Microsoft Entra ID Is Moving Away from SMS Authentication: What Organizations Need to Know

Microsoft is making a major change to authentication in Microsoft Entra ID. Organizations that still rely on SMS or voice calls for multifactor authentication (MFA) need to start preparing for the retirement of Microsoft-provided SMS and voice authentication.

This is part of Microsoft's broader move toward phishing-resistant authentication, particularly passkeys and other passwordless authentication methods.

The change does not mean that every organization must immediately eliminate SMS. However, there are important deadlines that Entra administrators need to understand.

What is changing?

Microsoft has announced the retirement of Microsoft-provided SMS and voice authentication in Microsoft Entra ID.

The transition has two major dates:

September 1, 2026

Users who are currently enabled for SMS or voice authentication will be automatically enabled for passkeys, and Microsoft will begin nudging those users to register a passkey when they complete MFA.

February 1, 2027

Microsoft-provided SMS and voice delivery will be retired.

Organizations that still have a legitimate requirement for SMS or voice can use a customer-managed telecommunications provider through Microsoft's Security Store, subject to Microsoft's supported-provider model.

Microsoft recommends moving users toward phishing-resistant methods such as passkeys, Windows Hello for Business, or FIDO2 security keys.

Why is Microsoft moving away from SMS?

SMS has been widely used for MFA because it is simple and familiar. However, it is not considered a strong phishing-resistant authentication method.

Attackers can target SMS-based authentication through techniques such as:

SIM swapping

Social engineering against mobile operators

Phishing pages that capture one-time codes

Number-porting attacks

Interception or redirection of authentication messages

Microsoft describes SMS and voice as among the more vulnerable authentication methods and recommends phishing-resistant authentication instead.

The goal is therefore not simply to remove a feature. It is part of a larger identity-security strategy: move users from possession of a phone number toward cryptographic, phishing-resistant authentication.

What happens to existing SMS users?

This is an important distinction.

Microsoft is not saying that all SMS users will suddenly lose access on September 1, 2026.

Instead, from September 1, 2026, users who are enabled for SMS or voice in the relevant authentication policies will be automatically enabled for passkeys and will be encouraged to register one.

The registration campaign is designed to help organizations transition users before the final retirement date.

Users can initially snooze the registration prompt, but organizations should not treat this as a long-term solution.

From February 1, 2027, users who depend only on Microsoft-provided SMS or voice will no longer be able to use those methods normally. If they have no alternative authentication method, Microsoft says they will be required to register a passkey during sign-in before they can continue.

There is no opt-out from the February 1, 2027 enforcement.

What should Entra administrators do?

Organizations should start by identifying exactly who is using SMS and voice.

A good migration process looks like this:

1. Identify SMS and voice users

Review your Entra authentication-method configuration and identify users and groups that are currently allowed to use SMS or voice.

Microsoft recommends specifically identifying active SMS and voice users before beginning the migration.

This is important because simply disabling SMS without understanding who depends on it can create unnecessary account-access and help-desk problems.

2. Review your authentication methods policy

Microsoft recommends using the modern Authentication methods policy to manage authentication methods.

Administrators can configure which authentication methods are available to specific users or groups.

For example:

Employees

Microsoft Authenticator

Passkeys

Windows Hello for Business

Privileged administrators

FIDO2 security keys

Passkeys

Windows Hello for Business

Temporary / recovery scenarios

Temporary Access Pass

SMS should not be the primary authentication strategy for privileged identities.

Microsoft's documentation explains that authentication methods can be targeted to specific users or groups rather than simply enabled for everyone.

3. Deploy passkeys

Passkeys are one of Microsoft's preferred migration paths.

Passkeys use public-key cryptography rather than relying on a code sent through SMS.

Depending on the implementation, organizations can use:

FIDO2 security keys

Device-bound passkeys

Synced passkeys

Windows Hello for Business

This makes authentication significantly more resistant to traditional phishing attacks.

Microsoft recommends preparing a passkey deployment before the SMS/voice retirement deadline.

4. Consider Microsoft Authenticator

Microsoft Authenticator remains an important MFA option for many organizations.

However, organizations should distinguish between strong MFA and phishing-resistant MFA.

For highly privileged accounts, phishing-resistant methods such as FIDO2/passkeys or Windows Hello for Business should be strongly considered.

A useful identity-security strategy is therefore:

Standard users

Microsoft Authenticator + Passkey

Privileged users

FIDO2 / Passkey + Conditional Access

Emergency accounts

Strongly controlled emergency authentication strategy

What about organizations that still need SMS?

Microsoft recognizes that some organizations may have legitimate business, regulatory, technical, or operational requirements for SMS or voice.

