Microsoft has issued a recommendation for Entra ID administrators to transition from using SMS and voice authentication methods to passkeys. This shift is intended to mitigate phishing risks and avoid potential sign-in interruptions. The transition is advised to be completed before the deadline of February 1, 2027.
Transition Timeline and Scope
Announced on October 27 in Message Center notice MC1528000, the reminder follows previous communications from July. The retirement of SMS and voice authentication methods will affect both Worldwide and Government Community Cloud environments, with completion expected in early February 2027. Administrators are encouraged not to delay preparations for this transition.
Microsoft’s retirement notice clarifies that users who already have an alternative sign-in method will continue to use it without needing to register a passkey. Thus, verifying existing authentication methods is crucial for administrators as an initial step.
Impact on Users and Organizations
For users relying solely on SMS or voice authentication, Microsoft allows one last use of these methods to verify identity before mandating passkey registration. Organizations with a significant number of accounts dependent on phone-based methods must prioritize preparations for this transition.
While the transition to passkeys is emphasized, the retirement specifically targets Microsoft-provided phone authentication and does not entirely ban SMS and voice use across Entra ID.
Security Advantages and Implementation Steps
Passkeys offer enhanced security by reducing exposure to phishing and SIM-swap attacks, which can compromise verification codes or authentication phone numbers. Passkeys utilize public-key cryptography under FIDO standards, keeping the private key with the user’s authenticator while storing the public key on the service side.
Administrators should identify which users rely on SMS or voice, prioritize transitioning those without alternative methods, and assist in adopting passkeys or other supported options. Microsoft urges organizations to inform employees and helpdesk teams about the upcoming changes and registration procedures.
For organizations that wish to maintain phone-based authentication, Microsoft will allow configuration of a customer-managed telecom provider through the Microsoft Security Store, starting October 30, 2026. Existing customer-managed providers will remain unaffected, and those not using Microsoft’s SMS or voice services need not take additional action.
In summary, to bolster security and streamline authentication, Microsoft recommends a proactive migration to passkeys, ensuring readiness before the 2027 deadline.
