Microsoft Sets Entra SMS and Voice Retirement

The scheduled retirement applies to Microsoft-provided telecom delivery for SMS and voice in Entra ID. It does not mean that every organization must eliminate phone-based authentication on that date. Microsoft's documentation states that customers that still require SMS or voice can configure customer-managed telecom providers through the Microsoft Security Store. Microsoft has scheduled additional information about customer-managed telecoms for September 18, 2026.

Microsoft's announcement frames the transition as a move away from phishable authentication methods. The company writes that SMS and voice rely on shared secrets or communications channels that attackers can intercept, phish, or manipulate, while passkeys use public-key cryptography. Windows Latest, which reported on a Microsoft email to IT administrators, quoted the company as describing SMS and voice as more vulnerable to phishing, SIM-swap, and replay attacks than passkeys.

Microsoft's AI-era discussion focuses on attacker capability. AI-assisted content can make impersonation and phishing campaigns easier to produce and tailor, but SMS one-time codes remain susceptible to established risks including SIM swapping, message interception, number reassignment, and real-time phishing proxies.

Microsoft documents three key stages:

• •September 1, 2026: Entra users enabled for SMS or voice are auto-enabled for passkeys and prompted to register one during MFA.
• •February 1, 2027: Microsoft-provided SMS and voice delivery is fully retired from Entra ID.
• •After February 1, 2027: Users with SMS or voice as their only MFA option must register a passkey during sign-in; the registration prompt blocks account access until completed.

Microsoft recommends moving users to passkeys or another phishing-resistant method as soon as possible. Its documentation identifies Windows Hello for Business and FIDO2 methods alongside passkeys as options that existing users can continue to use.

For tenant administrators, the practical distinction is between enrollment and policy coverage. Microsoft provides a public PowerShell repository, entra-sms-voice-usage-analyzer, that checks SMS and voice authentication-method policy scope, reports registration-campaign status, exports targeted users and groups, and summarizes timeline exposure. The script requires Microsoft Graph permissions including Policy.Read.All and Group.Read.All.

Microsoft's registration-campaign documentation also describes controls for targeting users or groups, setting postponement periods, and requiring registration after up to three deferrals. Conditional Access rules governing security-information registration apply before a user receives the enrollment prompt.

Companies undertaking comparable MFA transitions commonly need to inventory users with legacy factors, test passkey enrollment across managed and unmanaged devices, and identify service or recovery workflows that still depend on phone delivery. The February 2027 blocking condition makes that inventory especially material for Entra administrators: a user population left with SMS or voice as its sole configured MFA method can encounter an access interruption rather than a passive deprecation notice.