Microsoft Is Retiring SMS Multi-Factor Authentication

If your employees log into Microsoft accounts using a text message code or an automated phone call, that habit is officially on a countdown timer. Microsoft is retiring SMS and voice-based multi-factor authentication (MFA) in Entra ID and replacing it with cryptographic passkeys.

Relying on text messages for account security felt like a huge step forward a decade ago. However, cybercriminals bypass phone verification routinely through interception, SIM swapping, and automated phishing proxies. Passkeys fix this by tying logins directly to a physical device and your verified corporate domain, stopping remote credential theft in its tracks.

 The Retirement Schedule

The transition timeline is moving quickly, so it is best to get ahead of these dates before your team gets caught off guard:

• September 1, 2026 - Users relying on SMS or voice calls have been automatically enabled for passkeys. Now Microsoft will prompt them to register a passkey.
• February 1, 2027 - Microsoft will permanently shut down its SMS and voice verification services across all Entra ID tenants.
• After February 1, 2027 - Anyone without a registered passkey will be completely blocked from logging in until they complete the registration process.

The last thing you want is a workforce locked out of their accounts on a busy morning because an enforcement deadline snuck up on your IT setup. Taking a few proactive steps now will keep your day-to-day operations moving smoothly:

• Audit your accounts - Review your Entra ID environment to pinpoint every user who still relies on SMS or phone calls as their primary backup login method.
• Deploy passkeys early - Update your authentication policies now and encourage staff to register their devices before Microsoft forces the prompt on them.
• Inform your staff - Send out clear, simple instructions explaining why this change is happening and how employees can set up their passkeys.
• Configure telecom fallbacks if needed - If specific regulatory mandates require your business to maintain phone verification, you must set up a customer-managed telecom provider through the Microsoft Security Store prior to the final February deadline.

Upgrading your security does not have to mean frustrating your workforce. If you want a hand auditing your Microsoft Entra ID policies, setting up passkeys, or guiding your team through the transition, give us a call at (717) 620-3042.