Remote SupportWhat Is Changing
Microsoft announced on 13 July 2026 that Entra ID is making passkeys the default phishing-resistant authentication method, and from 1 September 2026 users enabled for SMS or voice in the Entra Authentication Methods Policy are auto-enabled for passkeys and nudged to register one at their next MFA sign in, so as of October 2026 the auto-enablement stage is already live in every tenant. Microsoft Security Blog, Microsoft Entra ID security updates.
The retirement is specifically for Microsoft-provided telecom delivery, not SMS as a concept, and from 30 October 2026 customers who still need SMS or voice can select and configure a supported telecom provider through the Microsoft Security Store, with Soprano and Telesign named as the initial providers available during private preview and more providers becoming available by general availability. Microsoft Learn, Passkeys by default and retirement of SMS and voice.
Microsoft has announced (Message Center notification MC1426371, backed by a Microsoft Security Blog post and official Entra documentation) that Entra ID is making passkeys the default multifactor authentication experience. The stated driver is simple: to help enterprises adopt AI at scale, Microsoft wants every organisation on phishing-resistant authentication by default. SMS and voice are no longer positioned as secure methods and will no longer be provided natively in Entra ID.
Need to explain passkeys to staff first? Share our plain-English passkey guide.
This is not a minor admin setting change. If your organisation relies on SMS or voice MFA through Microsoft, those methods will stop working after 1 February 2027 unless you take action. The good news is that there is a clear runway and a fallback option for organisations that genuinely cannot move everyone to passkeys in time.
The short version
Passkeys become the default. SMS and voice MFA provided by Microsoft get retired. The transition window runs from September 2026 to February 2027 (July 2027 for Global Administrators and external users), with a telecom provider fallback available from 30 October 2026 if you still need SMS for some staff.
The bottom line from Microsoft: every SMS and voice user must be on a phishing-resistant method, with passkeys recommended, before Microsoft-provided SMS and voice retire on 1 February 2027. The auto-enablement stage has now started, so the remaining window to move users on your own schedule runs until that February cutoff.
Key Dates and What Happens at Each One
Four dates govern the transition: 1 September 2026 when passkeys auto-enable for SMS and voice users, 30 October 2026 when the telecom provider window opens in the Microsoft Security Store, 1 February 2027 when Microsoft-provided SMS and voice retire for all users except Global Administrators and external B2B users, and 1 July 2027 when the retirement extends to those groups, with internal guest users following the February date. Microsoft Learn, FAQ for SMS and voice retirement.
Four dates matter. Each one changes what your users see and what you as an admin can control.
1 September 2026
Passkeys auto-enabled
Anyone currently set up for SMS or voice MFA gets passkeys automatically enabled, and your registration campaign moves to a Microsoft managed state pointing at passkeys. Users are nudged to register a passkey at their next MFA sign in. By default they get unlimited snoozes of the nudge, so nobody is locked out yet. If you do not want this auto-enablement, move users out of SMS or voice in the Authentication Methods Policy before this date.
30 October 2026
Telecom provider window opens
If your organisation still needs SMS or voice MFA, you can configure your own telecom provider through the Microsoft Security Store. This is the path forward for orgs that cannot move everyone to passkeys in time.
1 February 2027
SMS and voice retired for most users
Microsoft stops providing SMS and voice as MFA options for all users except Global Administrators and external (B2B) users, who have until 1 July 2027. Any in-scope user whose only available MFA method is SMS or voice hits a blocking prompt to register a passkey before they can continue. The only way to keep SMS or voice after this date is through a telecom provider you configured yourself.
1 July 2027
SMS and voice retired for Global Admins and external users
Microsoft-provided SMS and voice authentication retires for Global Administrators and external (B2B) users. Internal guest users are not in this group and follow the 1 February 2027 date. Move these accounts to a phishing-resistant method or a configured telecom provider before this date.
Important distinction
Microsoft is retiring the SMS and voice MFA that it provides. It is not banning SMS as an MFA concept. If you configure your own telecom provider through the Microsoft Security Store (available from 30 October 2026), SMS and voice remain available through that provider. This is the key fallback for organisations with frontline or deskless staff who cannot easily use passkeys.
Every tenant. No opt-out.
After 1 February 2027 (1 July 2027 for Global Administrators and external users), passkey registration becomes a blocking prompt with no opt-out. A user whose only method was a phone number cannot get past it until they register a passkey.
