Microsoft to Disable SMS and Voice Authentication in Entra ID Starting February 2027

Microsoft will begin retiring Microsoft-provided SMS and voice authentication in Microsoft Entra ID on February 1, 2027, requiring affected organizations to migrate users or arrange alternative telecom delivery before enforcement starts.

The change covers Worldwide and Government Community Cloud (GCC) environments, with rollout expected to finish in early February. Administrators should treat February 1 as the migration deadline rather than wait for their individual tenant’s transition.

The October 27 reminder, published as Message Center notification MC1528000, follows announcements issued in July 2026.

Microsoft identifies phishing and SIM-swap attacks as key reasons for moving away from telephone-based authentication, recommending passkeys as a stronger, phishing-resistant replacement. However, the retirement targets Microsoft’s delivery service, not every implementation of SMS or voice authentication within Entra ID.

Microsoft Entra ID Disable SMS and Voice Authentication

Users who already have another registered sign-in method will continue authenticating through that method without being forced to register a passkey.

The experience differs for accounts whose only registered method is SMS or voice: Microsoft will allow one final telephone-based identity verification, after which the user must register a passkey to continue signing in. This distinction makes it especially important to identify single-method accounts before the deadline.

The transition builds on Microsoft’s previously announced Entra ID passkey migration. Unlike SMS codes, passkeys use public-key cryptography and bind authentication to the legitimate service.

During authentication, an authenticator signs a challenge with its private key, and Entra verifies the response with the registered public key. This design reduces exposure to conventional credential-phishing attacks.

Telephone authentication carries different risks. In SIM-swap attacks, criminals fraudulently transfer a victim’s number to a SIM they control, potentially intercepting authentication messages and calls. Moving delivery to another telecom provider preserves functionality, but does not inherently eliminate these underlying weaknesses.

Organizations that must retain telephone authentication can configure Choose Your Own Telephony Provider (CYOT) through the Microsoft Security Store. Microsoft’s telephony provider guidance says configuration becomes available beginning October 30, 2026.

The selected provider delivers messages or calls, while Entra continues enforcing authentication-method policies and coordinating sign-in. Customers manage provider selection, agreements, coverage requirements, and service monitoring.

Administrators should inventory affected users, prioritize accounts without alternatives, and complete registration before rollout. Helpdesk teams need clear instructions explaining the deadline and mandatory passkey enrollment for telephone-only users.

Organizations should also communicate through trusted channels, reported passkey enrollment phishing campaigns show how attackers can exploit migration-themed messaging to register attacker-controlled credentials.

Existing customer-managed telecom configurations are unaffected. Organizations that do not use Microsoft-provided SMS or voice authentication need take no action for this retirement, while affected tenants should complete migration or provider configuration before February 1 to prevent avoidable sign-in disruption.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.