Microsoft has officially drawn a line in the sand for enterprise authentication: SMS and voice-based multi-factor authentication (MFA) are dead. The company confirmed that these legacy methods will be permanently retired in Microsoft Entra by February 1, 2027, compelling every tenant to migrate to phishing-resistant passkeys. This decision comes as AI-driven attacks have made traditional telephony-based verification increasingly vulnerable to social engineering and credential theft.
The announcement, detailed in a new advisory circulated to IT administrators, underscores a broader strategic shift within Microsoft’s identity security division. The tech giant argues that the economics of phishing have fundamentally changed, with attackers leveraging artificial intelligence to automate SIM-swap operations and clone login pages at scale. As a result, SMS and voice codes no longer provide the security boundary Microsoft considers necessary for modern identity protection.
For organizations relying on these methods for regulatory compliance or operational continuity, the path forward is now clearly defined. Microsoft is providing a transition window that begins in September 2026, but the February 2027 cutoff is absolute, with no opt-out mechanism available after that date. This move aligns with previous steps taken for personal Microsoft accounts, where SMS codes are already being phased out in favor of passwordless sign-in options.
Why Microsoft Is Pulling the Plug on SMS and Voice MFA
The push to eliminate SMS and voice authentication is not a new development, but the acceleration is driven by the evolving threat landscape. Microsoft’s research indicates that AI has drastically lowered the barrier for attackers to execute sophisticated phishing campaigns. By automating the creation of fake sign-in pages and running SIM-swap operations at twice the speed of previous methods, threat actors can now intercept one-time passcodes before legitimate users even realize they are under attack.
Microsoft has long recognized the weaknesses of telephony-based verification. In 2020, Alex Weinert, the company’s identity security lead, published findings showing that SMS is approximately 40% less effective at blocking bad actors compared to the Microsoft Authenticator app. That gap has only widened as AI tools have made it easier to bypass the remaining security controls that SMS codes provided.
The advisory states that traditional authentication methods, including passwords, SMS one-time passcodes, and voice-based verification, remain vulnerable to phishing, interception, and social engineering attacks. Microsoft emphasizes that the AI era demands stronger, phishing-resistant authentication to help customers securely adopt AI at scale. This rationale mirrors the company’s earlier decision to kill SMS codes for personal Microsoft account sign-in, signaling that enterprise environments will no longer be treated as exceptions to this security philosophy.
The Passkey Solution Explained
Microsoft’s recommended replacement for SMS and voice MFA is the passkey, a technology rooted in public-key cryptography. Unlike traditional passwords or codes, passkeys rely on a pair of cryptographic keys: a public key stored by the service and a private key that never leaves the user’s device. This architecture ensures that attackers cannot steal credentials via fake prompts or cloned login pages, as the private key is inaccessible remotely.
Microsoft Entra supports two distinct types of passkeys, each suited to different deployment scenarios. Synced passkeys are stored in a platform credential manager, such as iCloud Keychain or Google Password Manager, and follow the user across devices. This option is ideal for users who already rely on a specific ecosystem for managing their digital identities.
Device-bound passkeys, on the other hand, are tied to a single piece of hardware. These can be implemented through Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app. Microsoft’s guidance suggests device-bound credentials for administrators and users in highly regulated environments, while synced passkeys are recommended for general users. This distinction is crucial for IT admins planning a rollout, as it affects device compatibility and user experience.
The groundwork for this transition has been months in the making. Microsoft has been incrementally integrating passkey support across Windows 11 and personal Microsoft accounts, phasing out SMS codes in the process. The enterprise version of this change, now being enforced in Entra, represents the final step in a broader strategy to make authentication more secure and user-friendly.
The Enforcement Timeline and Deadlines
Microsoft has outlined a clear timeline for the retirement of SMS and voice MFA, with specific milestones that organizations must meet. Starting September 1, 2026, users will be prompted to register a passkey during their next MFA challenge. This initial phase is designed to encourage voluntary adoption and familiarize users with the new authentication method.
