Worth Knowing
What is changing
Microsoft is changing how Microsoft Entra ID handles SMS and voice authentication as part of a broader move toward phishing-resistant authentication.
Beginning September 1, 2026, users enabled for SMS or voice are automatically enabled for passkeys and can be prompted to register a passkey during MFA sign-in. Microsoft-provided SMS and voice authentication is scheduled to retire for most users on February 1, 2027. Global Administrators and external users have a later retirement date of July 1, 2027. [learn.microsoft.com], [learn.microsoft.com]
That makes this more than a future authentication deadline.
The practical question is which people still depend on SMS or voice today and what each of those people will use instead.
Verified context
Microsoft says the primary driver for the change is security and is making passkeys the default authentication experience as part of its move from phishable authentication methods toward phishing-resistant methods. [learn.microsoft.com], [learn.microsoft.com]
The February 1, 2027 retirement does not apply identically to every user category. Global Administrators and external users follow the July 1, 2027 retirement date, while internal guest users remain in scope for February 1. [learn.microsoft.com], [learn.microsoft.com]
Organizations that still have a legitimate need for SMS or voice also have a Microsoft-supported telephony-provider path rather than Microsoft providing telephony delivery natively. [learn.microsoft.com], [learn.microsoft.com]
This is not simply a matter of turning one authentication method off and another one on.
Why it matters
Authentication is a shared business dependency.
A change can affect onboarding, people changing devices, users working away from company-managed devices, support teams, guests, administrators, and emergency-access practices.
Authentication changes can also reveal unclear ownership. One team may manage identity, another may manage devices, and another may own the business service a person is trying to reach.
A stronger authentication method is valuable, but the transition still needs to work for the people who depend on it.
Security improves when stronger authentication is usable, supported, and recoverable in the organization’s actual working environment.
Who should care
Business owners, Microsoft 365 administrators, security leads, HR and onboarding teams, service desks, and leaders responsible for continuity should be involved.
Organizations with external users, distributed workforces, shared-device scenarios, contractors, or people who rarely use a company-managed device may have additional circumstances to understand.
Administrators deserve separate attention because Microsoft’s published retirement timeline treats Global Administrators differently from most users. [learn.microsoft.com], [learn.microsoft.com]
Areas to review
Authentication methods currently enabled
Authentication methods actually being used
Users who still depend on SMS or voice
Readiness for supported alternatives
User registration patterns
Device availability
Recovery expectations
Guest and external-user access
Administrative accounts
Emergency-access practices
The objective is not simply to count authentication methods. The organization needs to understand which groups depend on which methods and where additional preparation or support may be required.
Questions worth asking
Who still relies on SMS or voice today?
Which people are likely to need additional support during the transition?
What happens when someone loses or replaces a device?
Are administrators being handled separately from ordinary users where appropriate?
Are guest and external-user scenarios understood?
Are emergency-access practices documented and protected appropriately?
Are support teams prepared to explain the change in plain language?
The answers help turn the Microsoft deadline into a manageable organizational transition rather than a last-minute authentication project.
A practical high-level path forward
A responsible planning sequence can begin with understanding current use rather than immediately enforcing a replacement method.
Inventory active methods and affected users. Determine where SMS and voice remain enabled and where they are actually relied upon.
Separate important user populations. Ordinary users, administrators, external users, internal guests, and exceptional access scenarios should not automatically be treated as one population.
Identify appropriate supported alternatives. Consider the methods and devices that fit the organization’s security requirements and working environment.
Run a limited registration pilot. Use a smaller population to identify communication, registration, support, and recovery issues.
Prepare support and recovery. Make sure people know where to get help and that support personnel understand the transition.
Communicate clearly. Explain what is changing, when it applies, what people need to do, and where assistance is available.
Expand deliberately. Broaden the transition after the organization understands the significant friction points and support requirements.
The goal is not merely stronger authentication. The goal is stronger authentication that the organization can operate successfully.
Key Takeaways
Microsoft is moving Microsoft Entra ID toward phishing-resistant authentication and making passkeys the default experience. [learn.microsoft.com], [learn.microsoft.com]
The retirement timeline differs by user category. Microsoft-provided SMS and voice authentication retires for most users on February 1, 2027, with Global Administrators and external users following on July 1, 2027. [learn.microsoft.com], [learn.microsoft.com]
Users, administrators, guests, recovery, and emergency access deserve deliberate review. Do not treat every access scenario as identical.
A controlled pilot and clear communication reduce transition risk. Registration, recovery, and support should be tested as part of the change.
Stronger authentication works best when it is planned as an operational transition. Security objectives and everyday working realities both matter.
