Microsoft is putting a firm expiration date on one of the most widely used — and most widely abused — forms of multi-factor authentication. The company has announced that native SMS and voice-call verification in Entra ID will be permanently retired by February 1, 2027, with passkeys becoming the default sign-in method for accounts well before that cutoff.

Why SMS codes are being phased out

Text-message and voice-call one-time codes have long been treated as a baseline security improvement over passwords alone, but Microsoft’s own guidance now frames them as a liability rather than a safeguard. The company pointed to a familiar list of attack techniques that specifically target this method: phishing kits that relay codes in real time, SIM-swapping schemes that hijack a victim’s phone number outright, social engineering against telecom support staff, unauthorized number porting, and interception of the underlying signaling protocols.

Passkeys are designed to close that gap structurally rather than procedurally. Because they rely on cryptographic key pairs bound to a specific device or credential manager, Microsoft notes there is “no reusable shared secret to enter on a fake website” — a phishing page can prompt a user for a code, but it cannot trick a passkey into authenticating against the wrong domain the way it can trick a human into reading out a six-digit number.

The migration timeline

Microsoft has laid out a staged rollout rather than an overnight switch:

• September 1, 2026: Users currently enrolled in SMS or voice authentication will automatically be enrolled for passkeys as well. During sign-in, they’ll begin seeing prompts encouraging passkey registration, with Microsoft managing the default rollout campaign while still allowing users to postpone registration temporarily.
• September 18 – October 30, 2026: Organizations that want to keep SMS or voice delivery beyond the cutoff must transition to a customer-managed telecom provider sourced through the Microsoft Security Store; provider details and configuration options become available during this window.
• February 1, 2027: Microsoft’s native SMS and voice delivery is retired entirely. Any user whose only configured MFA method is SMS or voice will be required to register a passkey before regaining account access, and Microsoft has been explicit that there will be no opt-out from this enforcement.

What counts as a passkey here

Entra ID’s passkey support spans both synced and device-bound implementations, giving organizations some flexibility in how they roll this out:

• Synced passkeys stored in platform ecosystems such as iCloud Keychain or Google Password Manager, which follow a user across their own devices.
• Device-bound passkeys tied to a specific piece of hardware, including Windows Hello for Business, Microsoft Authenticator, and FIDO2 hardware security keys.

That dual-track approach is deliberate: synced passkeys are easier for end users to adopt because they carry over automatically between a person’s own devices, while device-bound passkeys offer a stronger security guarantee for high-value accounts precisely because the credential cannot be copied or exported off the hardware it was created on. Large organizations are likely to end up running a mix of both, depending on the risk profile of a given role.

What IT administrators should be doing now

With roughly six months between the September auto-enrollment wave and the February hard cutoff, Microsoft is urging administrators not to wait. Recommended steps include using Microsoft’s PowerShell-based analyzer to identify exactly which users currently rely on SMS or voice as their MFA method, enabling FIDO2 passkey authentication tenant-wide, building targeted user groups for staged registration campaigns, and prioritizing Windows Hello for Business and hardware security keys for higher-risk accounts ahead of the broader rollout.

For organizations that have dragged their feet on passwordless authentication, this deadline effectively forces the issue. Given how frequently SMS-based MFA bypass shows up as a step in real-world intrusions — from helpdesk social engineering to SIM-swap fraud rings — the shift toward phishing-resistant credentials as a mandatory baseline, rather than an optional upgrade, marks one of the more consequential identity security changes Microsoft has pushed through Entra ID to date.