Microsoft Entra Retires Native SMS and Voice MFA in 2027—Prepare for Passkeys Now

Bottom line: Beginning September 1, 2026, Microsoft will start rolling out passkeys as the default authentication experience for users enabled for SMS or voice in public-cloud Microsoft Entra ID tenants. On February 1, 2027, Microsoft-provided telecom delivery for SMS and voice will end. Affected organizations should move users to a phishing-resistant method before that deadline or, where there is a documented need to retain SMS or voice, configure a customer-managed telecom provider.

Source fact: what Microsoft is changing

Microsoft is not eliminating every possible use of SMS and voice. It is retiring the native telecom delivery that Microsoft currently provides for those methods in Entra ID. Microsoft says SMS and voice provide weaker protection than phishing-resistant credentials because telephone channels can be phished, intercepted, redirected, or compromised through attacks such as SIM swapping.

Microsoft recommends passkeys as the primary migration path. Entra ID supports synced passkeys and device-bound credentials, including Microsoft Authenticator passkeys, Entra passkeys on Windows, and FIDO2 security keys. Other phishing-resistant options may also fit particular environments.

Key dates

Scope and important exceptions

• The published dates apply to Microsoft Entra ID public-cloud environments only. Other cloud environments will receive separate dates and guidance.
• The native SMS and voice retirement applies across Entra, including self-service password reset.
• B2B and internal guest users are included in the retirement scope. Microsoft says passkey support for those users is planned by the end of calendar year 2026.
• If a tenant has no users enabled for SMS or voice, Microsoft says no action is required for this change. Administrators should verify that condition rather than assume it.

The temporary opt-out is not a migration plan

Microsoft Learn documents a temporary opt-out for the automatic passkey enablement and registration-campaign rollout between September 1, 2026, and February 1, 2027. It is configured through Microsoft Graph using the passkeyDynamicMigration opt-out setting and requires the Policy.ReadWrite.AuthenticationMethod permission. Microsoft also notes that moving users out of SMS or voice in the Authentication Methods Policy before September 1 prevents the automatic passkey nudge for those users.

The opt-out does not postpone retirement. Beginning February 1, 2027, the enforcement timeline applies regardless of that setting, and Microsoft provides no opt-out from the final requirement. Because the documented configuration uses a Microsoft Graph beta endpoint, administrators should confirm the current Microsoft procedure immediately before making the change.

DSE recommendation: migration action plan

The following steps are DSE recommendations for managing the transition. Microsoft’s announced requirements and dates are described above.

1. Inventory now. Identify every user enabled for SMS or voice in both the Authentication Methods Policy and legacy MFA settings. Review actual method-registration and usage data, SSPR dependencies, guest users, privileged roles, shared-device workflows, and recovery processes.
2. Choose the target experience. Prefer passkeys where supported, then document approved alternatives for devices or workflows that need a different phishing-resistant method.
3. Pilot before expanding. Test registration, normal sign-in, device replacement, account recovery, temporary access, and help-desk escalation with representative users and devices.
4. Drive enrollment deliberately. Enable the target method, use a controlled registration campaign, and give users device-specific instructions before prompts appear. Track completion instead of treating policy enablement as proof of adoption.
5. Prioritize privileged and high-risk users. Move administrators, executives, finance personnel, remote-access users, and other frequently targeted groups first. Apply authentication-strength controls in stages after confirming recovery paths.
6. Use the temporary opt-out only with an owner and exit date. It can create implementation time, but it should not become a reason to defer the project.
7. Retain telecom only for a documented exception. If SMS or voice is necessary, review provider information on September 18, configure and pilot beginning October 30, and complete deployment before Microsoft’s February deadline.
8. Finish early. DSE recommends completing production migration by December 15, 2026, leaving time to resolve exceptions and support users before enforcement.

What users should expect

Users already signing in with a passkey, Windows Hello for Business, a FIDO2 security key, or another approved phishing-resistant method can continue using it. Users who remain enabled for SMS or voice may see a prompt to register a passkey after completing MFA as the rollout reaches their organization. Microsoft currently documents unlimited snoozes during the pre-retirement registration campaign, but the post-retirement prompt for users who have no other method will be blocking.

Related DSE guidance

• MFA, passkeys, and authentication strength
• Deploy phishing-resistant authentication by user and device readiness

Official reference

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication, Microsoft Learn, last updated August 10, 2026
• Frequently asked questions about SMS and voice retirement, Microsoft Learn
• Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID, Microsoft Security Blog, published July 13, 2026

Source review completed August 11, 2026. Microsoft may revise implementation details; confirm current guidance before changing production policy.