This is the biggest authentication change in Entra ID for years. Microsoft is retiring the SMS and voice call authentication it delivers itself, and is pushing users towards passkeys instead. If any of your users still verify with a text message or a phone call, this affects you.

What's actually retiring

The change covers Microsoft-provided SMS and voice: the codes and calls Microsoft's own telephony service sends. It applies to SMS and voice in the Authentication Methods Policy, to the legacy MFA settings, and across Entra including self-service password reset.

Two things are not retiring. External MFA methods are unaffected. And organisations that genuinely need SMS or voice can keep it by contracting with a third-party telephony provider through the Microsoft Security Store.

The scope is the public cloud. Government clouds follow later, Azure AD B2C is out of scope, and External ID is getting its own announcement.

The timeline

Date	What happens
1 Sep 2026	Passkeys are switched on automatically for users enabled for SMS or voice. A Microsoft-managed registration campaign nudges them to register a passkey at their next MFA sign-in. They can snooze it.
30 Oct 2026	Third-party telephony providers become configurable in the Microsoft Security Store.
1 Feb 2027	Retirement for all users except Global Administrators and external users. Anyone whose only method is SMS or voice gets a blocking prompt to register a passkey.
1 Jul 2027	Retirement for Global Administrators and external users.

Users won't be locked out. Anyone still relying only on SMS or voice gets a registration prompt they can't skip, and must set up a passkey before carrying on. For a busy service desk, that's still a Monday morning you want to avoid.

What to do now

Measure your exposure. Microsoft publishes an entra-sms-voice-usage-analyzer PowerShell script on GitHub. Any non-zero result means your tenant is in scope.
Decide passkeys or provider. Without a regulatory or operational reason to keep SMS, plan for passkeys. If you do need SMS, line up a telephony provider and move users before their retirement date.
Plan your passkey rollout. Use passkey profiles to set different rules for admins and standard users, and decide whether synced passkeys (stored in a passkey provider and shared across devices) are acceptable for each group.
Use the registration campaign. It now supports passkeys, so users are prompted at sign-in rather than chased by email.
Don't forget the edges. Shared mailboxes with MFA, break-glass accounts, frontline workers without smartphones and guests all need a plan.

Need more time?

There's a temporary opt-out that delays the automatic passkey enablement and registration campaign until 1 February 2027, while you set up a provider or migrate users. It's set through Graph:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json

{
  "optOutSettings": {
    "passkeyDynamicMigration": true
  }
}

Important: the opt-out only delays the rollout. It does not stop enforcement. From 1 February 2027 the retirement applies regardless.

Sources