Microsoft has issued another reminder to Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of the retirement of Microsoft-provided SMS and voice authentication, set for February 1, 2027.

The change applies specifically to Microsoft Entra ID workforce tenant authentication scenarios. It does not affect Azure AD B2C or Microsoft Entra External ID customer identity scenarios.

Once the retirement takes effect, organizations that have not migrated users will see sign-in disruptions, since SMS and voice will no longer work to complete multifactor authentication. Microsoft is recommending admins move users to passkeys, though QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods remain options.

“SMS and voice are vulnerable to phishing and SIM-swap attacks,” Microsoft said in a Microsoft 365 Message Center update. The company noted that organizations that still require phone-based authentication can retain it by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store.

Finding affected users

Admins holding the Authentication Policy Administrator, Global Reader, or Security Reader roles can identify users still relying on SMS or voice authentication using the Entra SMS/Voice Policy Scanner PowerShell script, which Microsoft highlighted in a previous reminder issued in September.

Passkeys becoming the default

In July, Microsoft announced passkeys would begin rolling out as the default authentication experience for Entra ID starting in September. As that rollout reaches each organization, users enabled for SMS or voice authentication are automatically enabled for passkeys and prompted to register one the next time they complete multifactor authentication.

Microsoft also retired SMS first-factor sign-in for Entra ID Free tenants in August, citing phishing, fraud, and account compromise risks, and has stopped enabling it for newly created tenants.

  • Deadline: Microsoft-provided SMS and voice authentication retires February 1, 2027
  • Scope: Entra ID workforce tenants only
  • Alternatives: Passkeys, QR code authentication, FIDO2 security keys, or a customer-managed telecom provider via the Microsoft Security Store

Detailed guidance on deploying phishing-resistant passwordless authentication in Entra ID is available through Microsoft’s documentation.