Microsoft Is Retiring SMS and Voice MFA in Entra ID: Passkey Migration Checklist (2027)

If your users still approve sign-ins with a text message or a phone call, that is about to stop working. Microsoft is retiring Microsoft-provided SMS and voice authentication in Microsoft Entra ID. Passkeys became the default on September 1, 2026, SMS and voice stop for most users on February 1, 2027, and Global Administrators and external users follow on July 1, 2027.

This guide explains exactly what is changing, who is affected on which date, and a step-by-step checklist to move your organisation to passkeys before users get locked into a blocking registration prompt.

Quick answer: From Feb 1, 2027, users whose only MFA method is SMS or voice must register a passkey at sign-in, with no opt-out. Admins should: (1) find SMS/voice-only users with Microsoft's entra-sms-voice-usage-analyzer script, (2) enable passkeys (FIDO2) in the Authentication methods policy, (3) run a registration campaign targeting those users, (4) tell users what to expect, and (5) only if you have a documented need, set up a telephony provider from Microsoft Security Store.

Last updated: November 12, 2026.

Table of contents

• What exactly is being retired
• Timeline: who is affected and when
• Why Microsoft is doing this
• Migration flow at a glance
• Admin checklist: 6 steps
• What end users will see
• Need SMS anyway? Telephony providers
• Mistakes to avoid
• FAQ

What exactly is being retired

Microsoft says SMS and voice "will no longer be provided natively in Entra ID". In other words, Microsoft stops sending the text messages and making the phone calls itself. That covers the classic "we sent a code to +91 XXXXX" and "answer the call and press #" MFA methods for work and school accounts.

Users who already use a phishing-resistant method, such as passkeys, Windows Hello for Business or FIDO2 security keys, can keep using them.

Timeline: who is affected and when

Date	What happens
Sep 1, 2026	Passkeys become the default. Users enabled for SMS or voice are auto-enabled for passkeys and nudged to register one at their next MFA sign-in.
Oct 30, 2026	Organisations that need SMS or voice can choose a telephony provider from Microsoft Security Store.
Feb 1, 2027	Microsoft-provided SMS/voice retired for all users except Global Administrators and external users (internal guests are included in this wave).
Jul 1, 2027	Retired for Global Administrators and external users.

After each date, anyone whose only MFA method is SMS or voice gets a blocking prompt to register a passkey. There is no opt-out from enforcement.

Why Microsoft is doing this

• SMS codes can be phished. A fake login page can ask for the code and pass it on in real time, the same trick behind many Microsoft 365 phishing attacks.
• SIM swap fraud. If an attacker moves your number to their SIM, they receive your codes.
• Passkeys can't be typed into a fake site. A passkey is tied to the real website's domain, so a phishing page simply can't use it.

Migration flow at a glance

Admin checklist: 6 steps

Step 1: Find users who rely only on SMS or voice

Microsoft provides a PowerShell script on GitHub: microsoft/entra-sms-voice-usage-analyzer. You need the Global Reader, Authentication Policy Administrator or Security Reader role. Put the users it finds into a security group (for example SG-SMS-Voice-Users). The Authentication methods activity report in the Entra admin center also helps you see which methods people register and use.

Step 2: Enable passkeys (FIDO2)

In the Entra admin center go to Entra ID > Authentication methods > Policies > Passkey (FIDO2), enable it, and target all users or your pilot group. Passkeys can be:

• Synced passkeys, saved in iCloud Keychain or Google Password Manager and synced across a person's devices.
• Device-bound passkeys, such as the passkey in Microsoft Authenticator, Entra passkey on Windows, or a FIDO2 security key.

Step 3: Run a registration campaign

1. Sign in as an Authentication Policy Administrator.
2. Open Entra ID > Authentication methods > Registration campaign.
3. Set State to Microsoft managed and target your SMS/voice security group.

Users are asked to register a passkey at their next MFA sign-in. By default they can snooze, which is why steps 4 and 5 matter.

Step 4: Tell users what's coming

Microsoft suggests three messages: awareness (why it's changing), action (how to set up a passkey on Windows, iPhone and Android) and a reminder close to the date. Ready-made end-user templates are at aka.ms/mfatemplates. Helpdesk teams should also know how to move Microsoft Authenticator to a new phone.

Step 5: Track progress every week

Re-run the analyzer script or check the authentication methods reports. Your target: zero users who have SMS or voice as their only method before Feb 1, 2027, and zero Global Admins before Jul 1, 2027.

Step 6: Fix your Conditional Access policies

If you already use Conditional Access, consider an authentication strength policy that requires phishing-resistant MFA for admins first, then everyone else. Keep your two break-glass emergency accounts excluded and protected with FIDO2 keys.

What end users will see

• A prompt after sign-in asking them to create a passkey.
• On Windows, it may offer Windows Hello (face, fingerprint or PIN). On a phone, it offers the phone's passkey or Microsoft Authenticator.
• After the enforcement date, SMS-only users can't skip the prompt.

Need SMS anyway? Telephony providers

If you have a regulatory or operational reason to keep SMS or voice (for example, shared kiosk workers with no smartphones), you can configure a telephony provider from Microsoft Security Store. Microsoft lists Soprano and Telesign as the first providers. Without a provider, in-scope users can't use SMS or voice for MFA after their retirement date. Microsoft positions this for documented needs only; passkeys stay the default for everyone else.

Temporary delay: between Sep 1, 2026 and Feb 1, 2027, admins can delay the automatic passkey enablement with a Microsoft Graph setting (passkeyDynamicMigration). It does not stop enforcement on Feb 1, 2027.

Mistakes to avoid

• Waiting until January. Users who travel or rarely sign in will hit a blocking prompt at the worst moment.
• Forgetting Global Admins. They get until Jul 1, 2027, but they're your most attacked accounts. Move them first.
• Ignoring external users and guests. Plan how partners will sign in.
• Locking yourself out. Keep two cloud-only break-glass accounts with FIDO2 keys, excluded from campaigns.

FAQ

Is Microsoft removing SMS MFA for personal Microsoft accounts too?

This retirement is about Microsoft Entra ID (work and school accounts). Personal Microsoft accounts have their own settings.

When exactly does SMS MFA stop working?

For most users on February 1, 2027. For Global Administrators and external users on July 1, 2027.

Can users keep Microsoft Authenticator push notifications?

Microsoft's retirement targets SMS and voice delivery. Users who already have other methods registered can use them, but Microsoft is steering everyone to passkeys, including the passkey inside Microsoft Authenticator.

Is there an opt-out?

There's a temporary delay for automatic passkey enablement until Feb 1, 2027, but no opt-out from enforcement.

What if a user has no smartphone?

Use a FIDO2 security key, Windows Hello for Business on their PC, or, if you have a documented need, a telephony provider.

Do I need extra licences?

Passkeys and registration campaigns are part of Microsoft Entra ID authentication methods. Conditional Access authentication strengths need Entra ID P1.

Related: Microsoft 365 sign-in error codes and fixes and passkeys explained.

Sources: Microsoft Learn, "SMS and voice retirement in Microsoft Entra ID" (concept-sms-voice-retirement). Checked on November 12, 2026.