Microsoft is calling on administrators of Entra ID to retire SMS and voice-based authentication in favor of passkeys by February 1, 2027. This shift, outlined in Message Center notice MC1528000 posted October 27, targets both Worldwide and Government Community Cloud environments. Administrators are urged not to wait until the change is rolled out to their tenants to prepare users for the switch.
According to Microsoft, users who already have a registered alternative authentication method won’t need to set up a passkey—they’ll simply continue using the existing method. However, for users whose only verification option is via SMS or voice call, a one-time identity verification via their phone will be required before they must enroll a passkey to keep accessing their accounts.
Why Move Away from Phone-Based Authentication?
SMS and voice authentications are considered less secure due to vulnerabilities like phishing and SIM swapping. Attackers can intercept verification codes or hijack phone numbers. Passkeys mitigate these risks by relying on public-key cryptography under FIDO standards: the user’s device holds a private key, and Microsoft stores only the public key. When authentication is required, a challenge is signed locally using biometric verification or a PIN—this setup helps prevent credential theft through fake login portals.
Admins are advised to start by auditing which users rely solely on SMS or voice and prioritize those accounts. Organizations should help employees enroll passkeys or another supported alternative, notify relevant teams, and streamline the helpdesk’s support process.
Exceptions and Timeline
Organizations that need to keep phone-based authentication have an option: configuring a customer-managed telecom provider via Microsoft’s Security Store. This capacity will be available beginning October 30, 2026. Existing customer-managed providers are unaffected. But all Microsoft-provided SMS or voice authentication services must be phased out by February 1, 2027.
No action is required by organizations that already use other methods or maintain their own telecom providers—those setups don’t change under this policy.
What this means: this move pushes enterprises toward more secure, phishing-resistant authentication models. While implementing passkeys requires training, infrastructure adjustments, and user education, the payoff is stronger protection for accounts across Entra ID. Large organizations especially should start mapping current authentication states now, set internal deadlines, and ensure helpdesk systems and user support are ready before the deadline to avoid disruptions come February.
