Microsoft has renewed its call for Entra ID administrators to shift users to phishing-resistant authentication approaches in preparation for the planned discontinuation of SMS and voice authentication in February 2027. The retirement applies exclusively to Microsoft Entra ID workforce tenant scenarios and does not affect Azure AD B2C or Microsoft Entra External ID deployments used for customer identity.
Organizations must ensure their users adopt phishing-resistant methods before the cutoff date, as SMS and voice authentication will no longer function for multifactor authentication or account sign-in. Administrators have several alternatives available through Entra ID, including passkeys, QR code authentication, FIDO2 security keys, and other supported sign-in mechanisms.
Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience
Microsoft, in a Microsoft 365 Message Center update
The company emphasized the security rationale for this change in its announcement. "SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store."
Administrators holding the Authentication Policy Administrator, Global Reader, or Security Reader roles can identify which users currently rely on SMS or voice authentication using the Entra SMS/Voice Policy Scanner PowerShell script, which Microsoft detailed in a previous advisory from September. For organizations with specific requirements for phone-based authentication, third-party telecom providers can be configured via the Microsoft Security Store.
Passkeys becoming the default authentication method
Microsoft announced in July that passkeys would roll out as the default authentication experience for Entra ID beginning in September. During this transition, users currently enabled for SMS or voice authentication will automatically gain passkey capability, and upon their next multifactor authentication action, they will receive a prompt to register a passkey.
As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multifactor authentication, they'll be prompted to register a passkey
Microsoft
The company has already taken steps to phase out less secure authentication methods. In August, Microsoft retired SMS first-factor sign-in for Entra ID Free tenants due to concerns about phishing, fraud, and account compromise, and the company has prevented newly created tenants from enabling this capability.
Microsoft has published comprehensive documentation on deploying and managing phishing-resistant passwordless authentication in Entra ID for administrators seeking implementation guidance.