Move users to Entra ID passkeys before SMS and voice retirement

Microsoft has again told Entra ID administrators to move users off SMS and voice authentication and onto phishing-resistant methods, because it will stop offering Microsoft-provided SMS and voice delivery on February 1, 2027, according to BleepingComputer. The company is urging admins to switch workforce tenants to passkeys, QR code authentication, FIDO2 security keys, or other Entra ID supported sign-in methods to avoid login interruptions.

What Microsoft is changing and who is affected

The retirement affects Microsoft Entra ID workforce tenant authentication scenarios only. It does not apply to Azure AD B2C or Microsoft Entra External ID customer identity scenarios, the report says. Microsoft will no longer offer SMS and voice as a native Entra capability after February 1, 2027, so users who depend on those methods for multifactor authentication will not be able to complete MFA with them unless their organization takes other steps.

Passkeys are being promoted as the preferred alternative. As BleepingComputer notes, Microsoft advised admins that "Microsoft recommends passkeys" for stronger, phishing-resistant protection. Admins may also migrate users to QR code authentication, FIDO2 security keys, or other supported sign-in methods.

How the rollout and retirement will work

Microsoft has already moved toward making passkeys the default experience for Entra ID. The company announced a rollout that will enable passkeys as the default authentication experience for Entra ID enterprise tenants, and when the rollout reaches an organization, users who were enabled for SMS or voice will automatically be enabled for passkeys and prompted to register one the next time they perform multifactor authentication, the report says.

Because the retirement only covers Microsoft-provided telecom delivery, organizations that must continue to use phone-based authentication can keep that capability by configuring a customer-managed telecom provider, sometimes called CYOT, through the Microsoft Security Store. Microsoft previously disabled SMS first-factor sign-in for Microsoft Entra ID Free tenants in August, citing phishing, fraud, and account compromise risks.

Why this matters for small organizations and public sector teams

If your organization uses Entra ID for workforce authentication and still relies on SMS or voice for MFA, you could face interrupted sign-ins when Microsoft retires its telecom delivery. The technical change is about how second factors reach users, but the practical effect is that users who cannot complete MFA with SMS or voice will be blocked from logging in unless they have another approved method.

BleepingComputer also notes that Microsoft considers SMS and voice vulnerable to phishing and SIM-swap attacks, which is the core security rationale behind the move. For organizations that have already experienced account recovery or fraud tied to phone-based factors, this is an opportunity to reduce that exposure by switching to phishing-resistant methods.

Practical steps for your organization

• Inventory who is still using SMS or voice for Entra ID MFA. According to the report, admins with the Authentication Policy Administrator, Global Reader, or Security Reader roles can run the Entra SMS/Voice Policy Scanner PowerShell script to find those users.
• Plan to migrate users to passkeys, QR code authentication, FIDO2 security keys, or other supported sign-in methods before the February 1, 2027 retirement date to avoid sign-in interruptions.
• If your operations require phone-based authentication, evaluate and configure a customer-managed telecom provider through the Microsoft Security Store so you can retain phone delivery after Microsoft retires its own service.
• Communicate the change to users and schedule time for registrations. Microsoft says users enabled for SMS or voice will be prompted to register passkeys during their next MFA attempt as the passkeys rollout reaches each organization.
• Review who in your team can run the scanner script and who has the Authentication Policy Administrator, Global Reader, or Security Reader roles.

If you want a quick external check of how exposed your site or services are to common issues, start with a free external scan on our security page: /security.html.

Timeline and next steps to watch

Microsoft set a firm retirement date for Microsoft-provided SMS and voice delivery, February 1, 2027. The passkeys-as-default rollout was announced earlier, and as that rollout reaches organizations, SMS or voice users will be auto-enabled for passkeys and prompted to register. That means admins should not treat this as a distant change; work to identify and migrate affected users now.

Microsoft also provides a dedicated documentation page with deployment and management guidance for phishing-resistant, passwordless authentication in Entra ID, which admins should consult while planning their migration.

Where to read the original reporting

This summary is based on reporting by BleepingComputer. For the full details and original wording, see the BleepingComputer report.

If you need help planning a migration away from SMS and voice, or you want a quick external security scan to see how your public-facing services look, start with our free scan on the security page linked above.