Microsoft Entra ID

Microsoft Entra ID: Reminder to migrate from Microsoft-provided SMS and voice authentication

27 October 2026MC1528000 on mc.merill.net ↗Major update

In brief

Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.

Message Center announcement

What and why

This is a reminder of the upcoming retirement of Microsoft-provided SMS and voice authentication in Microsoft Entra ID, previously announced in MC1426371 (July 13, 2026) and MC1434201 (GCC, July 20, 2026).

Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience.

SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store.

Rollout schedule

Retirement (Worldwide and GCC): Beginning February 1, 2027, and expected to complete in early February 2027.
Complete migration or configure CYOT before February 1, 2027, rather than waiting for the rollout to reach your tenant.

Impact on your organization

Who is affected

Organizations and users that rely on Microsoft-provided SMS or voice authentication
Customer-managed telecom providers configured through the Microsoft Security Store are not affected.

Platforms and services

Microsoft Entra ID authentication

What will happen

Users with another registered sign-in method will use that method. They will not be required to register a passkey to continue signing in.
Users whose only registered sign-in method is SMS or voice can use SMS or voice one final time to verify their identity. They must then register a passkey before continuing sign-in.

Action required and recommendations

If your organization uses Microsoft-provided SMS or voice, complete these steps before February 1, 2027:

Identify affected users. Review who relies on SMS or voice, especially users with no other registered sign-in method.
Complete migration. Help affected users register and start using passkeys or another supported authentication method before rollout begins.
Configure CYOT if you need to retain SMS or voice. Configure a customer-managed telecom provider through the Microsoft Security Store before rollout begins.
Notify users and your helpdesk. Explain the deadline, required actions, and the passkey-registration requirement for users who only have SMS or voice registered.

If your organization does not use Microsoft-provided SMS or voice, no action is required for this retirement.

Learn more

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.