---
title: SMS and voice MFA are ending in Microsoft Entra ID: what to finish before the end of 2026
description: Microsoft is retiring its own SMS and voice delivery for MFA. From 1 February 2027, neither will be a native Entra ID capability. What it means for your tenant, and why you should not leave the migration for January.
url: https://www.malachis.eu/en-US/news/entra-sms-retirement
published: 2026-08-01
modified: 2026-08-14
---

# SMS and voice MFA are ending in Microsoft Entra ID: what to finish before the end of 2026

**In short:** Microsoft is retiring its own delivery of SMS and voice calls for multifactor authentication. From **1 September 2026**, passkeys become the default sign-in experience in Microsoft Entra ID. From **1 February 2027**, SMS and voice will no longer be a native capability of the service. Organisations that have not migrated by then will have to buy a telecom provider of their own through the Microsoft Security Store — otherwise their users will hit a blocking prompt to register a passkey. **We recommend completing the migration by 31 December 2026.**

> **Source:** Message center MC1426371 · [Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication](https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement) · [Microsoft Security Blog, 13 July 2026](https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/)

---

## What changes, and when

| Date | What happens |
| --- | --- |
| **1 Sep 2026** | Gradual rollout to tenants begins. Users enabled for SMS or voice are automatically enabled for passkeys. Registration Campaign switches to the *Microsoft-managed* state and starts targeting passkeys. The registration prompt is skippable at this stage. |
| **18 Sep 2026** | Microsoft publishes details on customer-managed telecom providers in the Microsoft Security Store. |
| **30 Oct 2026** | Customers can start selecting and configuring their own telecom provider. |
| **1 Feb 2027** | Microsoft-provided SMS and voice are retired. The passkey registration prompt becomes **blocking** — users cannot sign in without completing it. |

A **temporary opt-out** is available until 1 February 2027 to delay the automatic passkey enablement and the registration campaign. There is no opt-out from the 1 February 2027 retirement itself.

---

## Why this is more than a technical detail

### 1. Keeping SMS means a new vendor and a new cost line — you do not want that

Today SMS verification is part of your licence. After 1 February 2027 it is not. Anyone who wants to keep it signs a contract with a telecom provider through the Microsoft Security Store — priced per message, varying by provider and region. Add vendor onboarding, a data processing agreement and a GDPR assessment. In other words: you would pay extra, and administer extra, in order to keep the weakest available authentication method. Migrating to passkeys costs nothing additional — passkeys are included in every Entra plan.

### 2. SMS and voice are practically breakable today, and not only by social engineering

An attacker does not need your password database. An adversary-in-the-middle phishing kit that relays the one-time code in real time will do, as will a SIM swap at the carrier or an automated bot that talks the code out of the user. Passkeys are phishing-resistant by construction: the private key never leaves the device and the credential is bound to a specific origin, so it cannot be replayed on a look-alike site.

### 3. The regulatory timeline has converged on the same dates

NIS2 national transpositions list multifactor authentication among mandatory technical measures — in the Czech Republic through the new Cybersecurity Act (Act No. 264/2025 Coll., effective 1 November 2025, with the transition period for implementing measures ending **1 January 2027**), and in Slovakia through Act No. 366/2024 Coll. amending Act No. 69/2018 Coll., plus NBÚ Decree No. 227/2025 Coll. on security measures. If you are working on NIS2 compliance while your MFA still runs on phone numbers, these are two projects worth merging into one.

### 4. Your own customers will start asking

Supply chain security is one of the NIS2 additions. Phishing-resistant MFA is now a standard line item in vendor security questionnaires. "SMS codes" is becoming a problem when defending a contract, not just during a security audit.

### 5. A blocking prompt in February is not a scenario you want to manage ad hoc

On 1 February 2027, users with no alternative method will not sign in until they register a passkey — on a device that has to be capable of it, with support that someone has to provide. That is a manageable project in November and a helpdesk incident in February.

---

## Three things that are routinely overlooked

**SSPR.** Passkeys **cannot be used** for self-service password reset. If your SSPR currently relies on SMS or voice, migrating to passkeys does not close that gap — you need a different method for password reset (Microsoft Authenticator, email, security questions). This is the most commonly missed part of the whole migration.

**Break-glass accounts.** Emergency administrator accounts often keep a phone number as a fallback method. They need to be moved to FIDO2 hardware security keys stored physically in a safe — and tested, so that you know sign-in actually works before you need it.