By September 18, 2026, Microsoft will publish details on telecom providers for organizations that must maintain SMS or voice authentication for regulatory or operational reasons. This step provides a pathway for those who cannot immediately switch to passkeys, though it comes with a cost. Organizations will need to configure a supported telecom provider through the Microsoft Security Store by October 30, 2026, if they cannot transition away from telephony-based MFA.
The critical deadline is February 1, 2027. On this date, Microsoft-provided SMS and voice authentication will be permanently disabled. Unlike previous policy changes where public pressure led to extensions, Microsoft has been blunt about this deadline, stating there is no opt-out after February 1. The company’s documentation confirms that the retirement applies to every tenant without exception.
For users whose only registered MFA method is SMS or voice, the impact will be immediate. After February 1, 2027, they will encounter a blocking prompt requiring them to register a passkey before they can sign in. This prompt cannot be skipped, and account access will remain locked until the passkey is set up. Importantly, data will not be lost, and accounts will not be disabled, but the inability to sign in creates a significant operational hurdle that must be resolved before the deadline.
What This Means for You
For IT administrators and security teams, the retirement of SMS and voice MFA is a mandatory migration that requires immediate attention. The decision eliminates a familiar authentication method and forces a shift to passkeys, which may present challenges for users on older devices or those unfamiliar with passwordless sign-in. However, the move is designed to address a critical security gap that AI has exploited, making it a necessary step for modern identity protection.
For end users, the transition means saying goodbye to SMS codes and voice calls for authentication. While passkeys offer a more secure and convenient experience, they require compatible devices and a willingness to adopt new technology. Microsoft has provided a transition window to ease this shift, but organizations must act quickly to ensure all users are prepared before the February 2027 deadline.
The cost implications are also worth noting. Passkeys are included in every Microsoft Entra plan at no additional charge, making them a cost-effective solution for most organizations. However, for those who must maintain telephony-based MFA through a customer-managed telecom provider, there will be a paid add-on priced per message. This cost varies by provider and region, so organizations should evaluate their options carefully.
How to Prepare Your Organization
Preparation for the passkey migration should begin immediately. The first step is to identify users in your tenant who are still relying on SMS or voice authentication. Microsoft provides a PowerShell script published on GitHub to help with this investigation. To run the script, you will need one of the Global Reader, Authentication Policy Administrator, or Security Reader roles. Any tenant that returns a non-zero result is in scope for the migration.
Once you have identified the users affected, the next step is to draft communications and assess device compatibility. Microsoft recommends enabling a registration campaign ahead of the September 1 auto-enrollment to encourage voluntary adoption. The following are the minimum operating system requirements for passkey support:
- Windows 10 22H2 for Windows Hello for Business
- Windows 11 22H2 for the best passkey experience
- macOS 13 Ventura
- iOS 17
- Android 14
Devices older than these requirements can still use external FIDO2 security keys, but the built-in platform experience will not be available. Microsoft’s phishing-resistant passwordless deployment guide includes a readiness workbook that pulls data from your sign-in logs, helping you assess fleet compatibility.
After addressing device support, you can proceed with the migration to phishing-resistant methods or contract with a preferred telecom provider to continue using SMS or voice. It is also important to note that this retirement applies to self-service password reset (SSPR) flows as well, so any SSPR configurations using SMS or voice must be updated. B2B and guest users are also in scope, though Microsoft plans to extend passkey support to these groups by the end of 2026.
This timeline currently applies to public cloud tenants only, with other cloud environments to follow on a separate schedule. Microsoft’s decision adds a layer of complexity to identity management, but it is a proactive measure against the growing threat of AI-driven attacks. Organizations that act now can ensure a smooth transition and maintain robust security posture well into the future.
Source: Windows Latest
Over to you: Are you ready to ditch SMS codes for passkeys, or will you stick with a telecom provider past the deadline?
You may also like
Microsoft Deepens Mistral AI Partnership to Build Out European Infrastructure
Bing Catches What Google Missed: Miami Heat’s Leaked LeBron James Video Surfaces
Nvidia CEO Reveals How Sega’s $5 Million Investment Saved the Company 30 Years Ago
Surface Pro with Snapdragon X2 ships with a significant graphics upgrade
