The end of SMS and voice calls for Microsoft MFA: what changes on February 1, 2027 and how to prepare

It is probably the most significant identity change since mandatory MFA for admin portals: Microsoft is ending SMS and voice calls in Entra ID. Announced on July 13, 2026 in message MC1426371, it takes effect on February 1, 2027 and covers MFA as well as self-service password reset (SSPR).

If some of your users still approve their sign-ins with a code received by SMS, you have a little over three months left. In this article, I cover the timeline, what actually happens on the day, and the migration plan I recommend.

Why Microsoft is dropping SMS

The reason is security. SMS and voice are among the weakest authentication methods:

• phishing: an SMS code can be typed into a fake sign-in page just as easily as into the real one;
• SIM swapping: an attacker who gets a new SIM card in your name receives your codes;
• interception and reassignment: diverted messages, numbers reassigned to someone else;
• social engineering: “Could you read me the code you just received?”.

Microsoft is making passkeys the default authentication experience in Entra ID. A passkey relies on a cryptographic key pair bound to the legitimate site: it resists phishing, SIM swapping and replay. And the impact is real: according to Microsoft, SMS and voice still accounted for 44% of MFA responses in 2024.

The timeline

Date	What happens
July 13, 2026	Announcement (MC1426371)
September 1, 2026	Users enabled for SMS or voice are enabled for passkeys; the registration campaign switches to “Microsoft managed” and prompts them to create a passkey, which they can postpone indefinitely
October 30, 2026	A third-party telecom provider can be configured through Microsoft Security Store
February 1, 2027	Microsoft-provided SMS and voice end for all users except Global Administrators and external users
July 1, 2027	End for Global Administrators and external users

A few important details:

• internal guests (guest accounts created in your directory) don’t get the July reprieve: they follow the February 1, 2027 date;
• this timeline covers the public cloud. Sovereign and government clouds will follow later;
• Azure AD B2C is not affected. For Microsoft Entra External ID, the change comes next year with a separate announcement.

What goes away, what stays

Method	After the deadline
SMS code (MFA and SSPR)	❌ Ended, unless third-party provider
Voice call (MFA and SSPR)	❌ Ended, unless third-party provider
Passkey in Microsoft Authenticator	✅ Recommended method
Synced passkey (iCloud Keychain, Google Password Manager)	✅
Windows Hello for Business, Entra passkey on Windows	✅
FIDO2 security key	✅
Microsoft Authenticator notification, TOTP codes, OATH tokens	✅ Unchanged
External MFA methods	✅ Out of scope, unless the user is also enabled for SMS or voice

The retirement targets Microsoft-provided SMS and voice in the authentication methods policy, as well as the legacy MFA and SSPR policies.

What happens on February 1, 2027?

Microsoft is clear about it: nobody loses access to their account. However:

1. an affected user can no longer use SMS or voice to answer MFA;
2. if it was their only method, they must create a passkey during sign-in. The prompt is blocking: it can no longer be postponed.

Picture Monday morning, February 1: every “SMS only” user having to create a passkey at the same time, some on an old phone or without a work smartphone. That’s a guaranteed flood of helpdesk calls. The whole point is to do this migration beforehand, at your own pace.

No opt-out for the deadline. Microsoft repeats it in its documentation: there is no way to push back the February 1, 2027 date (or July 1 for Global Administrators and external users). Only a third-party telecom provider lets you keep SMS.

Step 1: find out who is affected

Microsoft’s script

Microsoft publishes a PowerShell script, entra-sms-voice-usage-analyzer, that lists users enabled for and actively using SMS or voice. It requires one of the Global Reader, Authentication Policy Administrator or Security Reader roles. Any non-zero result means your tenant is in scope.

Users who only have phone methods

The users to handle first are those whose registered methods are all phone-based: they are the ones who will hit the blocking prompt. The authentication methods registration report lets you isolate them:

Connect-MgGraph -Scopes "AuditLog.Read.All"

$phone = 'mobilePhone', 'alternateMobilePhone', 'officePhone'
$details = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

# Users whose registered methods are all phone-based
$phoneOnly = $details | Where-Object {
    $_.MethodsRegistered.Count -gt 0 -and
    -not ($_.MethodsRegistered | Where-Object { $_ -notin $phone })
}

$phoneOnly | Select-Object UserPrincipalName, UserDisplayName, IsAdmin,
    @{ n = 'Methods'; e = { $_.MethodsRegistered -join ', ' } } |
    Export-Csv .\Users-SMS-only.csv -NoTypeInformation -Encoding UTF8

"{0} users only have SMS or voice" -f $phoneOnly.Count

In the admin center, Entra ID > Authentication methods > Activity also shows the breakdown of registered and used methods. Create a security group with these users: you’ll use it for the registration campaign and for communications.

Step 2: choose the target method

For the vast majority of users, the target is a passkey. Entra ID supports two families:

• device-bound passkeys: passkey in Microsoft Authenticator, Entra passkey on Windows, Windows Hello for Business, FIDO2 key. That’s what I recommend in the enterprise: the key never leaves the device;
• synced passkeys (iCloud Keychain, Google Password Manager): very easy for users, but the key lives in a personal account. Reserve them for populations where that’s acceptable.

