Many businesses improved Microsoft 365 security by requiring a texted code or automated telephone call. That was better than a password alone, but Microsoft is now moving organizations toward phishing-resistant passkeys.
Microsoft has begun retiring Microsoft-provided SMS and voice authentication in Microsoft Entra ID, the identity system behind Microsoft 365. Passkey registration prompts began appearing for affected users on September 1, 2026.
February 1, 2027: retirement for most users, including internal guests. July 1, 2027: retirement for Global Administrators and external users.
After the applicable deadline, an affected user whose only MFA method is Microsoft-provided SMS or voice will have to register a passkey during sign-in before continuing. Organizations with a legitimate need for telephone-based authentication may contract with a supported provider through Microsoft Security Store.
What exactly is changing?
Microsoft is retiring the telecom delivery service it currently provides for SMS and voice authentication in public-cloud Entra tenants. The change also applies across Entra scenarios such as self-service password reset.
This does not mean every use of SMS disappears on the same date. A supported telephony provider can remain an option for a defined need, but it introduces another vendor relationship, configuration work, usage cost, and many of the security weaknesses that affect SMS and voice.
Why Microsoft is making the change
SMS and voice codes can be defeated through phishing, fraudulent number transfers, SIM swaps, social engineering, malware, number reassignment, device compromise, and real-time adversary-in-the-middle attacks.
A passkey uses public-key cryptography and is tied to the legitimate website or application. A fraudulent sign-in page cannot collect and replay it the way it can steal a password and one-time code.
Who may be affected?
- Employees receiving text codes or automated calls
- Users relying on a phone number for password reset
- Seasonal, part-time, field, and shared-device users
- Executives and owners who travel
- Employees who replace phones often
- Internal guests, external collaborators, and vendors
- Global Administrators and users governed by older MFA policies
Written policy is not proof of readiness. Actual tenant configuration, registered methods, recent sign-in activity, licensing, and device compatibility must be reviewed.
What users may already be seeing
Microsoft began automatically enabling passkeys in the Authentication Methods Policy and moving the Registration Campaign to a Microsoft-managed state for users enabled for SMS or voice. Before enforcement, users can snooze the registration prompt by default. That can make a mandatory transition look optional.
Once enforcement begins, an SMS- or voice-only user may face a blocking prompt. A company with many unprepared users could turn a planned security improvement into a help-desk surge and business interruption.
Why “just turn on passkeys” is not a complete plan
The migration must account for operating systems, company-owned and personal devices, shared workstations, users without compatible smartphones, accessibility, remote onboarding, temporary workers, guests, privileged accounts, emergency access, and older applications.
Microsoft recommends persona-based deployment, representative pilots, report-only Conditional Access testing, and at least two registered authentication methods per user. Device inventory is therefore part of the identity project.
A practical ten-step migration plan
1. Find every user still enabled for SMS or voice
Use current Entra tenant evidence. Record registered and recently used methods, privileged roles, devices, shared-device needs, guest status, accessibility requirements, and recovery paths. Review modern and legacy MFA settings, and remove stale accounts instead of migrating them.
2. Divide users into practical groups
Plan separately for administrators, executives, finance teams, office staff, field workers, shared-device users, seasonal staff, guests, vendors, and people with older devices.
3. Select the right phishing-resistant method
Options include synced passkeys, passkeys in Microsoft Authenticator, FIDO2 security keys, Windows Hello for Business, Windows passkeys, Mac Platform SSO, and certificate-based authentication where justified.
4. Prepare devices before enrollment
Verify operating systems, browsers, Authenticator versions, device registration, and management policies. Older or shared devices may need a FIDO2 security key or another supported method.
5. Establish secure identity proofing
Verify identity before issuing or resetting a credential. Temporary Access Pass can bootstrap enrollment, but it should be short-lived, securely delivered, logged, and issued only after approved verification.
6. Pilot with representative users
Test office and remote sign-ins, mobile and desktop apps, personal and managed devices, shared workflows, password reset, phone replacement, lost security keys, guest access, and critical business applications.
7. Give every user a recovery path
Microsoft recommends at least two registered authentication methods. Critical and privileged users need especially strong, independently recoverable methods and tested emergency access.
8. Communicate through several channels
Explain the reason, approved process, permitted devices, legitimate prompts, support path, and lost-device steps. Warn employees that criminals may imitate the migration.
