This action is necessary to prevent sign-in disruptions before SMS and voice authentication are retired in February 2027.
This retirement scope is limited specifically to Microsoft Entra ID workforce tenant authentication scenarios. It does not affect customer identity scenarios within Azure AD B2C or Microsoft Entra External ID.
Administrators must ensure all organizational users adopt a phishing-resistant method before the deprecation date, as the legacy methods will cease supporting multifactor authentication and account login. Available options include passkeys, FIDO2 security keys, QR code authentication, and other Entra ID-approved sign-in techniques.
"Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft stated in a Microsoft 365 Message Center update on Tuesday.
Furthermore, Microsoft noted, "SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store."
Previously, in September, Microsoft advised that users employing SMS or voice authentication can be identified using the Entra SMS/Voice Policy Scanner PowerShell script, accessible to roles such as Authentication Policy Administrator, Global Reader, or Security Reader.
Organizations requiring phone-based authentication must configure third-party telecom providers via the Microsoft Security Store. In July, Microsoft announced that passkeys would become the default authentication experience for the Entra ID enterprise identity service starting in September.
"As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multifactor authentication, they'll be prompted to register a passkey," Microsoft communicated.
This transition culminates on February 1, 2027, when Microsoft will discontinue native Microsoft Entra capability for SMS and voice authentication delivery.
This ongoing push toward stronger authentication mechanisms reflects a broader industry trend where initial access controls are increasingly insufficient, as evidenced by findings such as the Blue Report 2026, which measures defenses technique by technique.
