Microsoft urges Entra ID administrators to migrate to passkeys before SMS sign-in is retired in 2027

Microsoft has reminded Entra ID administrators that they must migrate users to phishing-resistant authentication methods, such as passkeys, before the company retires SMS sign-in as a first factor starting in February 2027. The company offers alternatives already supported by Entra ID, among them QR code authentication and FIDO2 security keys, as well as other methods compatible with the service.

As Microsoft explained in an update published in the Microsoft 365 message center, the retirement will affect even organizations that use the "Choose Your Own Telephony Provider" option to keep SMS or voice as a multifactor authentication method. "The retirement of SMS sign-in as a first-factor authentication method applies even when Choose Your Own Telephony Provider is used to continue using SMS or voice as a multifactor authentication method," the company said, urging organizations that still rely on SMS as a first factor to migrate their users according to each scenario.

The move is not new: Microsoft already retired SMS sign-in as a first factor for free Microsoft Entra ID tenants in August, citing risks of phishing, fraud and account compromise, and since then it has not enabled this option for newly created tenants either. It should be noted that the retirement process is limited to authentication scenarios for Microsoft Entra ID "workforce" tenants, without affecting Azure AD B2C or Microsoft Entra External ID customer identity scenarios. The company has also published a detailed guide on deploying and managing phishing-resistant passwordless authentication in Entra ID in its official documentation.

The announcement is part of a broader shift: in July, Microsoft had already said that passkeys would become the default authentication method in Entra ID, with a rollout beginning this month. "As the rollout reaches each organization, users enabled for SMS or voice authentication will be automatically enabled for passkeys, and the next time they perform multifactor authentication, they will be prompted to register a passkey," the company said. After this transition, on February 1, 2027, Microsoft will retire the telecom delivery it provides directly for SMS and voice authentication, and will stop offering these options as a native Microsoft Entra capability.

To ease the transition, Microsoft points out that administrators with Global Reader, Authentication Policy Administrator or Security Reader roles can identify users who still depend on SMS or voice by running the Entra SMS/Voice Policy Scanner PowerShell script. Organizations that must continue using phone-based authentication for operational reasons will have to configure third-party telecom providers through the Microsoft Security Store.

Overall, the news confirms Microsoft's strategy of progressively abandoning SMS- and voice-based authentication factors —widely considered vulnerable to phishing, SIM swapping and interception attacks— in favor of more robust standards such as passkeys and FIDO2. For IT teams managing Entra ID environments, the message is clear: they have a defined deadline, until February 2027, to complete the migration of their users before SMS stops working as a native sign-in method.