# The end of SMS and voice calls for Microsoft MFA: what changes on February 1, 2027 and how to prepare

> Microsoft is ending SMS and voice calls in Entra ID on February 1, 2027 (MFA and SSPR). Timeline, affected users, passkeys, third-party telecom providers and a migration plan.

- URL: https://benjamintestart.fr/en/end-sms-voice-mfa-microsoft-entra-passkeys/
- Author: Benjamin Testart (Devices Practice Leader & Microsoft Intune consultant)
- Published: 2026-10-16
- Updated: 2026-10-16
- Category: Microsoft Entra ID
- Language: en
- Tags: Microsoft Entra ID, MFA, Passkeys, SMS, SSPR, Microsoft Authenticator, Windows Hello for Business
- Version française: https://benjamintestart.fr/fr/fin-sms-appel-mfa-microsoft-entra-passkeys/

## TL;DR

With message MC1426371, Microsoft is ending its own delivery of SMS codes and voice calls in Entra ID. Since September 1, 2026, users enabled for SMS or voice have been enabled for passkeys and prompted to create one. On February 1, 2027, Microsoft-provided SMS and voice go away for all users, MFA and SSPR included, except Global Administrators and external users, who have until July 1, 2027. A user whose only method is SMS or voice will then have to create a passkey to sign in, with no way to postpone. There is no opt-out for this deadline: you need to migrate to passkeys, Windows Hello or a FIDO2 key, or subscribe to a third-party telecom provider through Microsoft Security Store.

It is probably the most significant identity change since mandatory MFA for admin portals: **Microsoft is ending SMS and voice calls in Entra ID**. Announced on July 13, 2026 in message **MC1426371**, it takes effect on **February 1, 2027** and covers MFA as well as self-service password reset (SSPR).

If some of your users still approve their sign-ins with a code received by SMS, you have a little over three months left. In this article, I cover the timeline, what actually happens on the day, and the migration plan I recommend.

## Why Microsoft is dropping SMS

The reason is security. SMS and voice are among the weakest authentication methods:

- **phishing**: an SMS code can be typed into a fake sign-in page just as easily as into the real one;
- **SIM swapping**: an attacker who gets a new SIM card in your name receives your codes;
- **interception and reassignment**: diverted messages, numbers reassigned to someone else;
- **social engineering**: “Could you read me the code you just received?”.

Microsoft is making **passkeys** the default authentication experience in Entra ID. A passkey relies on a cryptographic key pair bound to the legitimate site: it resists phishing, SIM swapping and replay. And the impact is real: according to Microsoft, SMS and voice still accounted for **44% of MFA responses in 2024**.

## The timeline

| Date | What happens |
|---|---|
| **July 13, 2026** | Announcement (MC1426371) |
| **September 1, 2026** | Users enabled for SMS or voice are enabled for passkeys; the registration campaign switches to “Microsoft managed” and prompts them to create a passkey, which they can postpone indefinitely |
| **October 30, 2026** | A third-party telecom provider can be configured through Microsoft Security Store |
| **February 1, 2027** | Microsoft-provided SMS and voice end for all users **except** Global Administrators and external users |
| **July 1, 2027** | End for **Global Administrators** and **external users** |

A few important details:

- **internal guests** (guest accounts created in your directory) don’t get the July reprieve: they follow the **February 1, 2027** date;
- this timeline covers the **public cloud**. Sovereign and government clouds will follow later;
- **Azure AD B2C** is not affected. For **Microsoft Entra External ID**, the change comes next year with a separate announcement.

## What goes away, what stays

| Method | After the deadline |
|---|---|
| SMS code (MFA and SSPR) | ❌ Ended, unless third-party provider |
| Voice call (MFA and SSPR) | ❌ Ended, unless third-party provider |
| Passkey in Microsoft Authenticator | ✅ Recommended method |
| Synced passkey (iCloud Keychain, Google Password Manager) | ✅ |
| Windows Hello for Business, Entra passkey on Windows | ✅ |
| FIDO2 security key | ✅ |
| Microsoft Authenticator notification, TOTP codes, OATH tokens | ✅ Unchanged |
| External MFA methods | ✅ Out of scope, unless the user is also enabled for SMS or voice |

The retirement targets **Microsoft-provided** SMS and voice in the authentication methods policy, as well as the legacy MFA and SSPR policies.

## What happens on February 1, 2027?

Microsoft is clear about it: **nobody loses access to their account**. However:

1. an affected user can no longer use SMS or voice to answer MFA;
2. if it was their **only method**, they must **create a passkey during sign-in**. The prompt is **blocking**: it can no longer be postponed.

Picture Monday morning, February 1: every “SMS only” user having to create a passkey at the same time, some on an old phone or without a work smartphone. That’s a guaranteed flood of helpdesk calls. The whole point is to do this migration **beforehand**, at your own pace.

> **No opt-out for the deadline.** Microsoft repeats it in its documentation: there is no way to push back the February 1, 2027 date (or July 1 for Global Administrators and external users). Only a third-party telecom provider lets you keep SMS.

