the year those two become table stakes and the differentiator moves to recovery, related-origin messy domains, and whether agent tokens are a product or a blog post.

I would not buy a CIAM in 2026 that cannot show: device-aware passkey prompting, a recovery story that is not "email magic link," and a documented agent-vs-human token split. Everything else is packaging.

The mistake I still see: treating Entra External ID, Auth0, and WorkOS as interchangeable. They are not. Microsoft-shop plus compliance is Entra. Mixed B2C/B2B with DX is Auth0 until the bill hurts. Pure B2B SSO/SCIM is WorkOS. Passkey-first consumer is Stytch or Descope. Self-host is FusionAuth or Keycloak. That map has been stable for two years. The new axis is agents.

What to do

• Re-run the vendor selector if your last shortlist is older than Q1 2026. Stytch is a Twilio product. Auth0 has an agent SKU. B2C-on-Azure is a migration program.
• If you still recover passkey accounts with email magic links, read account recovery design. You have an email-secured system.
• If "Okta" is on the RFP, start at Okta CIAM vs Auth0 vs Workforce. Those are two products.

The 2025 yearbook remains at the annual report. This brief is the 2026 overlay.