SMS and voice sign-in are retiring in Entra ID: how to move to passkeys before February 2027

Published 30 October 2026

What’s changing

Microsoft no longer considers SMS and voice secure authentication methods, and is making passkeys the default sign-in experience in Entra ID.

Date	What happens
1 September 2026	Already in effect: users enabled for SMS or voice are automatically enabled for passkeys and asked to register one when they next complete MFA.
30 October 2026	Organisations that must keep SMS or voice can choose a paid telephony provider through Microsoft Security Store.
1 February 2027	Microsoft’s built-in SMS and voice codes stop for all users, including internal guests, except Global Administrators and external users.
1 July 2027	The same for Global Administrators and external users.

What happens if you do nothing

After the retirement date, a user whose only MFA method is SMS or voice must register a passkey during sign-in before they can continue. The prompt is blocking, and Microsoft offers no opt-out from it. A temporary opt-out exists only for the automatic passkey prompts before 1 February 2027.

On a normal Monday morning, that means a queue at the help desk and people locked out of email and Teams until they finish registering, often on a phone they weren’t prepared to use.

Why this matters

This isn’t only a technical change to tick off. SMS and voice codes are among the weakest MFA methods:

Phishing: a fake sign-in page asks for the code and passes it straight to the attacker, who signs in with it in real time.
SIM swap: an attacker convinces the mobile carrier to move your number to their SIM, and receives your codes.
Interception: texts and calls are not end-to-end encrypted. CISA advises against using SMS as a second factor for this reason.

Passkeys use a key that never leaves the user’s device and only works on the real Microsoft sign-in page. A fake page gets nothing it can reuse, and a stolen phone number is worthless.

One limit to keep in mind: passkeys protect the sign-in itself. They don’t stop an attacker who steals a session token from an already signed-in device. We covered that in Phishing, token theft and CAE: what passkeys alone can’t solve.

What to do now

Find who still uses SMS or voice. Microsoft publishes a script that lists them (needs Global Reader, Security Reader or Authentication Policy Administrator). The Authentication methods activity report in the Entra admin center also shows registrations.
Enable passkeys. In Entra admin center → Authentication methods, turn on Passkey (FIDO2) for those users. Synced passkeys (iCloud Keychain, Google Password Manager) and passkeys in Microsoft Authenticator both work.
Run a registration campaign. Authentication methods → Registration campaign prompts users to set up a passkey at their next MFA sign-in. It’s the easiest way to move many users without loading the help desk.
Start with admins and emergency access accounts. Give every admin and break-glass account a passkey or security key first, so nobody important is locked out on the day.
Tell your users. Explain what’s changing, when, and what they need to do. Microsoft provides ready-made end-user communication templates.
Keep SMS only where you must. If a regulation or operational need really requires SMS or voice, configure a telephony provider from Microsoft Security Store before the date. Move everyone else to passkeys.

How Griffin31 helps

Griffin31 checks your sign-in settings continuously, so you can see who still depends on SMS well before the deadline. The recommendations to check are:

SMS authentication method: whether SMS is still enabled for your users.
SMS for first-factor sign-in: who signs in with an SMS code alone.
Passwordless authentication for end users: whether passkeys are turned on.
Phishing-resistant MFA for admin roles: whether admins must use a passkey or another phishing-resistant method.
Phishing-resistant MFA for all users: the same for everyone.

Try Griffin31

Sources

Cookie settings · Privacy policy