Microsoft Entra ID Is Retiring SMS and Voice MFA: The Timeline, the Risks, and How to Prepare

Microsoft has set an end date for one of the most familiar rituals in corporate IT: the six-digit code that arrives by text message. According to the official Microsoft Learn announcement, passkeys become the default sign-in experience in Microsoft Entra ID on September 1, 2026, and Microsoft-provided SMS and voice authentication will be fully retired on February 1, 2027. The enforcement is universal: after that date, users whose only MFA method is SMS or voice will face a blocking prompt and must register a passkey before they can sign in again. Microsoft states it plainly — there is no opt-out from the February 1 behavior, for any tenant.

For organisations running Microsoft 365, this is not a cosmetic change to a settings page. It touches every user who signs in to Exchange Online, Teams, or SharePoint with a text-message code, and it lands on a fixed schedule whether a tenant is ready or not.

The timeline every tenant is on

• September 1, 2026 — passkeys become the default authentication experience. Users currently enabled for SMS or voice are automatically enabled for passkeys, and Microsoft's registration campaign begins nudging them to register one at their next MFA sign-in.
• September 18, 2026 — Microsoft publishes details of customer-managed telecom providers in the Microsoft Security Store, for organisations with a genuine regulatory need to keep an SMS channel.
• October 30, 2026 — tenants that must keep SMS or voice can begin selecting and configuring a telecom provider from the Security Store.
• February 1, 2027 — Microsoft-provided SMS and voice delivery is fully retired in Entra ID. Users whose only method is SMS or voice hit a blocking passkey-registration prompt at sign-in.

There is a temporary opt-out that delays the automatic passkey enablement between September 2026 and February 2027 — a single Microsoft Graph setting (`passkeyDynamicMigration`) on the authentication methods policy. It buys planning time; it does not change the retirement date. On February 1, 2027, the standard enforcement applies to every tenant regardless of that setting.

Why one-time codes over the phone network were never safe

Microsoft's stated reason is that SMS and voice are "no longer positioned as secure authentication methods". That phrasing is diplomatic. The security community has been documenting the weaknesses of phone-based authentication for a decade — NIST began restricting SMS for out-of-band authentication in its Special Publication 800-63B back in 2016. The problems are structural, not incidental.

SIM swapping puts your MFA in someone else's pocket

A SIM-swap attack does not touch your infrastructure at all. The attacker convinces a mobile carrier — through social engineering, a bribed insider, or leaked personal data — to move the victim's phone number to a SIM card the attacker controls. From that moment, every one-time code sent by Entra ID arrives on the attacker's device. The entire control rests on the identity-verification practices of a telecom call centre that your security team has never met and cannot audit.

The phone network itself is interceptable

SMS messages and voice calls travel over signalling protocols, such as SS7, designed in an era when every participant in the network was a trusted state carrier. Known SS7 weaknesses allow traffic to be redirected and intercepted, and they have been used in the wild — including documented cases where attackers intercepted one-time banking codes at scale. A code in transit over the public telephone network is simply not a secret in any strong sense.

Codes are phishable by design

The most common real-world attack needs no telecom expertise at all. A phishing page that mirrors the Microsoft sign-in flow asks the victim for their password, then for "the code we just sent you". Adversary-in-the-middle kits automate this end to end, relaying credentials and codes to the legitimate service in real time. The fundamental flaw: a one-time code has no idea which website it is being typed into. The user is the only line of defence, and users are human.

Voice calls add social engineering on top

Voice-based approval inherits every weakness above and adds its own: fatigue attacks that ring a user at 3 a.m. until they press approve, and pretexting calls in which an "IT helpdesk" walks an employee through approving an authentication they never initiated.

Passkeys close this entire class of attacks at the protocol level. A passkey is a cryptographic credential bound to the origin it was registered for — there is no shared secret to intercept, and the credential will not respond to a look-alike phishing domain at all. That is what "phishing-resistant" means: the protection does not depend on the user noticing anything.

A practical checklist for Microsoft 365 administrators

• Find your exposed users. Microsoft publishes a PowerShell script that lists everyone enabled for SMS or voice. Run it now — the size of that list defines the size of your project.
• Enable passkeys and start a registration campaign. Entra ID supports synced passkeys (iCloud Keychain, Google Password Manager) and device-bound passkeys (Microsoft Authenticator, Windows Hello for Business, FIDO2 hardware keys). A registration campaign nudges users into registering at their next sign-in — before Microsoft's own campaign does it for you on September 1, 2026.
• Treat the telecom fallback as an exception, not a strategy. The Security Store route exists for documented regulatory or operational requirements. If a segment of users genuinely needs an out-of-band SMS channel, document why, pilot a provider from October 30, 2026, and keep every other user on passkeys.
• Communicate in phases. Awareness, action, reminder — aligned to the retirement dates. A user who understands why the text-message code is going away is far less likely to call the helpdesk in February 2027.

What this means for email administrators

Identity is the front door to your mail. Every mailbox in Exchange Online, every transport rule, every admin session in the Exchange admin center sits behind an Entra ID sign-in — and after February 1, 2027, the strength of that sign-in changes for the better.

It is also a timely prompt to look at the rest of the trust chain. The same directory that authenticates your users feeds every service connected to your tenant: the job titles and phone numbers in Entra ID end up in your employees' email signatures, and the services that manage those signatures hold their own permissions into your environment. The logic behind Microsoft's move — replace interceptable shared secrets with credentials that cannot leave your control — is the same logic worth applying when you review which third-party services sit in your message path and what they can touch. Fewer shared secrets, tighter boundaries, and processing kept where you can see it: that principle now officially applies to your sign-in screen, and it applies just as well to everything downstream of it, email signatures included.

The retirement dates are fixed, the enforcement is universal, and eighteen months is less time than it sounds for an organisation with thousands of mailboxes. The tenants that treat this as a security upgrade rather than a compliance chore will be done long before the deadline.

Source: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication — Microsoft Learn (accessed August 2026).