Who This Hits Hardest
The populations hit hardest are frontline and deskless staff in warehouse, retail, construction, healthcare and field roles who may not have a company laptop, shared device and hot-desk environments where per-user passkey enrolment is harder, guest and B2B collaborators whose home organisation controls some of the MFA configuration, and break-glass or emergency accounts that some organisations have enrolled with SMS as the factor and now need a hardware key instead. Microsoft Learn, Passkeys by default and retirement of SMS and voice.
SMS and voice already feel like edge cases in most identity conversations. But this change might reach more people than it looks like on paper, especially anywhere frontline or deskless staff make up a big share of the workforce.
Frontline and deskless staff
Warehouse, retail, construction, healthcare and field workers who may not have a company laptop or easy access to the Microsoft Authenticator app. SMS has been the fallback that works on any phone.
Shared device environments
Kiosks, shared workstations and hot-desk setups where individual device enrolment for passkeys is harder to manage. These setups often leaned on SMS as the simplest per-user factor.
Guest and B2B users
External collaborators and guest accounts in your Entra tenant may be enrolled with SMS MFA. Their home organisation controls some of this, but you need to know who they are and what happens when SMS disappears.
Break-glass and emergency accounts
Some orgs use SMS as the MFA factor on emergency access accounts. These need a documented plan and ideally a hardware key instead, not a phone number that can be SIM-swapped.
If your workforce is mostly office-based with company laptops, this change is relatively straightforward. Microsoft Authenticator push with number matching is likely already deployed, and moving to passkeys is a small step. The complexity is in the populations above, where SMS has been the lowest common denominator that works everywhere and needs no device refresh or extra training.
Why Microsoft Is Doing This
Microsoft states that SMS and voice are among the most vulnerable authentication methods available today, providing significantly weaker protection against phishing, SIM swap and replay attacks than passkeys, and that moving to phishing-resistant methods is a precondition for adopting AI at scale, so the retirement is framed as a security uplift the AI era demands rather than an administrative deprecation. Microsoft Security Blog, Microsoft Entra ID security updates.
The ACSC Essential Eight Maturity Model recommends phishing-resistant MFA and explicitly lists SMS as not suitable for privileged accounts at higher maturity levels, so moving from SMS to passkeys aligns your tenant with what the ACSC and most cyber insurers now expect, and removes the method that was already a gap on insurance proposals. ACSC Essential Eight maturity model.
Microsoft's framing is blunt: SMS and voice are among the most vulnerable authentication methods available today, providing significantly weaker protection against phishing, SIM-swap and replay attacks than passkeys. The official line is that moving to phishing-resistant methods gives your organisation stronger security by default, and that this is a precondition for adopting AI at scale. Here is why passkeys are the replacement.
SMS weaknesses
- + Vulnerable to SIM swap attacks where an attacker ports your number to their device
- + Susceptible to SS7 signalling interception on the telecom network
- + Can be relayed in real-time phishing kits that capture and forward the code
- + Depends on mobile coverage and carrier reliability
Passkey advantages
- Phishing-resistant by design. Cryptographically bound to the domain
- No SIM dependency, no carrier interception risk
- Works with Windows Hello, Face ID, fingerprint and hardware keys
- Aligns with ACSC Essential Eight phishing-resistant MFA expectations
ACSC alignment: The Essential Eight Maturity Model recommends phishing-resistant MFA and lists SMS as not suitable for privileged accounts. Moving to passkeys brings your organisation closer to what the ACSC and most cyber insurers now expect.
Two types of passkey in Entra ID
Microsoft supports two passkey flavours. Both are phishing-resistant, but the deployment looks different.
Synced passkeys
Saved to a platform credential manager such as iCloud Keychain or Google Password Manager and synced across the user's devices. Best for staff who already use a platform credential manager on their phone.
Device-bound passkeys
Created and stored on a single device, such as Passkey in Microsoft Authenticator, Entra Passkey on Windows, or a FIDO2 hardware security key. Best for shared devices and break-glass accounts.
What to Do Now
Because the 1 September 2026 auto-enablement date has now passed, the practical steps are to audit who is using SMS or voice today using the Entra authentication methods report, deploy the Microsoft Authenticator app to all company and BYO devices, enable FIDO2 security keys and passkeys in the authentication methods policy before the auto-enablement nudges users, and identify who genuinely cannot use a passkey so you can budget for hardware keys and plan the telecom provider fallback from 30 October 2026. Microsoft Learn, Passkeys by default and retirement of SMS and voice.
The 1 September 2026 auto-enablement date has arrived, so the passkey registration nudge is either appearing for your SMS and voice users now or is about to. Nobody is locked out yet, and the steps below still apply. Work through them to get ahead of the 1 February 2027 cutoff rather than meeting it as a blocking prompt.
