Microsoft has drawn a line in the sand: after February 1, 2027, its Entra ID identity platform will no longer provide SMS or voice call verification for multi-factor authentication. Organizations that haven't migrated users to phishing-resistant passkeys by that date risk seeing those users blocked from signing in entirely. The move, announced in a Microsoft Learn advisory, gives IT administrators just under two years to get off one of the least secure authentication methods still in wide use.
A Two-Phase Countdown
The retirement follows a two-phase schedule. Starting September 1, 2026, passkeys become the default authentication experience. Users who are still enabled for SMS or voice will be automatically opted into passkey support, and a Microsoft-managed registration campaign will prompt them to set up a passkey the next time they sign in and complete MFA. These nudges can be snoozed indefinitely—for now.
Then comes the hard deadline. On February 1, 2027, Microsoft-provided SMS and voice delivery is retired across Entra ID. From that moment, any user whose only available MFA method is SMS or voice will be forced to register a passkey during sign-in before they can access their account. The prompt is blocking, and there is no opt-out. Tenants that have configured customer-managed telecom providers through the Microsoft Security Store can continue using SMS or voice, but Microsoft’s own delivery stops.
A temporary opt-out mechanism will let organizations delay the September 2026 changes if they’re still planning a migration or evaluating a custom telecom provider. That window runs from August 1, 2026, until February 1, 2027. After that, the blocking prompt applies to every tenant—no exceptions.
Why This Matters: SMS Is a Security Liability
SMS-based two-factor authentication has been on borrowed time for years. Sim-swapping attacks, social engineering, and the mundane reality that text messages travel over insecure channels make it one of the weakest MFA options available. Microsoft’s own advisory put it bluntly: “SMS and voice are among the most vulnerable authentication methods available today and provide significantly weaker protection against phishing and account compromise than passkeys.”
This is about more than a single technology swap. It’s the culmination of an industry-wide pivot toward phishing-resistant credentials. Passkeys, built on FIDO2 standards, use cryptographic key pairs instead of shared secrets. They’re immune to phishing because the credential is bound to the original website or app and can’t be tricked into giving away a one-time code. Microsoft has already been steering consumer accounts away from SMS; the Entra ID change signals that enterprise identity must follow.
Whose Problem Is This? (Spoiler: Probably Yours)
If your organization uses Entra ID (formerly Azure AD) and any of your users rely on SMS or voice for MFA, you’re in scope. That includes not only the obvious—remote workers who never set up the Authenticator app—but also privileged accounts, emergency access accounts, and users on shared devices who often fall back to a phone call. Microsoft’s own documentation warns that simply ignoring the deadline will not work: on February 1, 2027, “users whose only available MFA method is SMS or voice will be required to register a passkey during sign-in to continue accessing their account.”
The impact extends beyond MFA. Self-service password reset (SSPR) via SMS or voice also goes away with the native delivery retirement. Users who forget their password and only have a phone method registered will be unable to reset it without administrator help—or a configured customer-managed telecom provider.
To find out how many users are affected, Microsoft provides a PowerShell script (requiring global reader, authentication policy administrator, or security reader roles). Even a single user still dependent on SMS or voice means you have work ahead.
The Replacement Menu: Choosing a Phish-Resistant Path
Microsoft recommends passkeys as the primary replacement, and Entra ID supports several flavors:
- Synced passkeys: stored in a platform credential manager (iCloud Keychain, Google Password Manager) and synced across devices. These suit users who already rely on such managers and need portability.
- Device-bound passkeys: passkey in Microsoft Authenticator, Entra passkey on Windows, or a physical FIDO2 security key. These offer stronger control over where credentials reside.
- Windows Hello for Business: a biometric-based credential on managed Windows devices, already popular in many enterprises.
The right choice depends on your workforce. A privileged administrator might need a physical security key; a frontline worker on a shared terminal might need something else entirely. There is no universal answer, but the guiding principle is the same: replace something phishable with something that isn’t.
Microsoft will also offer a fallback for organizations that genuinely cannot eliminate SMS or voice—for example, if a regulation mandates an out-of-band telecom channel or a certain user segment cannot use any passkey option. Starting September 18, 2026, customers can review telecom providers in the Microsoft Security Store, and from October 30, 2026, they can configure their own carrier. This is not a free pass: it involves negotiating contracts, regional coverage, and per-message costs. Microsoft explicitly says this should be the exception, not the default.
Concrete Steps to Take Right Now
The timeline may feel distant, but the migration touches authentication, device management, communication, and help desk readiness. Procrastination guarantees a scramble.
1. Know Your Exposure
Run the PowerShell inventory to find every user enabled for or registered with SMS or voice. Go beyond the current authentication methods policy—check legacy MFA settings and any conditional access rules that might silently rely on phone delivery. Map out privileged accounts, emergency access, contractors, and infrequently logging-in users; they are often the most dangerous to overlook.
2. Pick Your Replacement and Pilot Early
Choose a target credential for each user persona. Enable passkeys in your tenant now, not in 2026. Run a pilot with a diverse group: an admin, a mobile worker, a shared-device user, someone who’s never used anything but SMS. Test everything: enrollment, normal sign-in, sign-in on a second device, credential loss and recovery. If recovery still falls back to a phone call, the project isn’t done.
3. Launch a Registration Campaign
Microsoft’s registration campaign is the most efficient way to move users at scale. You can start one before the auto-enablement date. Configure it in the Entra admin center, target your SMS/Voice user group, and track progress. Provide users with clear, simple instructions for their device type. A phased communication plan—awareness, action, reminder—reduces help desk calls.
4. Test Recovery and Break-Glass Scenarios
A passkey rollout is incomplete until you’ve simulated losing the credential. For every persona, register a second phishing-resistant method and document how they get back in after a device swap or security key loss. For emergency access accounts, design a procedure that doesn’t depend on a single person’s phone.
5. Decide If You Need a Telecom Provider
If genuine regulatory or operational constraints exist, start paperwork early. Identify the specific requirement, the user segment, and the intended provider. Treat it as a temporary exception with a built-in review date, not a permanent escape hatch.
The Sticking Point: No Opt-Out, Blocking Registration
The February 2027 cutoff is not a friendly reminder. A user who shows up that Monday morning with only a phone method registered will see a screen that won’t let them proceed without setting up a passkey. If their device doesn’t support passkeys, or if they’re confused by the prompt, they’ll be calling the help desk—or locked out.
This is why piloting and communication are not optional. The blocking prompt is universal; even if you have a telecom provider configured, users who still have Microsoft-managed SMS/voice as their only method will hit the wall. The only prevention is migration.
After the Deadline: What to Watch
Once February 2, 2027, arrives, the authentication landscape inside Entra ID will look fundamentally different. Passkeys will be the norm, and organizations that embraced the change will have drastically reduced their phishing surface. Microsoft is likely to extend similar policies to other cloud environments—the current timeline applies only to public cloud, but the writing is on the wall.
In the nearer term, September 18, 2026, will be a key date: that’s when telecom provider details drop. For organizations clinging to SMS, it will be a moment to decide whether the cost and complexity are worth it—or whether it’s finally time to step into a passwordless future.