Microsoft is retiring SMS & voice MFA. Here's your timeline.
Those "we'll text you a code" sign-ins are going away. Microsoft Entra ID is making passkeys the default and switching off its own SMS and voice delivery — and the enforcement step has no opt-out. Here's what happens, when, and what a small business or MSP should actually do about it.
- 1 Sep 2026 — passkeys auto-enabled; every SMS/voice user starts getting "register a passkey" nudges at sign-in.
- 1 Feb 2027 — Microsoft-provided SMS/voice is switched off. Users whose only method is SMS/voice hit a blocking passkey-registration prompt. No opt-out, all tenants.
- The fix is simple and free: get those users onto the Authenticator app or a passkey before the deadlines — on your schedule, not Microsoft's.
Why this is happening
SMS codes can be phished in real time and stolen via SIM-swap; voice calls are no better. Microsoft's position is that neither counts as secure authentication anymore, so Entra ID is moving everyone toward phishing-resistant methods — passkeys, Windows Hello for Business, FIDO2 keys — which use cryptographic keys tied to your device instead of codes that can be read out or relayed. (This also matches where the ASD Essential Eight has been pushing for years: ML2 already expects phishing-resistant MFA for privileged users.)
The timeline
Passkeys become the default. Any user enabled for SMS or voice is automatically enabled for passkeys, and Microsoft's registration campaign starts nudging them to register one every time they complete MFA. Users can snooze it — indefinitely by default — but the prompts start whether you've communicated or not.
Customer-managed telecom option opens. Organisations with a genuine regulatory or operational need to keep SMS/voice can evaluate (from 18 Sep) and configure (from 30 Oct) a third-party telecom provider through the Microsoft Security Store — at their own cost. For most SMBs this is the wrong path; it exists for edge cases.
Microsoft-provided SMS and voice retired. Users whose only MFA method is SMS/voice can no longer sign in normally — they get a blocking prompt requiring passkey registration before they can continue. Microsoft is explicit: there is no opt-out from this, for any tenant.
Microsoft's official answer is "run this PowerShell script from GitHub." Ours: sign in read-only and click once. The free MFA coverage check now reports exactly how many users have SMS/voice registered, and — critically — who will hit the blocking prompt in Feb 2027, by name.
./run mfa-coverage-check --freeThe simple migration plan
- Find your exposed users (this week)
Run the tool above, or Microsoft's PowerShell analyzer. Two lists matter: everyone with SMS/voice registered (they'll get nudged from September), and everyone for whom it's their only method (they'll be blocked in February).
- Put them in a security group
Scope everything that follows — comms, the registration campaign, reporting — to that group, so the right people hear from you and nobody else gets noise.
- Tell them before Microsoft does (before 1 Sep)
One plain email: what's changing, why, what they'll be asked to do, and that the prompt is legitimate — not phishing. Microsoft publishes ready-made templates at aka.ms/mfatemplates. A workforce warned in advance generates no help-desk tickets; a surprised one generates plenty.
- Move them to Authenticator or passkeys
For most SMBs the practical path is: Microsoft Authenticator app first (fast, free, familiar), passkeys as they're ready. Enable Passkey (FIDO2) in Entra ID → Authentication methods, then turn on the registration campaign targeting your group — it nudges users at sign-in with no help-desk involvement. Admins should go straight to phishing-resistant (passkey, security key, or Windows Hello) — that's Essential Eight ML2 anyway.
- Verify, then remove SMS/voice (before 1 Feb 2027)
Re-run the coverage check until the exposed list is empty, then disable SMS/voice in your Authentication methods policy so nothing can drift back. Done before the deadline, on your terms.
passkeyDynamicMigration via Graph) if you need breathing room — but it expires 1 Feb 2027 regardless.Doing this across many tenants?
If you're an MSP, this is the same exercise multiplied — and a genuinely good reason to contact every client before September. Sentavo can run the assessment and migration under your brand. ./for-msps
Source: Microsoft Learn — Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (checked Aug 2026). Dates are Microsoft's and could shift; the direction won't.