Microsoft is urging Entra ID administrators to move users to phishing-resistant authentication before the company retires its own SMS and voice authentication services on February 1, 2027. After that date, Microsoft-provided SMS and voice delivery will no longer be available as native Entra ID functionality, potentially disrupting sign-ins for users who still rely on those methods.
The deprecation applies only to Microsoft Entra ID employee-tenant authentication scenarios. It does not apply to Azure AD B2C or Microsoft Entra external ID customer identity scenarios.
Before the retirement, administrators should ensure that users in their organizations have enrolled in supported, phishing-resistant authentication methods. Once the change takes effect, SMS and voice authentication will no longer be available for completing multi-factor authentication or signing in to an account.
Supported alternatives include passkeys, QR code authentication, FIDO2 security keys and other Entra ID sign-in methods.
“SMS and voice authentication provided by Microsoft will be deprecated starting February 1, 2027. Please complete the transition before your deployment begins to avoid disrupting your users’ sign-in experience,” Microsoft said in a Microsoft 365 Message Center update on Tuesday.
Microsoft said SMS and voice authentication are vulnerable to phishing and SIM-swapping attacks. It recommends passkeys for stronger, phishing-resistant protection, while also offering organizations the option to use another supported authentication method.
Organizations that need to retain SMS and voice authentication can configure a customer-managed communications provider, known as CYOT, through the Microsoft Security Store. Phone-based authentication will otherwise require a third-party communications provider configured through that store.
How administrators can identify affected users
As Microsoft noted in a previous reminder issued in September, administrators with the Authentication Policy Administrator, Global Reader or Security Reader role can identify users who rely on SMS or voice authentication by using the Entra SMS/Voice Policy Scanner PowerShell script.
Passkeys become the default Entra ID authentication method
In July, Microsoft announced that it would begin rolling out passkeys as the default authentication experience for its Entra ID enterprise identity service starting in September.
“Once this rollout reaches organizations, users who have SMS or voice authentication enabled will also automatically have a passkey enabled and will be required to register for a passkey the next time they perform multi-factor authentication,” Microsoft said.
Microsoft added that it will retire Microsoft-provided communications delivery for SMS and voice authentication on February 1, 2027, ending SMS and voice as native Microsoft Entra functionality.
Microsoft also announced the obsolescence of SMS first-factor sign-in. The company stopped enabling Microsoft Entra ID Free tenants for newly created tenants in August because of the risks of phishing, fraud and account compromise.
Microsoft provides detailed guidance for planning and managing phishing-resistant, passwordless authentication with Entra ID on its dedicated documentation page.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com