## Step 1: find out who is affected

### Microsoft’s script

Microsoft publishes a PowerShell script, [entra-sms-voice-usage-analyzer](https://github.com/microsoft/entra-sms-voice-usage-analyzer), that lists users enabled for and actively using SMS or voice. It requires one of the **Global Reader**, **Authentication Policy Administrator** or **Security Reader** roles. Any non-zero result means your tenant is in scope.

### Users who only have phone methods

The users to handle first are those whose **registered methods are all phone-based**: they are the ones who will hit the blocking prompt. The authentication methods registration report lets you isolate them:

```powershell
Connect-MgGraph -Scopes "AuditLog.Read.All"

$phone = 'mobilePhone', 'alternateMobilePhone', 'officePhone'
$details = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

# Users whose registered methods are all phone-based
$phoneOnly = $details | Where-Object {
    $_.MethodsRegistered.Count -gt 0 -and
    -not ($_.MethodsRegistered | Where-Object { $_ -notin $phone })
}

$phoneOnly | Select-Object UserPrincipalName, UserDisplayName, IsAdmin,
    @{ n = 'Methods'; e = { $_.MethodsRegistered -join ', ' } } |
    Export-Csv .\Users-SMS-only.csv -NoTypeInformation -Encoding UTF8

"{0} users only have SMS or voice" -f $phoneOnly.Count
```

In the admin center, **Entra ID > Authentication methods > Activity** also shows the breakdown of registered and used methods. Create a **security group** with these users: you’ll use it for the registration campaign and for communications.

## Step 2: choose the target method

For the vast majority of users, the target is a **passkey**. Entra ID supports two families:

- **device-bound passkeys**: passkey in **Microsoft Authenticator**, Entra passkey on Windows, **Windows Hello for Business**, **FIDO2** key. That’s what I recommend in the enterprise: the key never leaves the device;
- **synced passkeys** (iCloud Keychain, Google Password Manager): very easy for users, but the key lives in a personal account. Reserve them for populations where that’s acceptable.

My recommendations by population:

| Population | Target method |
|---|---|
| Users with a work smartphone or managed BYOD | Passkey in Microsoft Authenticator |
| Managed Windows devices | Windows Hello for Business, deployed with Intune |
| Administrators, privileged accounts | FIDO2 key, at least two per person |
| Users without a smartphone (shop floor, retail, shared devices) | FIDO2 key, or a third-party provider if no other option works |

**Passkey profiles** in the authentication methods policy let you restrict the accepted types, for example only Authenticator and FIDO2 keys, by filtering on AAGUID. Note that the September 1 automatic enablement puts affected users in a profile that **accepts every type of passkey**, synced passkeys included: check that this suits you.

## Step 3: launch the registration campaign

This is the most effective tool to migrate at scale without overloading the helpdesk: at their next sign-in, users are prompted to create a passkey.

1. Check that **Passkey (FIDO2)** is enabled in **Entra ID > Authentication methods > Policies** for the target group.
2. Go to **Entra ID > Authentication methods > Registration campaign**.
3. Set the **State** to **Microsoft managed** (or **Enabled** to control the number of allowed snoozes yourself) and target the SMS users group.

Since September 1, Microsoft has already enabled this campaign for affected users, with unlimited snoozes. I recommend **taking back control**: limit the number of snoozes as the deadline approaches, so the migration happens in January rather than on February 1.

On the **Conditional Access** side, use the migration to require the **“Phishing-resistant MFA” authentication strength** for administrators and sensitive apps, once passkeys are in place.

## Step 4: don’t forget SSPR

Self-service password reset also loses SMS and voice. If your users reset their password with an SMS code, plan other verification methods: **Microsoft Authenticator** notification or code, email address, or a helpdesk process. Microsoft has also announced the ability to change passwords for users who sign in passwordless, with no date yet.

## Step 5: third-party providers, for genuine edge cases

If you have a **regulatory or operational need** to keep SMS or voice (populations without a smartphone or the option of a FIDO2 key, compliance requirements), you can subscribe to a **third-party telecom provider** through **Microsoft Security Store**:

- the first available providers are **Soprano** and **Telesign**, with more to come at general availability;
- configuration in Entra is possible **from October 30, 2026**;
- the service is **paid**, depending on the provider, volume and countries;
- Microsoft recommends having it in place **at least four weeks before the deadline** and testing with a pilot group.

Users moved to a third-party provider before the deadline don’t get the blocking prompt. But keep in mind that you’re paying to keep the least secure method: document the need and limit it to populations with truly no alternative.

## The temporary opt-out: what it does, and what it doesn’t

If you don’t want Microsoft to automatically enable passkeys and the registration campaign, for example because you’re preparing a third-party provider or another method, a **temporary opt-out** exists. It’s set with Microsoft Graph (`Policy.ReadWrite.AuthenticationMethod` permission):

```powershell
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"

Invoke-MgGraphRequest -Method PATCH `
    -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy" `
    -Body @{ optOutSettings = @{ passkeyDynamicMigration = $true } }
```

It excludes your tenant from the automatic passkey and campaign enablement until **February 1, 2027**. It does **not** push back the end of SMS: on that date, the normal rules apply regardless of this setting. I advise against it in most cases: it delays user registration without solving anything.

