Microsoft is Retiring SMS MFA in Entra ID and Moving to Passkeys

What happens to a user whose only sign-in method is a text message code on the day Microsoft stops supporting it? Without a plan, they will be stuck at a registration prompt instead of doing their work.

Microsoft is retiring Microsoft-hosted SMS and voice multifactor authentication in Microsoft Entra ID and making passkeys the default way to sign in. The change affects how users authenticate to Microsoft 365, Azure and other business applications, and it sets firm 2027 deadlines for moving away from phone based methods. For IT teams, this means tracking the retirement dates, understanding how passkeys work, and moving every user off SMS and voice MFA before Microsoft does it for them. 

Why Microsoft Entra ID is Replacing SMS and Voice MFA with Passkeys

Microsoft is replacing SMS and voice MFA because one time code can be intercepted or stolen, while passkeys use cryptographic keys that cannot be phished. 

On this episode of the Demystifying Microsoft podcast, Austin Kelly, Client Success Manager at Sourcepass MCOE, walks through the dates every IT team should have on their calendar and why phone based authentication no longer holds up against modern phishing. He also shares the phased approach his team uses to move users to passkeys before Microsoft makes the switch for them. 

Microsoft Entra ID SMS and Voice MFA Retirement Dates

Microsoft hosted SMS and voice MFA in Entra ID retires for all users on February 1, 2027. Global administrators and external users with an extended timeline have until July 1, 2027. The rollout started earlier, though, and the first milestone has already passed. 

If you start planning now, the change can happen on your schedule and not at the deadline.

Why SMS and Voice MFA No Longer Stop Phishing Attacks

SMS and voice MFA no longer stop phishing because the code itself can be stolen. Modern phishing attacks routinely intercept authentication sessions, capture tokens and bypass traditional MFA, even though organizations treated these methods as a strong control for years. 

Phone-based authentication has three main weaknesses. In SIM swapping, an attacker takes over a user's phone number. In social engineering, users are tricked into handing over codes. Message interception lets attackers capture codes in transit.

Microsoft's position is that authentication must be phishing resistant by design. Passkeys remove the code that attackers try to steal, which shrinks the attack surface and shuts down entire categories of phishing attacks. This may be the most important identity improvement Microsoft has made since modern MFA was introduced.

What is a Passkey in Microsoft Entra ID?

A passkey is a phishing resistant sign in method that replaces passwords, SMS codes and voice verification with cryptographic keys tied to a trusted device. Users can register a passkey on Microsoft Authenticator, Windows Hello for Business, a mobile device or a FIDO2 security key.

How does Passkey Sign-In Work?

When a user signs in, Microsoft sends a challenge to the registered device. The user confirms their identity with a fingerprint, face recognition or the device PIN. The private key never leaves the device, so there is nothing for an attacker to intercept or phish.

Are Passkeys Easier for Users than SMS Codes?

Yes. Users no longer have to type a password, wait for a text, switch apps and copy a code. It is uncommon for a security upgrade to also make life easier for users, but passkeys do both.

What Will Users See When Microsoft Prompts Them to Register a Passkey?

Users who complete MFA will see a prompt asking them to register a passkey during their normal sign-in. These prompts started in September, and the registration process is simple and usually takes a couple of minutes. Microsoft is handling most of this experience, which helps the user adoption, usually the biggest worry with any authentication change. 

The prompts become harder to ignore once the deadline pass. If a user reaches a retirement milestone and SMS or voice is their only registered method, Microsoft can require them to register a passkey before they can continue signing in. Users who skip the prompt now will get stopped at the worst possible moment later, so talk with them early. 

How Should you Move Users from SMS MFA to Passkeys?

Move users in four phases: discover, pilot, expand and remove the risk. 

1. Discover. Identify which users are actively using SMS and voice authentication today.
2. Pilot. Start with IT administrators, executives and high risk users. These groups benefit most from phishing resistant authentication, and security assessments typically prioritize FIDO2 and passkey adoption for them.
3. Expand. Roll out passkeys department by department while you monitor adoption and help desk requests.
4. Remove the risk. Before the deadlines arrive, make sure every employee has at least one phishing resistant method registered.

What if your Organization Still Needs SMS or Voice MFA?

Organizations that still need SMS or voice MFA can use Microsoft's Bring Your Own Telephony Provider model. It is designed for organizations with legitimate business, regulatory or operational requirements, and it lets them buy SMS and voice delivery through an approved telephony provider instead of relying on Microsoft hosted delivery. 

During the initial rollout, Soprano and Telesign are the only approved providers, and Microsoft expects to add more over time. Either way, Microsoft now treats SMS and voice as exceptions, not as a primary authentication method.

Plan your Passkey Rollout Before SMS MFA Retires in 2027

Microsoft's direction is clear. Passkeys are the future of authentication in Entra ID, and organizations that start early will improve security, reduce phishing risk and avoid disrupting users. Every week before February 2027 is time to work through the rollout on your terms instead of under a deadline. 

If you need help planning your transition or reviewing your authentication methods, contact our Microsoft experts.

Subscribe to Demystifying Microsoft to stay current on Microsoft security, licensing and Entra ID changes.