9. Roll out in controlled waves
Track successful registration and actual use—not just policy enablement—along with failures, support demand, report-only Conditional Access results, exceptions, and guest readiness.
10. Enforce, monitor, and retire the old path
After each group is ready, enforce approved authentication strengths where supported. Monitor sign-ins, method changes, resets, and unusual registrations, then remove obsolete SMS and voice dependencies.
Business continuity in Southwest Florida
Authentication is an availability control as well as a security control. During a hurricane, evacuation, power interruption, or cellular outage, employees may need replacement devices and unfamiliar locations. A phone may be lost, damaged, uncharged, or disconnected, while an office holding spare security keys may be inaccessible.
- Give critical users at least two approved methods.
- Store spare FIDO2 keys in separate secure locations.
- Document identity verification for emergency recovery.
- Protect, monitor, and periodically test emergency-access accounts.
- Maintain offline support contacts and a clean spare device for essential roles.
- Test access from continuity locations and document provider escalation.
Do not keep every backup key, administrator device, recovery instruction, and emergency contact in one office.
When a telephony provider may be appropriate
A regulatory requirement, specialized accessibility need, incompatible workforce device, or short migration bridge may justify a provider for a defined population. Evaluate regional availability, cost, privacy terms, security commitments, reliability, logging, Entra integration, and exit options. Treat it as a documented exception—not the default replacement.
How AI can help—and where people remain responsible
Approved AI-assisted tools can summarize authentication inventories, identify SMS-dependent users, group readiness by role and device, analyze report-only policy results, detect unusual registration or reset patterns, summarize support issues, and prepare rollout reports.
People must remain responsible for identity verification, permitted credential types, personal-device policy, privileged and guest access, accessibility needs, application readiness, emergency procedures, suspicious registrations, credential revocation, and acceptance of remaining risk.
Authentication reports can reveal usernames, privileged roles, devices, sign-in patterns, and security weaknesses. They should not be pasted into an unapproved public AI service.
Twelve questions business owners should ask now
1How many users are still enabled for Microsoft-provided SMS or voice?
2Who relies on it as the only MFA or recovery method?
3Which affected users hold sensitive or administrative roles?
4Are their devices compatible with the planned passkey method?
5Which passkey types will the organization permit?
6Does every critical user have a second approved method?
7How will support verify identity after a lost device?
8Have guest, shared-device, seasonal, and accessibility scenarios been tested?
9Will Conditional Access changes start in report-only mode?
10Can the provider show successful registration and actual usage?
11How will employees authenticate during a hurricane or cellular outage?
12Who owns completion before February 1, 2027?
Frequently asked questions
Is Microsoft eliminating SMS and voice MFA completely?
Microsoft is retiring the SMS and voice delivery it provides through Microsoft Entra ID. Organizations with a legitimate need can use a supported telephony provider through Microsoft Security Store, subject to configuration, availability, and cost.
When does Microsoft-provided SMS and voice authentication end?
It retires for most users on February 1, 2027. Global Administrators and external users follow a July 1, 2027 deadline. Internal guest users follow the February 1 deadline.
What happens if SMS or voice is a user’s only MFA method?
After the applicable retirement date, the user must register a passkey during sign-in before continuing, unless the organization has migrated that user to a supported telephony provider or another approved method.
Are users already being moved to passkeys?
Beginning September 1, 2026, Microsoft automatically enabled passkeys and registration prompts for users enabled for SMS or voice. Before enforcement, users can snooze the prompt by default, so administrators must still track completion.
Are passkeys safer than text-message codes?
Yes. Passkeys are tied to the legitimate website or application and resist phishing that can steal and replay passwords and one-time codes. Deployment and recovery still require careful controls.
Does the change affect self-service password reset?
Yes. Microsoft says retirement of its native SMS and voice delivery applies across Entra, including self-service password reset. Organizations must review both sign-in and recovery workflows.
Should every employee use the same type of passkey?
Not necessarily. Administrators, shared-device users, field workers, regulated employees, and other groups may need different combinations of synced passkeys, Authenticator passkeys, Windows Hello, or FIDO2 security keys.
How can Managed Intelligence Advisors help?
Managed Intelligence Advisors can inventory affected users, assess devices and licensing, design passkey and recovery policies, test Conditional Access, train employees, and connect identity recovery with business continuity.