Microsoft Entra ID to Retire SMS Authentication by 2027
The platform will phase out native SMS and voice MFA in favor of phishing-resistant methods starting February 1, 2027.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust modern passwordless authentication methods more than traditional phone-based SMS codes?
Microsoft is set to retire its native SMS and voice authentication services for Entra ID workforce tenants on February 1, 2027. Administrators are required to transition users to phishing-resistant authentication methods, such as passkeys, to maintain uninterrupted access.
Why it matters
Traditional SMS and voice verification methods are susceptible to phishing and SIM-swap attacks, which compromise enterprise security. Moving away from these legacy vectors is part of a broader industry shift toward hardware-backed and cryptographic authentication protocols.
Microsoft began phasing out SMS first-factor sign-in for Entra ID Free tenants in August 2026 and introduced passkeys as a default method in September 2026. Administrators can audit current usage by running the Entra SMS/Voice Policy Scanner PowerShell script.
The players
Microsoft
A global technology company providing the Entra ID identity and access management platform used for enterprise security.
The details
The retirement forces a migration from telephony-based verification, which relies on public mobile networks to deliver one-time passcodes, to phishing-resistant alternatives. Passkeys, a FIDO-based standard, use public-key cryptography to authenticate users locally on their devices, effectively eliminating the potential for intercepting transmitted codes. While Microsoft is removing its own managed service, organizations may still utilize SMS or voice via a customer-managed telecom provider configuration.
Timeline
August 2026: SMS first-factor sign-in retired for Entra ID Free tenants.
September 2026: Passkeys rollout began as a default Entra ID authentication method.
February 1, 2027: Microsoft-provided SMS and voice authentication retirement begins.
The Tech Race
Microsoft is following an industry-wide trend toward eliminating knowledge-based and telephony-based authentication in favor of hardware-bound credentials. This move aligns the Entra ID platform with FIDO-based security standards to counter evolving phishing tactics.
IT administrators must audit current authentication policies using the provided PowerShell scanner before the February 2027 deadline to prevent sign-in failures. End users will transition to passkeys, which typically offer faster sign-in experiences by leveraging local device security.
The takeaway
Enterprises must prioritize migrating workforce authentication to modern protocols to eliminate known vulnerabilities in SMS and voice channels. Watch for updated Microsoft Entra ID management scripts that will signal the final phase-out of legacy support as the February 1, 2027 deadline approaches.
Further reading
Learn more about securing enterprise identities in the Cybersecurity section.
More information
Review the full phishing-resistant authentication deployment documentation for implementation guidance.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust modern passwordless authentication methods more than traditional phone-based SMS codes?
