Microsoft urges Entra ID admins to migrate users from SMS/voice authentication to passkeys

Upcoming Retirement of SMS and Voice Authentication

Microsoft has reiterated its call for Entra ID administrators to migrate users from SMS and voice authentication to more secure, phishing-resistant methods. The company plans to retire Microsoft-provided SMS and voice authentication for Entra ID workforce tenants starting February 1, 2027. This move is intended to prevent sign-in disruptions for users who currently rely on these methods for multifactor authentication.

Security Vulnerabilities and Recommended Alternatives

SMS and voice authentication are susceptible to phishing and SIM-swap attacks, making them less secure than newer methods. Microsoft recommends passkeys as a stronger, phishing-resistant alternative. Other supported sign-in methods include QR code authentication and FIDO2 security keys. Organizations that require phone-based authentication after the retirement date must configure third-party telecom providers through the Microsoft Security Store.

Migration Process and Tools

Admins with Authentication Policy Administrator, Global Reader, or Security Reader roles can use the Entra SMS/Voice Policy Scanner PowerShell script to identify users currently using SMS or voice authentication. In July, Microsoft announced that passkeys would become the default authentication experience for Entra ID, with a rollout beginning in September. Users enabled for SMS or voice authentication will automatically be enabled for passkeys and prompted to register one during their next multifactor authentication.

Scope of the Change

This retirement specifically applies to Microsoft Entra ID workforce tenant authentication scenarios. It does not affect Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Microsoft had previously retired SMS first-factor sign-in for Microsoft Entra ID Free.