SMS and Voice MFA End on February 1: Your Entra ID Migration Checklist

Microsoft stops delivering SMS and voice codes for Entra ID on February 1, 2027. That leaves about twelve weeks. After that date, users whose only MFA method is SMS or voice hit a blocking prompt and must register a passkey before they can sign in. You can’t opt out of that step.

If your tenant has used SMS for years, expect a long tail of users who never registered anything else. This post covers what changes, who it hits, the password reset problem most write-ups skip, and a checklist to get your tenant ready.

What Microsoft is changing

• September 1, 2026: Microsoft turned on passkeys for every user enabled for SMS or voice, and switched the registration campaign to Microsoft managed. Those users now get a passkey prompt after MFA, which they can snooze.
• October 30, 2026: Organizations that need SMS or voice can buy delivery from a telephony provider in Microsoft Security Store. Soprano and Telesign are the first providers.
• February 1, 2027: Microsoft-provided SMS and voice end for all users except Global Administrators and external users. Anyone whose only method is SMS or voice must register a passkey at their next sign-in.
• July 1, 2027: The same happens for Global Administrators and external users.

Passkeys cost nothing extra and work in every Entra ID plan. Users who sign in with Windows Hello for Business, a passkey or another phishing-resistant method today keep working as before.

Who falls under which date

Two details catch people out:

• Internal guests follow February 1. Only external users get the July date.
• Eligible Global Administrators count as regular users. If someone holds Global Administrator through PIM but hasn’t activated it, February 1 applies to them. The July date only covers an active role.

So your admin accounts don’t buy you extra time if you run them through PIM, as you should.

The SSPR gap

The retirement covers self-service password reset as well as sign-in, and passkeys don’t count as a method for SSPR. Microsoft’s authentication methods overview lists passkeys as usable for sign-in and MFA, but not for password reset.

The methods SSPR accepts are Microsoft Authenticator notifications, software and hardware OATH tokens, SMS, voice and email one-time passcodes. Authenticator and OATH tokens count as one method together.

Picture a user who resets their password with SMS plus Authenticator today, under a policy that requires two methods. Once SMS goes, they have one method left and the reset fails. They end up calling your help desk, the exact load SSPR exists to remove.

Microsoft says it plans to let passwordless users change their password, with details to come. Until then, fix SSPR yourself.

The checklist

1. Find out who uses SMS or voice. Microsoft publishes a PowerShell script that lists the users enabled for SMS or voice. Run it as Global Reader, Authentication Policy Administrator or Security Reader, and put the results in a security group.
2. Pick the replacement method per group. Passkeys in Microsoft Authenticator suit most users with a company or personal phone. Windows Hello for Business covers Windows sign-in. FIDO2 security keys work for shared devices, frontline staff and admins.
3. Fix SSPR before you remove SMS. Enable Email OTP for SSPR and make sure users have an alternate email registered. Then check the number of methods your policy requires. If it requires two, every user needs two methods that keep working after February 1.
4. Target the registration campaign. Go to Entra ID > Authentication methods > Registration campaign, set it to Microsoft managed and target the group from step 1. Users get a prompt to register a passkey the next time they complete MFA.
5. Tell users before they see the prompt. Microsoft’s end-user communication templates give you email and Teams text to adapt. Send an announcement, a how-to for each device type, and a reminder to anyone who hasn’t registered.
6. Buy a telephony provider only for a documented need. If a regulation or a scenario with no other option requires SMS, set up a provider in Microsoft Security Store for that group only. Microsoft recommends finishing setup at least four weeks before February 1, which means early January.
7. Clean up after users migrate. Remove users from the SMS and voice policy scope once they have registered and tested a passkey. That stops the nudge prompts and shrinks what’s left for February.

If you need more time

Microsoft offers a temporary opt-out from the automatic passkey enablement and registration campaign. It doesn’t move the February 1 date. Use it only to buy time for a telephony provider or a planned rollout.

Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"

$uri = "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy"

$body = @{
    optOutSettings = @{
        passkeyDynamicMigration = $true
    }
} | ConvertTo-Json

Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $body -ContentType "application/json"

This uses the Graph beta endpoint. Test it in a lab tenant first.

My recommendation

Run the usage script this week and treat the result as your project scope. Move everyone you can to passkeys in Authenticator, fix SSPR with Email OTP before the first users lose SMS, and keep a telephony provider for the few cases that need one. Starting in January leaves no room for the users who snooze the first prompts.

Sources: Microsoft Learn: Passkeys by default and retirement of SMS and voice, Microsoft Learn: SMS and voice retirement FAQ, Microsoft Learn: Authentication methods overview, Microsoft Learn: How SSPR works, MC1426371