Microsoft is introducing a Choose Your Own Telephony Provider model.

Instead of Microsoft providing the SMS/voice delivery infrastructure, organizations can use supported customer-managed telecommunications providers.

According to Microsoft's current documentation, information about supported providers is expected beginning September 18, 2026, while the configuration experience is scheduled to become available beginning October 30, 2026.

Organizations using this model will be responsible for selecting and managing their telecommunications provider.

There will also be costs associated with this model, including telecommunications-provider charges and potentially Azure consumption associated with the routing architecture.

Therefore, organizations should not automatically assume that moving to a third-party SMS provider is the best solution.

For most environments, migrating users to stronger authentication methods is the better long-term strategy.

Don't forget SSPR

One area that administrators should carefully review is Self-Service Password Reset (SSPR).

SMS may not only be used for MFA. It can also be involved in password-reset scenarios.

Microsoft Entra authentication policies and SSPR settings need to be reviewed together.

Microsoft explains that authentication-method policies can operate independently, and a method may remain available through another policy even after being disabled in one location.

Therefore, if the objective is to completely prevent SMS authentication, administrators need to verify all relevant policies and configurations rather than simply switching off SMS in one place.

A practical migration plan

A phased migration is safer than immediately disabling SMS for everyone.

Phase 1 : Discovery

Identify:

Users using SMS

Users using voice

Privileged accounts using SMS

Service/help-desk processes dependent on SMS

B2B and external users

SSPR dependencies

Legacy authentication configurations

Phase 2 : Risk assessment

Prioritize users based on identity risk.

For example:

Priority 1: Global Administrators and privileged accounts

Priority 2: IT administrators and security teams

Priority 3: High-risk or sensitive users

Priority 4: General workforce

Phase 3 : Deploy alternatives

Introduce:

Passkeys

FIDO2 security keys

Windows Hello for Business

Microsoft Authenticator

Use pilot groups before expanding the deployment.

Phase 4 : Conditional Access

Conditional Access can then be used to progressively enforce stronger authentication requirements.

For example, organizations can create policies requiring phishing-resistant authentication for privileged administrative access.

This allows the organization to move toward a Zero Trust authentication model rather than simply replacing one MFA method with another.

Phase 5 : Disable SMS where appropriate

Once users have successfully registered alternative authentication methods, remove SMS from the applicable authentication policies.

Monitor:

Sign-in logs

Authentication method registration

Authentication method usage

Conditional Access results

Help-desk incidents

Phase 6 : Prepare for February 2027

Before February 1, 2027, organizations should have a clear answer to one question:

Can every user who currently depends on Microsoft-provided SMS or voice authenticate using another supported method?

If the answer is no, there is still migration work to complete.

What about SMS as a primary sign-in method?

There is another important distinction.

SMS can be configured for authentication in different scenarios. Microsoft documents SMS-based authentication for both MFA and, where configured, first-factor sign-in.

The retirement should not be interpreted as simply replacing SMS with another SMS provider for every scenario.

Microsoft's telephony-provider documentation specifically states that the customer-managed provider model does not support SMS as a primary authentication method.

Organizations using SMS as a primary sign-in method need to migrate those users to supported alternatives such as passkeys, QR-code authentication, FIDO2 security keys, or other supported authentication methods.

The bigger picture: Identity is becoming passwordless

The retirement of Microsoft-provided SMS and voice authentication is part of a much larger change in identity security.

The direction is clear:

Passwords → MFA → Passwordless → Phishing-resistant authentication

For organizations running Microsoft Entra ID, this is an opportunity to rethink authentication rather than simply replace SMS.

A mature identity architecture should consider:

Phishing-resistant MFA

Conditional Access

Privileged Identity Management

Just-In-Time access

Zero Trust

Identity Governance

Access Reviews

Authentication strengths

Passkeys

FIDO2

Microsoft Authenticator

Windows Hello for Business

SMS was an important step in the evolution of MFA, but modern identity security is moving beyond it.

Final thoughts

The February 1, 2027 deadline may seem far away, but large organizations should not wait until the final months to begin migration.

The biggest challenge is not technically disabling SMS.

The real challenge is identifying every dependency on SMS, selecting an appropriate replacement, enrolling users, testing authentication, updating Conditional Access policies, and ensuring that privileged accounts have strong phishing-resistant authentication.

For most organizations, the recommended direction is clear:

Start with discovery → deploy passkeys/phishing-resistant authentication → migrate users gradually → enforce stronger authentication → retire SMS dependencies.

Organizations that plan early can turn Microsoft's SMS retirement into an opportunity to significantly improve their overall identity-security posture.