Audit who is using SMS or voice today
In the Entra admin centre, check the authentication methods report. Export the list of users with SMS or voice as their registered MFA method. This is your migration scope.
Deploy the Microsoft Authenticator app broadly
Get the Authenticator app onto every company and BYO device now, before the September prompt starts appearing. Users who already have the app with push notifications can move to passkeys with minimal friction.
Enable passkeys in your tenant
In Entra authentication methods policy, enable FIDO2 security keys and passkey (Microsoft Authenticator) before Microsoft auto-enables them. This lets you control the rollout timing and communication.
Identify who genuinely cannot use a passkey
Some staff will not have a compatible device or will need a hardware security key. Identify these people now so you can budget for keys and plan the telecom provider fallback if needed.
Communicate the change to staff
Tell people what is happening, when, and what they will see. A short heads-up before September prevents helpdesk spikes when the passkey registration prompt appears during sign-in.
Plan your Conditional Access updates
Review your Conditional Access policies. If any policies explicitly require or allow SMS as an authentication method, update them. Your phishing-resistant MFA policies should already favour passkeys and hardware keys.
The Telecom Provider Option
Soprano and Telesign are the initial telecom providers available during private preview from 30 October 2026, with more providers becoming available by general availability, and the organisation is responsible for the provider relationship, configuration and any associated costs, so this is a targeted fallback for specific user populations like frontline staff, not a reason to delay passkey adoption for everyone who can use one. Microsoft Learn, Passkeys by default and retirement of SMS and voice.
From 30 October 2026, you can configure your own telecom provider through the Microsoft Security Store. This is the official path for organisations that still need SMS or voice MFA after Microsoft retires its own SMS and voice options.
How the telecom provider option works
You select and configure a telecom provider in the Microsoft Security Store. Soprano and Telesign are the initial providers available during private preview, with more providers becoming available by general availability. That provider handles the SMS and voice delivery for your tenant. You are responsible for the provider relationship, configuration, and any associated costs. Microsoft no longer acts as the telecom intermediary.
This option is a relief for organisations with frontline or deskless staff. It gives you a real path forward instead of a hard cutoff. But it should be a targeted fallback for specific user populations, not a reason to delay passkey adoption for everyone who can use one.
Use it for who actually needs it
Identify the specific users or roles where passkeys are genuinely not viable. Configure the telecom provider for those populations, not the whole tenant.
Budget for the provider costs
Unlike Microsoft-provided SMS, a third-party telecom provider has its own pricing. Factor this into your identity and security budget for the 2027 financial year.
Keep working on passkey adoption
The telecom provider is a bridge, not a destination. Continue moving users to passkeys where possible, and revisit your SMS-dependent population each quarter.
Check Your Current MFA Setup
Before you can plan your migration, you need to know who is using SMS or voice today. Here is how to check.
1. Open the Entra admin centre
Go to entra.microsoft.com and navigate to Protection then Authentication methods then Activity.
2. Check the registered methods report
Look at the registration count for each authentication method. Filter for users with SMS or voice as their primary or only registered method. Export this list.
3. Review your authentication methods policy
Check whether SMS and voice are currently allowed or targeted for specific groups. Review your FIDO2 and passkey settings to see if they are already enabled or still in the default state.
4. Check Conditional Access policies
Review any Conditional Access policies that require MFA. Identify policies that explicitly allow SMS as an acceptable method. These will need updating to favour phishing-resistant methods.
If you are not sure where to start or do not have an Entra ID admin on staff, this is exactly the kind of thing we help with. We can run the audit for you and give you a clear report of who is on SMS, what needs to change, and a timeline to get it done before February 2027.
Migration Checklist
A practical checklist to work through between now and February 2027.
Common questions
Will SMS MFA stop working for my users on 1 September 2026?
What happens after 1 February 2027 if I do nothing?
Can I keep SMS MFA after February 2027?
Does this affect Google Workspace or other non-Microsoft platforms?
Are passkeys phishing-resistant?
Does this align with ACSC Essential Eight guidance?
Sources
- Microsoft Message Center notification MC1426371 and the accompanying Microsoft Security Blog announcement on phishing-resistant authentication by default.
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (official migration guidance, including the PowerShell usage analyser and registration campaign steps).
- Always verify the latest details and any updates in your own Microsoft 365 admin centre Message Center, as Microsoft may adjust timelines or scope. This guide reflects the announcement as published in August 2026.
Need help moving off SMS MFA?
We audit your Entra tenant, identify every user on SMS or voice, deploy passkeys and the Microsoft Authenticator app, configure Conditional Access, and set up the telecom provider fallback if you need it.