Microsoft will end self-delivered SMS and voice-based multi-factor authentication (MFA) in its enterprise identity platform, Microsoft Entra ID, on February 1, 2027. Users who rely solely on SMS or voice as their authentication method will be required to register a passkey before they can continue signing in after that date. That said, SMS itself won't disappear from Entra ID entirely. Organizations that need it for regulatory or operational reasons will be able to contract with a customer-managed telecom provider. In essence, this is a change that replaces the codes Microsoft distributes by default with passkeys, while treating users who keep SMS as an organization-managed exception.
Registration Push in September, Forced Migration in February
The migration will proceed in two stages: September 1, 2026, and February 1, 2027. In the first stage, users who have SMS or voice enabled—whether through the Entra Authentication Methods Policy or legacy MFA settings—will be automatically added to a profile that supports all types of passkeys. Once affected users complete MFA, a Microsoft-managed registration campaign will prompt them to set up a passkey. By default, users can defer this prompt indefinitely.
| Date | What Changes in Entra ID | Administrator Action |
|---|---|---|
| September 1, 2026 | Passkeys automatically enabled for SMS/voice users | Notify affected users and prepare a registration campaign |
| September 18, 2026 | Information on customer-managed telecom providers scheduled for release | Compare providers against regional, regulatory, and operational requirements |
| October 30, 2026 | Provider selection and configuration available in Microsoft Security Store | Contract and pilot with the necessary user groups |
| February 1, 2027 | Microsoft-provided SMS and voice delivery ends | Migrate users to passkeys or other methods, or configure a telecom provider |
What this schedule shows is that administrators' discretion differs between September and February. The automatic enablement and registration campaign in September come with a temporary opt-out. Using the Policy.ReadWrite.AuthenticationMethod permission in Microsoft Graph, administrators can configure the passkeyDynamicMigration setting in the authentication methods policy to delay the automatic rollout while migration work is underway. However, this setting only buys time. The February 1 cutoff is enforced across all affected tenants and cannot be opted out of.
If a customer-managed telecom provider isn't configured by the deadline, users won't be able to complete MFA via Microsoft's SMS or voice delivery. Users whose only available method is SMS or voice will see a blocking screen requiring passkey registration. They won't be able to proceed until registration is complete, though Microsoft hasn't stated that accounts will be locked out immediately. Users who already rely on phishing-resistant methods such as Windows Hello for Business or FIDO2 security keys will be able to continue using them without interruption.
Why Switch to Passkeys Now
The problems with SMS didn't emerge alongside AI. Current guidelines from the U.S. National Institute of Standards and Technology (NIST) classify SMS and voice delivered over the public switched telephone network (PSTN) as "restricted" authenticators, requiring checks for anomalies such as device swaps, SIM changes, and number porting before use. One-time passwords (OTPs) entered manually aren't bound to a specific authentication session, and because a fake site can simply forward the received code to the legitimate site, they offer no phishing resistance.
What AI does is make exploiting this known weakness faster and more scalable. Citing its 2025 Digital Defense Report, Microsoft states that click-through rates for AI-enhanced phishing have risen from the conventional 12% to as high as 54%. When attackers can mass-produce convincing text and fake sites and tailor the lures to each target, defenses that rely on humans spotting the deception become fragile. Even though an SMS code can only be used once, that single use is enough if it's stolen in real time.
Moreover, Microsoft anticipates that as AI agents begin accessing systems and executing workflows under user permissions, the damage from a compromised identity will spread further. This migration, then, isn't a response to AI having technically broken SMS. Rather, it's a measure to reduce the credentials users can hand over to fake sites in the first place, before attack automation and post-compromise privilege abuse become more widespread.
How Passkeys Work Without Sending a Code
Passkeys use the FIDO2 standard WebAuthn, authenticating through a public-private key pair unique to each service. Entra ID holds only the public key; the private key stays on the device or in a synced credential store. During sign-in, the private key signs a challenge sent by Entra ID, and the user approves the action with on-device biometrics or a PIN. Unlike SMS, there's no shared code that a person can read and type into a different screen.
What makes this phishing-resistant is that the key is bound to the specific service it was registered with. Even if a fake Microsoft sign-in page is opened, the key can't be used to sign a challenge for that domain. This also rules out the technique where an attacker relays entered values to the legitimate site. Microsoft states that these properties make passkeys resistant to remote phishing, SIM swapping, and replay attacks.
Organizations can choose methods based on their users and required assurance level. Synced passkeys, available through services like iCloud Keychain and Google Password Manager, are convenient for use across multiple devices. On the other hand, passkeys in Microsoft Authenticator or FIDO2 security keys can be bound to a specific device, and Microsoft recommends the latter for industries requiring high assurance or for privileged users.
Usability will also determine how well the migration succeeds. According to aggregated data from Microsoft's consumer services, the registration success rate for synced passkeys was 99%. Sign-in time reportedly dropped from 69 seconds—for password plus legacy MFA—to 3 seconds. The success rate was also reported at 95%, compared to 30% for legacy methods. While these figures aren't guaranteed to hold for enterprise Entra ID, they offer a useful reference point for estimating the registration burden of a large-scale rollout.
What Remains of SMS, and the Exception Administrators Must Decide on First
What ends on February 1 is the standard SMS and voice delivery that Microsoft provides directly within Entra ID. This initially applies to public cloud environments, with separate timelines to be announced later for other clouds. For cases where specific regulations require out-of-band SMS, or where alternative methods aren't feasible, organizations can select a telecom provider through the Microsoft Security Store. If an organization chooses to keep SMS, it will need to identify the necessary user groups itself and manage the contract and regional delivery on its own.
Personal Microsoft accounts operate on a separate migration timeline. Microsoft has indicated a policy of gradually removing SMS from authentication and recovery for personal accounts as well, replacing it with passkeys and verified email. However, the official support page doesn't specify an end date. The February 1, 2027 date for Entra ID cannot simply be applied to personal Microsoft accounts.
The first task for enterprise administrators is identifying which users currently have SMS or voice enabled. They should decide on an approach for passkey registration guidance by September 1, and if an exception is needed, review the provider information released on September 18. If contracting and piloting can begin from October 30, then February 1, 2027 won't arrive as a sudden lockout—it will simply be the day organizations switch over to an authentication policy they've already prepared for.