The deadline for Entra ID authentication changes is approaching and will affect many organizations. Passkeys became the default option for eligible users in September 2026, and Microsoft-provided text and phone-call verification is scheduled to end in 2027. If businesses are still relying on SMS or voice for multifactor authentication (MFA), it is now time to begin the transition.
The transition to passkeys doesn’t have to wait until the last second. Organizations that delay could face issues such as interrupted access and avoidable security exposure. This could also impact help desks, as passkeys becoming the default could generate many user tickets.
Why Microsoft is Making the Change
SMS and voice verification are vulnerable to common attacks like phishing and SIM-swapping, but they still offer some protection. If an attacker gets access to a one-time code, they could gain access to an account. Microsoft is making it, so users and organizations don’t have to rely on the code anymore.
CISA and NIST security standards recommend phishing-resistant MFA and treat telephone-based authentication as a restricted method. Obviously having any form of MFA is better than none, but more secure options are now available.
What Passkeys Are (and Why They Work Differently)
Passkeys use public-key cryptography to verify identity. Instead of entering a text code, a user approves sign-in on a trusted device using a PIN, biometric, or security key. Since the credential is bound to the legitimate service, a fake sign-in page cannot simply capture and reuse it.
Synced passkeys are available across supported devices through a credential manager.
Device-bound passkeys remain on one device, such as a managed computer, Microsoft Authenticator, or a FIDO2 security key.
SMS/Voice MFA Retirement Timeline
Microsoft has identified the following milestones for public-cloud Entra ID environments:
| Date | What Happens | What This Means |
| September 1, 2026 | Eligible SMS/voice users are enabled for passkeys and prompted to register. | Registration nudges may already appear. Users can currently postpone them. |
| October 30, 2026 | Telephony provider configuration is scheduled to be available. | Organizations retaining SMS/voice should evaluate provider options. |
| February 1, 2027 | Microsoft-provided SMS/voice ends for most users, including internal guests. | Affected users must migrate. Passkey registration becomes mandatory if SMS/voice is their only MFA method. |
| July 1, 2027 | Retirement extends to Global Administrators and external users. | Confirm migration for these accounts before their later deadline. |
Microsoft is not eliminating every possible use of those methods; they are just retiring the delivery of SMS and voice codes. If organizations genuinely need these systems to operate, supported providers are available. However, the schedule and provider details remain subject to Microsoft updates.
What To Do
A smooth transition starts with knowing who is affected and setting up a plan of action before the deadline.
1. Identify users on SMS/Voice. Review Entra ID authentication methods and locate accounts that still depend on SMS or voice. Microsoft provides a usage analyzer to assist.
2. Plan the migration. Determine if any users need SMS or voice authentication. If so, enable anti-phishing options, then test the changes with a small group.
3. Communicate clearly. Inform employees of the change. To avoid confusion, provide early instructions that include when it will happen and how to register the passkey.
4. Prioritize privileged accounts. Administrative access warrants additional attention because account compromise can have greater consequences.
5. Check recovery workflows. Review self-service password reset and fallback authentication so users can recover access without relying on methods scheduled for retirement.
Don’t Wait for the Lockout
Organizations do not need to wait for a blocked user to login to act. Review the current MFA usage, test passkey enrollment, and give users time to transition. Addressing the change early can reduce disruption while strengthening protection against credential attacks.
This overview is based on Microsoft’s guidance available as of October 14, 2026. Confirm deadlines and deployment requirements against Microsoft documentation before making tenant-wide changes.
Leave a Reply