**Shared and operational devices.** Manufacturing, warehouses, point-of-sale, field staff, users without a company phone. A synced passkey in a password manager does not help here. The answer is a FIDO2 hardware key — which has to be ordered, distributed and inventoried.

---

## What we recommend: FIDO2, but not the same for everyone

A passkey is a credential based on the **FIDO2** standard. Entra ID supports two types, and the difference drives the design:

- **Device-bound passkeys** — the private key never leaves the device. This covers FIDO2 security keys, Windows Hello for Business, Entra passkey on Windows, and device-bound passkeys in Microsoft Authenticator. They support attestation, so you can enforce specific approved models via AAGUID.
- **Synced passkeys** — the key is encrypted and synchronised across the user's devices (iCloud Keychain, Google Password Manager, 1Password, Bitwarden). Substantially lower recovery and reissuance cost, but they **do not support attestation** — if you enforce it in a profile, synced passkeys are automatically excluded.

Our recommended segmentation:

| Segment | Recommendation |
| --- | --- |
| **Privileged accounts** (Global Administrator, Privileged Role Administrator, etc.) | FIDO2 hardware security keys, device-bound only, attestation enforced, AAGUID allow-list. Two keys per person — primary and backup. |
| **Office users with a corporate Windows device** | Entra passkey on Windows / Windows Hello for Business as the primary method, device-bound passkey in Authenticator as the mobile companion. |
| **BYOD, contractors, users without a corporate device** | Synced passkeys in a separate passkey profile without attestation. |
| **Shared and operational devices** | FIDO2 hardware security keys, shared or assigned per shift. |

**Passkey profiles** have been generally available since March 2026 — configuration is no longer a single tenant-wide setting but a named set of rules targeted at groups. This segmentation can therefore actually be deployed, not merely planned. Enforce it through Conditional Access authentication strength, not through a recommendation in an email.

---

## A plan for 31 December 2026

Why the end of the year rather than February? Microsoft itself recommends completing the transition at least four weeks before enforcement. In the Czech Republic the statutory transition period ends on 1 January 2027. And December change freezes combined with January helpdesk holiday coverage make January the worst possible month for this work.

1. **By end of August — establish scope.** Who is enabled for SMS/voice in the Authentication methods policy, who has actually registered a phone number, and who has no other method at all. These are three different numbers. Do not forget legacy MFA settings and SSPR. Microsoft has published a PowerShell script for this, the *Entra SMS/Voice Policy Scanner*.
2. **September — decide the direction.** Migrate to passkeys, or buy a telecom provider? For most organisations the answer is migration; a provider only makes sense where a specific regulation or operational reality genuinely requires phone-based verification.
3. **September–October — design the passkey profiles** along the segmentation above, pilot them with a test group, and order hardware keys. Lead times at the end of the year are not zero.
4. **October–November — communicate and deploy.** Run the registration campaign against the security group of SMS/voice users, not against everyone at once. Prepare per-device-type guidance and brief the helpdesk before the tickets start arriving.
5. **December — clean up the remainder** and remove SMS and voice from the Authentication methods policy. Turning it off yourself on a date you control always beats waiting for Microsoft to do it.

If you need more time, the temporary opt-out is a legitimate tool — for managing the transition, not for deferring the decision. After 1 February 2027 there is no deferral option left.

---

## Want to know where your tenant stands?

We deliver a **Passkey Readiness Assessment** for Microsoft 365 tenants. It is read-only, with no changes made to your environment, and all data stays inside your own Microsoft 365 tenant.

The deliverable is a report covering:

- The list of users at risk of being blocked on 1 February 2027, separated into genuinely at-risk and merely in-scope
- Analysis of the Authentication methods policy, the registration campaign state, and any legacy MFA settings still in place
- Review of break-glass accounts and SSPR dependencies on phone-based methods
- Passkey profile design per user segment, including attestation and AAGUID configuration
- Conditional Access and authentication strength recommendations
- Hardware key quantity and cost estimate
- A roadmap with dates through 31 December 2026, plus end-user communication templates in Czech, Slovak and English

**Questions, or want to order the assessment?** Email us at [support@malachis.eu](mailto:support@malachis.eu) or use the contact form.

---

*Based on Microsoft announcement MC1426371 and the associated Microsoft Learn documentation, as of 1 August 2026. Microsoft may adjust dates and technical details; we recommend verifying the current state in the [documentation](https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement).*