A lot of small businesses use SMS-based multi-factor authentication for Microsoft 365. A texted six-digit code is how most of your employees "do MFA" today.
That's about to change. Microsoft has announced the retirement of Microsoft-provided SMS and voice calls for authentication, with a phased transition.
Affected users may be prompted to register passkeys. Review your tenant's authentication methods now so you can prepare before the applicable deadline.
What's Changing
Microsoft is retiring its own SMS and voice delivery for Microsoft Entra ID. It is encouraging passkeys, a phishing-resistant sign-in method. Organizations with a supported telephony provider can continue to use SMS or voice where needed.
The rollout is phased. For most affected users, Microsoft-provided SMS and voice MFA ends February 1, 2027; Global Administrators and external users follow a July 1, 2027 date.
This doesn't affect the Microsoft Authenticator app's push approvals or passkeys already registered there — those continue to work. The change concerns Microsoft-provided SMS and voice delivery, rather than every possible SMS or voice service.
Why Microsoft Is Doing This
SMS authentication has been the weakest link in MFA for years. The reasons are well documented:
SIM swapping lets attackers take over a phone number and receive the codes themselves.
Texted codes can be intercepted or forwarded without the user knowing.
SMS is vulnerable to phishing — a fake login page happily collects the code along with the password.
Voice calls are no stronger and carry the same weaknesses.
Passkeys close those gaps. They're tied to a specific device and a specific website, so a passkey stolen through a fake login page simply won't work on the attacker's end. It's a meaningful security upgrade — but it does require action.
What Passkeys Actually Are
A passkey is a credential stored on a device — your phone, a laptop, or a hardware security key — that proves who you are without sending a code over a network. When you sign in, the device uses biometrics (Face ID, fingerprint) or a PIN to unlock the passkey and approve the login.
Phishing-resistant. A passkey only works for the real website it was created for. A fake login page can't capture it.
Nothing transmitted to intercept. Unlike a texted code, no secret travels over a network that an attacker could grab.
Tied to the device. The credential lives on hardware you control, unlocked by something you are (biometrics) or know (PIN).
Already supported. Microsoft Authenticator, iOS, Android, Windows, and hardware keys like YubiKey all support passkeys today.
Important Dates
Microsoft begins automatically prompting users who rely on SMS or voice authentication to register a passkey.
Microsoft-provided SMS and voice MFA ends for most users; some user groups have a later date.
Affected users must register a passkey during sign-in before continuing, unless their organization has configured an eligible telephony provider.
What This Means for Your Business
Review which users depend on Microsoft-provided SMS or voice. Users with other registered methods may need less preparation, while SMS-only users should plan for passkey registration.
A required registration prompt can interrupt sign-in if users are unprepared. Communicate the change and make sure they have a supported method before the deadline.
How to Prepare
A short, practical plan:
Audit your current MFA methods. Find out which users are relying on SMS or voice codes today. Microsoft's admin center shows this per user.
Register passkeys now, not later. Don't wait for the prompts. Register passkeys on supported devices (phones, hardware keys) ahead of the deadline.
Keep a backup factor. Every user should have at least two registered sign-in methods so a lost device doesn't lock them out.
Plan for users without modern devices. Some employees on older phones may need a hardware security key. Budget for it now.
Communicate the change. Tell your team what's happening and why. Surprise prompts in the middle of the workday create support tickets and confusion.
The Bottom Line
Microsoft-provided SMS and voice MFA is being retired for affected users. Passkeys offer stronger protection, and an early review can reduce sign-in disruption.
Audit authentication methods, help affected users register passkeys, and keep a backup method where supported.
Not sure who's using SMS MFA in your tenant?
MFA migration is involved enough that it's a billable engagement, but we're happy to talk through your environment and get a review on the calendar. Email us and we'll find a time.
Request a Review