Microsoft Entra ID SMS and Voice Authentication Retirement: How to Prepare Your Business
Microsoft is retiring its built-in SMS and voice authentication services on February 1, 2027. Businesses should review their Microsoft 365 authentication settings now to prepare for this change.
Employees who use text messages or phone calls to verify Microsoft 365 sign-ins will need another authentication method before the deadline.
Microsoft is also making passkeys the default authentication experience for users enabled for SMS or voice. While other MFA methods, including Microsoft Authenticator notifications, will continue working, administrators should verify which methods employees have available.
Here's what is changing and what your IT administrator should do.
What's Changing?
Microsoft has announced the following timeline:
Date | Change |
September 1, 2026 | Microsoft began automatically enabling passkeys for users enabled for SMS or voice MFA and prompting them to register. |
February 1, 2027 | Microsoft-provided SMS and voice authentication will be retired for most users. |
July 1, 2027 | Retirement takes effect for Global Administrators and external users. |
After the applicable deadline, users whose only available MFA method is Microsoft-provided SMS or voice will be required to register a passkey before continuing to sign in.
Which Authentication Methods Will Still Work?
Microsoft is retiring its built-in SMS and voice delivery services, not all MFA methods.
Authentication method | Status after February 1, 2027 |
Microsoft Authenticator push notifications | Continues working |
Microsoft Authenticator verification codes (TOTP) | Continues working |
Passkeys in Microsoft Authenticator | Continues working; recommended |
Windows Hello for Business | Continues working; recommended |
FIDO2 security keys | Continues working; recommended |
Microsoft-provided SMS codes | Retired for most users |
Microsoft-provided voice calls | Retired for most users |
Important: Employees who already use Microsoft Authenticator push notifications can continue using them if permitted by their organization's policies.
However, Microsoft Authenticator notifications are not phishing-resistant. Microsoft recommends passkeys because they provide stronger protection against phishing and account compromise.
Users who remain enabled for SMS or voice may also receive prompts to register passkeys, even if they have another MFA method available.
Microsoft Entra ID SMS and Voice Authentication Retirement: What IT Administrators Should Do Before February 2027
Step 1: Identify Employees Using SMS or Voice Authentication
Sign in to the Microsoft Entra admin center.
Navigate to Entra ID > Authentication methods > Policies.
Review which users and groups are enabled for SMS and Voice call.
Use Microsoft's official PowerShell script to identify affected accounts, including legacy MFA configurations.
Goal: Identify employees who are enabled for SMS or voice, especially those who rely exclusively on these methods.
Step 2: Check Existing Authentication Methods
Before making changes, review which authentication methods employees already have registered.
Sign in to the Microsoft Entra admin center.
Navigate to Entra ID > Authentication methods > Activity.
Open Registration details to review users' registered authentication methods.
Identify employees who rely exclusively on SMS or voice and those who already have Microsoft Authenticator, passkeys, or other supported methods.
Confirm that replacement methods are permitted by your organization's authentication policies.
Employees using Microsoft Authenticator notifications can continue using them. However, administrators should verify that no employees still depend exclusively on Microsoft-provided SMS or voice authentication.
Microsoft documentation: Monitor authentication method registration and usage
Step 3: Enable and Deploy Passkeys
Microsoft recommends passkeys as the primary replacement for SMS and voice MFA.
To review your configuration:
Navigate to Entra ID > Authentication methods > Policies.
Select Passkey (FIDO2).
Verify that passkeys are enabled for the appropriate users.
Review Entra ID > Authentication methods > Registration campaign.
Test passkey registration and sign-in with a pilot group.
Since September 1, 2026, Microsoft has automatically enabled passkeys for users enabled for SMS or voice and included them in a Microsoft-managed registration campaign.
Enabling passkeys does not mean employees have completed registration. Administrators must verify that affected users have successfully registered and tested an approved authentication method.
Step 4: Inform Employees and Verify Readiness
Before the deadline:
Notify affected employees about the retirement of SMS and voice MFA.
Explain how to register and use the replacement authentication method.
Confirm that employees can successfully sign in.
Prepare account recovery procedures for users who lose access to their authentication devices.
Remove unnecessary SMS and voice dependencies once working alternatives are confirmed.
Pay particular attention to employees whose only available authentication method is SMS or voice.
What Happens If You Don't Prepare?
After the applicable retirement date:
Microsoft-provided SMS and voice authentication will no longer work.
Employees who rely exclusively on these methods will receive a mandatory passkey registration prompt.
Those employees must complete registration before continuing to sign in.
Microsoft Authenticator notifications and other supported authentication methods will remain available.
Microsoft is not disabling employee accounts or retiring the Microsoft Authenticator app. The change affects Microsoft-provided SMS and voice authentication.
How We Can Help
We help businesses strengthen Microsoft 365 security, protect their data, and reduce cybersecurity risks. Contact us to learn how we can help protect your business.
Comments