My recommendations by population:

Population	Target method
Users with a work smartphone or managed BYOD	Passkey in Microsoft Authenticator
Managed Windows devices	Windows Hello for Business, deployed with Intune
Administrators, privileged accounts	FIDO2 key, at least two per person
Users without a smartphone (shop floor, retail, shared devices)	FIDO2 key, or a third-party provider if no other option works

Passkey profiles in the authentication methods policy let you restrict the accepted types, for example only Authenticator and FIDO2 keys, by filtering on AAGUID. Note that the September 1 automatic enablement puts affected users in a profile that accepts every type of passkey, synced passkeys included: check that this suits you.

Step 3: launch the registration campaign

This is the most effective tool to migrate at scale without overloading the helpdesk: at their next sign-in, users are prompted to create a passkey.

1. Check that Passkey (FIDO2) is enabled in Entra ID > Authentication methods > Policies for the target group.
2. Go to Entra ID > Authentication methods > Registration campaign.
3. Set the State to Microsoft managed (or Enabled to control the number of allowed snoozes yourself) and target the SMS users group.

Since September 1, Microsoft has already enabled this campaign for affected users, with unlimited snoozes. I recommend taking back control: limit the number of snoozes as the deadline approaches, so the migration happens in January rather than on February 1.

On the Conditional Access side, use the migration to require the “Phishing-resistant MFA” authentication strength for administrators and sensitive apps, once passkeys are in place.

Step 4: don’t forget SSPR

Self-service password reset also loses SMS and voice. If your users reset their password with an SMS code, plan other verification methods: Microsoft Authenticator notification or code, email address, or a helpdesk process. Microsoft has also announced the ability to change passwords for users who sign in passwordless, with no date yet.

Step 5: third-party providers, for genuine edge cases

If you have a regulatory or operational need to keep SMS or voice (populations without a smartphone or the option of a FIDO2 key, compliance requirements), you can subscribe to a third-party telecom provider through Microsoft Security Store:

• the first available providers are Soprano and Telesign, with more to come at general availability;
• configuration in Entra is possible from October 30, 2026;
• the service is paid, depending on the provider, volume and countries;
• Microsoft recommends having it in place at least four weeks before the deadline and testing with a pilot group.

Users moved to a third-party provider before the deadline don’t get the blocking prompt. But keep in mind that you’re paying to keep the least secure method: document the need and limit it to populations with truly no alternative.

The temporary opt-out: what it does, and what it doesn’t

If you don’t want Microsoft to automatically enable passkeys and the registration campaign, for example because you’re preparing a third-party provider or another method, a temporary opt-out exists. It’s set with Microsoft Graph (Policy.ReadWrite.AuthenticationMethod permission):

Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"

Invoke-MgGraphRequest -Method PATCH `
    -Uri "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy" `
    -Body @{ optOutSettings = @{ passkeyDynamicMigration = $true } }

It excludes your tenant from the automatic passkey and campaign enablement until February 1, 2027. It does not push back the end of SMS: on that date, the normal rules apply regardless of this setting. I advise against it in most cases: it delays user registration without solving anything.

Step 6: communicate

Microsoft insists on this point, and I agree: communication is what makes a passkey rollout succeed. A three-stage plan, targeted at the SMS users group:

1. Announcement: SMS is ending, why, and which method replaces it;
2. Action: how to create a passkey, with a step-by-step guide per device type (Windows, iPhone, Android);
3. Reminder: follow-ups for users who still don’t have a phishing-resistant method.

Microsoft provides communication templates for email, Teams and the intranet. Brief the helpdesk too: they’re the ones who’ll get the calls on February 1 if the migration isn’t finished.

Licensing

Passkeys are included in every Entra ID plan, at no extra cost. Conditional Access and authentication strengths require Entra ID P1. Only the third-party telecom provider is an additional cost.

My checklist

• Inventory with the entra-sms-voice-usage-analyzer script
• List of “SMS only” users and a dedicated security group
• Target method per population: Authenticator, Windows Hello for Business, FIDO2
• Passkey profiles reviewed (synced passkeys accepted or not)
• Passkey registration campaign active, with snoozes limited as the deadline approaches
• SSPR methods reviewed without SMS or voice
• FIDO2 keys for Global Administrators before July 1, 2027
• Internal guests handled before February 1, 2027
• Third-party provider evaluated only for justified cases, configured at least four weeks before the deadline
• User communications and helpdesk briefing
• Phishing-resistant authentication strength in Conditional Access

What I recommend doing this week

1. Run the inventory: how many users only have SMS or voice? That number determines the size of the project.
2. Choose the target method per population and order FIDO2 keys now for those without a smartphone: procurement lead times matter.
3. Take back control of the registration campaign and send the first communication: every passkey created in November is one less helpdesk call on February 1.