Microsoft has told Entra ID administrators to prepare for the retirement of Microsoft-provided SMS and voice authentication and to migrate users to passkeys before the change takes effect on February 1, 2027. The reminder, posted as Message Center notice MC1528000 on October 27, reinforces earlier guidance and covers Worldwide and Government Community Cloud tenants. Administrators are being encouraged not to wait until the retirement reaches their tenant before preparing affected users.
Why this change matters
SMS and voice authentication remain vulnerable to phishing and SIM-swap attacks, where attackers trick users into revealing one-time codes or hijack phone numbers to intercept authentication messages. Microsoft’s move reflects a broader industry shift away from phone-based second factors toward stronger, phishing-resistant approaches. For organizations dependent on phone-based sign-ins, failing to prepare could lead to avoidable sign-in disruptions for users whose only registered method is SMS or voice.
How passkeys work
Passkeys rely on public-key cryptography under the FIDO standards. The user’s authenticator — such as a device secure element or platform authenticator — keeps the private key, while the service stores only the public key. During sign-in, the authenticator signs a challenge after the user verifies themselves with a PIN or biometric. Because a passkey credential is bound to the originating website or application, it helps prevent credential theft through fake login pages.
What happens to different user types
- Users who already have another registered sign-in method will automatically use that method instead of SMS or voice. They will not be required to register a passkey simply to retain access.
- Users whose only registered method is SMS or voice can use that existing method one final time to verify their identity, but they will then be required to register a passkey to continue signing in going forward.
Action checklist for Entra ID administrators
- Identify phone-dependent accounts: inventory users who rely solely on Microsoft-provided SMS or voice for authentication and flag those without alternative registered methods.
- Prioritize high-risk and high-impact accounts: focus first on users who have privileged access or whose accounts would cause significant disruption if they lost access.
- Communicate early: notify employees and helpdesk teams about the incoming retirement, the registration steps for passkeys, and the timeline so support teams can handle expected inquiries.
- Provide guidance and support: help users register passkeys or other supported authentication methods; plan for bulk onboarding where needed.
- Consider alternatives if phone authentication must be retained: organizations that require phone-based authentication can configure a customer-managed telecom provider through the Microsoft Security Store. Guidance for configuring a provider is scheduled to be available starting October 30, 2026. Existing customer-managed providers are unaffected, and organizations not using Microsoft-provided SMS or voice need take no action for this retirement.
Timeline and scope
Microsoft’s retirement begins in early February 2027 and applies to Microsoft-provided SMS and voice authentication across Worldwide and Government Community Cloud environments. Administrators should begin planning now rather than waiting for the change to roll out to their tenant.
Operational and security follow-through
Preparing for this change is not only an identity-management task but also a coordination exercise with helpdesks, security operations centers, and end users. Giving your SOC the necessary alert context and integrating relevant threat intelligence can help detect and respond to any account takeover attempts or phishing campaigns that target the transition period.
Final thoughts
The shift to passkeys is a practical step toward stronger, phishing-resistant authentication across Entra ID. By identifying affected users early, communicating clearly, and leveraging available options for organizations that must retain phone authentication, administrators can reduce disruption and improve their organization’s security posture ahead of the February 1, 2027 deadline.
Licensed under CC BY-ND 4.0 International