## Step 6: communicate

Microsoft insists on this point, and I agree: communication is what makes a passkey rollout succeed. A three-stage plan, targeted at the SMS users group:

1. **Announcement**: SMS is ending, why, and which method replaces it;
2. **Action**: how to create a passkey, with a step-by-step guide per device type (Windows, iPhone, Android);
3. **Reminder**: follow-ups for users who still don’t have a phishing-resistant method.

Microsoft provides [communication templates](https://aka.ms/mfatemplates) for email, Teams and the intranet. Brief the **helpdesk** too: they’re the ones who’ll get the calls on February 1 if the migration isn’t finished.

## Licensing

**Passkeys are included in every Entra ID plan**, at no extra cost. Conditional Access and authentication strengths require **Entra ID P1**. Only the third-party telecom provider is an additional cost.

## My checklist

- [ ] Inventory with the `entra-sms-voice-usage-analyzer` script
- [ ] List of “SMS only” users and a dedicated security group
- [ ] Target method per population: Authenticator, Windows Hello for Business, FIDO2
- [ ] Passkey profiles reviewed (synced passkeys accepted or not)
- [ ] Passkey registration campaign active, with snoozes limited as the deadline approaches
- [ ] SSPR methods reviewed without SMS or voice
- [ ] FIDO2 keys for Global Administrators before July 1, 2027
- [ ] Internal guests handled before February 1, 2027
- [ ] Third-party provider evaluated only for justified cases, configured at least four weeks before the deadline
- [ ] User communications and helpdesk briefing
- [ ] Phishing-resistant authentication strength in Conditional Access

## What I recommend doing this week

1. **Run the inventory**: how many users only have SMS or voice? That number determines the size of the project.
2. **Choose the target method** per population and order FIDO2 keys now for those without a smartphone: procurement lead times matter.
3. **Take back control of the registration campaign** and send the first communication: every passkey created in November is one less helpdesk call on February 1.

## Key takeaways

- On February 1, 2027, Entra ID stops sending SMS messages and voice calls for MFA and self-service password reset (SSPR).
- Global Administrators and external (B2B) users get a reprieve until July 1, 2027; internal guests stay on February 1.
- After the deadline, a user who only has SMS or voice must create a passkey to keep signing in: the prompt can no longer be skipped.
- The passkeyDynamicMigration opt-out only delays the automatic passkey enablement: it does not push back the end of SMS.
- SMS remains possible with a paid third-party provider (Soprano, Telesign) through Microsoft Security Store, configurable from October 30, 2026.
- The priority: identify users who only have phone methods, then launch a passkey registration campaign.

## Frequently asked questions

### When do SMS and voice calls stop for Microsoft MFA?

On February 1, 2027 for all Entra ID users in the public cloud, except Global Administrators and external users, for whom it ends on July 1, 2027. Internal guests follow the February 1, 2027 date. Sovereign and government clouds will follow a later schedule.

### Will my users be locked out on February 1, 2027?

They don’t lose access to their account, but a user whose only MFA method is SMS or voice will have to create a passkey during sign-in before continuing. This prompt is blocking and cannot be postponed. Users who already have Microsoft Authenticator, a passkey, Windows Hello for Business or a FIDO2 key are not blocked.

### Is self-service password reset (SSPR) affected?

Yes. The end of Microsoft-provided SMS and voice applies across Entra ID, SSPR included. You need to plan other verification methods for password reset.

### Can we keep using SMS after February 2027?

Yes, but only with a third-party telecom provider subscribed through Microsoft Security Store (Soprano and Telesign initially), configurable from October 30, 2026. The service is paid and Microsoft reserves it for justified regulatory or operational needs.

### How do I delay the automatic passkey enablement?

With Microsoft Graph, by setting optOutSettings.passkeyDynamicMigration to true in the authentication methods policy (beta API, Policy.ReadWrite.AuthenticationMethod permission). This delays passkey and registration campaign enablement until February 1, 2027, but does not push back the end of SMS.

### Do passkeys cost extra?

No. Passkeys are included in every Microsoft Entra ID plan at no extra cost. Only a third-party provider to keep SMS or voice is paid.

## Sources and documentation

- [Microsoft Learn: passkeys by default and retirement of Microsoft-provided SMS and voice authentication](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement)
- [Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq)
- [Microsoft Learn: choose a telephony provider for SMS and voice authentication](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-phone-providers)
- [Microsoft Learn: plan a passkey deployment in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication)
- [GitHub: entra-sms-voice-usage-analyzer (Microsoft script)](https://github.com/microsoft/entra-sms-voice-usage-analyzer)
- [Office 365 for IT Pros: No More SMS One-time Codes and Voice Calls from Entra ID](https://office365itpros.com/2026/07/14/entra-sms-one-time-code/)
- [Jan Bakker: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication](https://janbakker.tech/passkeys-by-default-and-retirement-of-microsoft-provided-sms-and-voice-authentication-a-guide-to-stay-calm/)