What and why
This is a reminder of the upcoming retirement of Microsoft-provided SMS and voice authentication in Microsoft Entra ID, previously announced in MC1426371 (July 13, 2026) and MC1434201 (GCC, July 20, 2026).
Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience.
SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store.
Rollout schedule
- Retirement (Worldwide and GCC): Beginning February 1, 2027, and expected to complete in early February 2027.
- Complete migration or configure CYOT before February 1, 2027, rather than waiting for the rollout to reach your tenant.
Impact on your organization
Who is affected
- Organizations and users that rely on Microsoft-provided SMS or voice authentication
- Customer-managed telecom providers configured through the Microsoft Security Store are not affected.
Platforms and services
- Microsoft Entra ID authentication
What will happen
- Users with another registered sign-in method will use that method. They will not be required to register a passkey to continue signing in.
- Users whose only registered sign-in method is SMS or voice can use SMS or voice one final time to verify their identity. They must then register a passkey before continuing sign-in.
Action required and recommendations
If your organization uses Microsoft-provided SMS or voice, complete these steps before February 1, 2027:
- Identify affected users. Review who relies on SMS or voice, especially users with no other registered sign-in method.
- Complete migration. Help affected users register and start using passkeys or another supported authentication method before rollout begins.
- Configure CYOT if you need to retain SMS or voice. Configure a customer-managed telecom provider through the Microsoft Security Store before rollout begins.
- Notify users and your helpdesk. Explain the deadline, required actions, and the passkey-registration requirement for users who only have SMS or voice registered.
If your organization does not use Microsoft-provided SMS or voice, no action is required for this retirement.
Learn more
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.