Entra ID SMS MFA Retirement: How to Move Users to Passkeys

Text-message codes had a long run as the default second factor, but their time in enterprise sign-in is ending. Microsoft has reminded Entra ID administrators that Microsoft-provided SMS and voice authentication will retire starting February 1, 2027, and is urging organizations to move users to phishing-resistant methods such as passkeys now. The October 28 reminder, reported by BleepingComputer, gives security teams a clear deadline and a clear upgrade path.

• Deadline: Microsoft-provided SMS and voice authentication in Entra ID begins retiring on February 1, 2027
• Scope: Entra ID workforce tenants only, not Azure AD B2C or Microsoft Entra External ID customer scenarios
• Recommended replacement: passkeys, with QR code sign-in, FIDO2 security keys and other supported methods also available
• Fallback: organizations that must keep phone-based codes can configure a customer-managed telecom provider through the Microsoft Security Store

Why Is Microsoft Retiring SMS and Voice MFA?

Microsoft's message is straightforward: SMS and voice codes are vulnerable to phishing and SIM-swap attacks. A one-time code can be typed into a convincing fake login page just as easily as a real one, and an attacker who hijacks a phone number receives the codes directly. Passkeys close both gaps. They are bound to the legitimate website, so a lookalike domain simply cannot use them, and the private key never leaves the user's device or security key.

This is the final stage of a plan that has been building all year. In July, Microsoft said passkeys would begin rolling out as the default Entra ID authentication experience from September, automatically enabling passkeys for users who had SMS or voice enabled and prompting them to register one at their next multifactor sign-in. Microsoft also retired SMS first-factor sign-in for Entra ID Free tenants in August. If you want a refresher on how the technology works, our passkeys explainer covers the fundamentals.

How Do Admins Find Users Still on SMS?

Microsoft points admins to its Entra SMS/Voice Policy Scanner, a PowerShell script that admins with the Authentication Policy Administrator, Global Reader or Security Reader role can run to list users still relying on phone-based methods. From there, a sensible migration plan looks like this:

• Inventory: run the scanner and group users by department, device type and travel patterns
• Pick methods: Microsoft Entra supports synced passkeys, Microsoft Authenticator passkeys, Windows Hello for Business, FIDO2 security keys and certificate-based authentication
• Pilot first: start with IT and security staff, then expand team by team well before February
• Enforce: Microsoft recommends at least an Entra ID P1 license so Conditional Access can require phishing-resistant sign-in and reports can track progress

Are Passkeys Faster Than Passwords and SMS Codes?

Usually, yes, and that helps adoption. Microsoft's own deployment guidance cites analysis of consumer accounts showing password sign-in can take up to 24 seconds on average, while passkeys take around 8 seconds and synced passkeys only about 3 seconds. Microsoft notes those figures come from consumer sign-ins, but the direction is clear: stronger security that is also quicker for employees is the easiest security change to roll out.

The February 2027 date gives organizations just over three months, which is plenty of time if the work starts now. Treat this as an opportunity rather than a chore: every user moved to a passkey is one less account a phishing kit can capture. For more defensive guides, visit our AI security section.

Sources: BleepingComputer — October 28, 2026; Microsoft Learn: phishing-resistant passwordless authentication deployment — accessed October 29, 2026.