Microsoft has announced through Message Center notification MC1426371 that SMS and phone calls will no longer be supported as built-in authentication methods in Microsoft Entra.
This is a major change for organizations still relying on telecom-based MFA methods.
Starting September 1, 2026, passkeys will become the default authentication experience in Microsoft Entra. SMS and voice calls will then be phased out and moved to a customer-configured provider model through the Microsoft Security Store.
What is changing?
Microsoft is moving Microsoft Entra toward stronger, phishing-resistant authentication methods.
In practical terms:
- Passkeys become the default and recommended authentication method.
- SMS and voice calls will no longer be available as native Microsoft Entra MFA methods.
- Organizations that still need SMS or voice will have to configure a third-party telecom provider through the Microsoft Security Store.
- The transition starts in 2026 and ends on February 1, 2027.
Microsoft explains the change clearly in its blog:
As identity attacks grow more sophisticated in the AI era, organizations need stronger authentication methods that protect users from phishing, credential theft, and social engineering. To address these evolving threats, Microsoft Entra ID is updating its authentication experience by making passkeys the default phishing-resistant authentication method, helping customers reduce reliance on phishable methods such as SMS and voice.
Microsoft also states that passwords, SMS one-time passcodes, and voice-based verification remain vulnerable to phishing, interception, and social engineering attacks.
Timeline
September 1, 2026
Microsoft starts the phased deployment.
For tenants with users enabled for MFA through SMS or voice call, either through the modern Microsoft Entra authentication methods policy or through legacy MFA settings:
- These users will be automatically enabled for passkeys.
- They will be placed into a passkey profile allowing all types of passkeys.
- Microsoft will automatically set the registration campaign to Microsoft managed in order to prompt these users to register a passkey.
- The next time these users sign in and complete MFA, they will be prompted to register a passkey.
- By default, they will be able to snooze this prompt without limit.
- This ability to snooze should not be interpreted as a lack of urgency: starting February 1, 2027, users whose only available MFA method is SMS or voice will be blocked until they register a passkey.
- End users must be informed about the upcoming change. Microsoft recommends using the passkey deployment guide to prepare the environment.
This does not mean SMS and voice calls stop working immediately, but it marks the beginning of the migration path toward passkeys.
September 18, 2026
The Microsoft Security Store allows organizations to evaluate third-party telecom operators.
This option is meant for organizations that cannot fully transition to stronger authentication methods yet.
It should be treated as an exception path, not as the target state.
October 30, 2026
Organizations that want to continue using SMS or voice calls can select an available telecom operator through the Microsoft Security Store.
From this point, SMS and voice move from Microsoft-provided methods to customer-configured telecom provider methods.
February 1, 2027
Microsoft discontinues SMS and voice call authentication as native Microsoft Entra MFA methods.
After February 1, 2027
Passkeys become the default and recommended authentication method.
Users whose only available MFA method is SMS or voice will be required to register a passkey during sign-in to continue accessing their account. This prompt will be blocking. Users must register a passkey before they can continue to sign in to their account.
There is no opt out from this February 1 behavior. It will be enforced for all tenants.
Migrate users to a phishing-resistant method or choose a telecom provider to continue using SMS or voice.
Why this matters
SMS and voice MFA have been useful transitional methods, but they are no longer strong enough for modern identity security.
They remain exposed to several risks:
- Phishing
- SIM swapping
- OTP interception
- Social engineering
- Voice call abuse
- User fatigue and poor assurance
Passkeys provide a stronger authentication model because they are phishing-resistant by design.
For Microsoft Entra environments, this is also consistent with the broader move toward passwordless authentication, Conditional Access, authentication strengths, and stronger identity protection.
What administrators should do now
Do not wait until 2027.
If your tenant still relies on SMS or voice MFA, start by identifying the impacted users and authentication method usage.
Recommended actions:
Review authentication methods usage Identify users still registered for SMS or voice authentication. You can use :
- User registration details on Entra portal
- or KQL if you have Log Analytics/Sentinel (for more KQL examples, see my dedicated post)
SigninLogs
| where ResultType == 0
| extend AuthenticationDetailsArray = parse_json(AuthenticationDetails)
| mv-expand AuthenticationDetailsArray
| where AuthenticationDetailsArray.authenticationMethod in ("Text message", "Phone call approval (Authentication phone)")
| extend AuthMethod = tostring(AuthenticationDetailsArray.authenticationMethod)
| project TimeGenerated, UserPrincipalName, AuthMethod, AppDisplayName, IPAddress, LocationPrepare passkey rollout Validate supported devices, user populations, onboarding flows, and helpdesk processes.
Review authentication method policies Make sure passkeys are enabled and aligned with your security requirements.
Plan communication Users need to understand what a passkey is, why they are being asked to register one, and what will change during sign-in.
Handle exceptions Some users, shared scenarios, or operational accounts may require a different transition path. Document these cases early.
Avoid making telecom fallback the default strategy The Microsoft Security Store option is useful for organizations with constraints, but it should not replace the move to phishing-resistant authentication.
Key takeaway
This is not just another MFA configuration change.
Microsoft is clearly moving Entra authentication away from telecom-based MFA and toward phishing-resistant methods by default.
If SMS and voice are still part of your MFA strategy, the migration window is now visible:
- September 1, 2026: passkeys become the default experience.
- February 1, 2027: native SMS and voice MFA are discontinued.
The right move is to start preparing passkey adoption now, before this becomes an urgent remediation project.