SMS and Voice Authentication Is Being Retired. Here's Your Migration Plan.
Microsoft is retiring native SMS and voice OTP from Entra ID on February 1, 2027 — with no opt-out. This guide covers every deadline, the passkey migration path, and the admin checklist to get every user moved before enforcement hits.
SMS & Voice Authentication Is Being Retired.
Here's Your Migration Plan.
Microsoft is retiring native SMS and voice OTP delivery from Entra ID on February 1, 2027. Every tenant is in scope. Every user still using these methods needs to move — to passkeys, Windows Hello, or Authenticator. This guide covers the exact steps, the exact deadlines, and what happens if you miss them.
⚡ Why Microsoft Is Doing This
This isn't a feature deprecation. It's a deliberate, industry-aligned security move. SMS and voice OTP have been on every attacker's menu for years — SIM-swap, SS7 interception, real-time phishing relays. They're better than nothing, but that bar is dangerously low when passkeys are available.
Microsoft's position is blunt: SMS and voice are phishable. Passkeys are cryptographically bound to the device and the origin — they can't be intercepted, relayed, or stolen in transit. The industry is moving, the standards are mature, and Microsoft is accelerating the transition by making it non-optional.
📌 The Core Decision
Starting September 1, 2026 — passkeys become the default authentication experience for users enabled for SMS or voice. Starting February 1, 2027 — Microsoft-provided telecom delivery is fully retired. There is no opt-out from the February enforcement. It applies to all tenants, everywhere in public cloud.
📅 Retirement Timeline
Three hard dates. Each one has consequences if you miss it.
| Date | What Happens | What You Must Do |
|---|---|---|
| Aug 1, 2026 | Opt-out API goes live for tenants that need to delay Sep 1 changes (e.g., configuring customer telecom first) | If you're not ready for auto-passkey enable, request opt-out before Sep 1 |
| Sep 1, 2026 | All users enabled for SMS or voice in AMP are auto-enabled for passkeys. Registration Campaign set to Microsoft Managed state. Nudge prompts begin on next sign-in. | Notify users. Have passkeys enabled in AMP before this date. If you don't want auto-enable, move users off SMS/Voice before Sep 1. |
| Sep 18, 2026 | Microsoft Security Store publishes telecom provider options for customer-managed SMS/voice | Evaluate providers if you have regulated users who need telecom channels |
| Oct 30, 2026 | Customer-managed telecom configuration becomes available in Entra | Configure telecom provider for users who genuinely can't use passkeys |
| Feb 1, 2027 | Microsoft-provided SMS and voice delivery fully retired. No more native OTP via telecom from Entra. Users without a passkey or customer telecom see a blocking passkey registration prompt — they cannot skip it. | Every user must be on passkeys, Windows Hello, Authenticator, or customer-managed telecom. Zero tolerance. No opt-out. |
☠️ Why SMS OTP Was Never Really Secure
If you're explaining this change to executives or end users, these are the attack vectors that made the decision inevitable. SMS authentication has three fundamental weaknesses that no policy change can fix — they're in the protocol itself.
Passkeys eliminate all four. The cryptographic key never leaves the device, is bound to the specific origin (URL), and requires local user verification (biometric or PIN). There is nothing to relay, intercept, or swap.
🔍 Step 1 — Find Every Affected User
Before you can plan migration, you need to know your exposure. Two populations matter: users enabled for SMS or voice in the Authentication Methods Policy, and users who have actually used SMS or voice recently. They're not the same list.
Run the Microsoft Analyzer Script
Microsoft published a PowerShell script specifically for this. It requires Global Reader, Authentication Policy Administrator, or Security Reader role.
# Install required module if not present
Install-Module Microsoft.Graph -Scope CurrentUser -Force
# Run Microsoft's published SMS/Voice usage analyzer
# Source: https://github.com/microsoft/entra-sms-voice-usage-analyzer
# Clone or download the script, then:
.\Get-SMSVoiceUsers.ps1 -TenantId "your-tenant-id"
# Output: CSV with UserPrincipalName, DisplayName,
# SMSEnabled (bool), VoiceEnabled (bool), LastUsedMethod, LastSignInThe output gives you two actionable lists: users who are enabled for SMS/Voice in policy (who will be auto-enrolled for passkeys on Sep 1), and users who have actively used SMS/Voice in the last 30/90 days (your highest-risk migration targets).
Check via Entra Admin Center
| Method | Users registered | Users used | Registrations trend |
|---|---|---|---|
| Microsoft Authenticator | 847 | 612 | ↑ 12% |
| FIDO2 security key | 143 | 97 | ↑ 28% |
| Windows Hello for Business | 423 | 389 | ↑ 8% |
| SMS | 214 | 178 | ⚠ Action required |
| Voice call | 89 | 62 | ⚠ Action required |
Export these numbers. Create two security groups: SG-SMS-Voice-Users (everyone in scope) and SG-SMS-Voice-Active (users who used either method in the last 30 days). You'll target both groups differently in your migration campaign.
🔑 Step 2 — Enable Passkeys for Your Tenant
Passkeys are the primary migration target. Microsoft supports two types. Understanding the difference determines which rollout path fits your environment.
☁️ Synced Passkeys
The credential lives in a platform credential manager — iCloud Keychain, Google Password Manager, Windows Hello credentials, or 1Password/Bitwarden. Syncs across all the user's devices automatically.
Best for: Consumer-style managed devices, BYOD users, workers who switch between devices frequently
🔒 Device-Bound Passkeys
The credential is stored on a specific device and cannot leave it. Includes: Passkey in Microsoft Authenticator, Entra Passkey on Windows 11, FIDO2 hardware security keys (YubiKey, etc.)
Best for: High-assurance roles, privileged accounts, regulated environments, users without a trusted cloud credential manager
Enable Passkeys in Authentication Methods Policy
| Method | Status | Target |
|---|---|---|
| Passkey (FIDO2) | Microsoft managed | SG-SMS-Voice-Users |
| Microsoft Authenticator | Enabled | All users |
| Windows Hello for Business | Enabled | All users |
| SMS | Retiring Feb 1, 2027 | SG-SMS-Voice-Users |
Enable Passkey (FIDO2) method
In the Entra admin center: Protection → Authentication methods → Policies → Passkey (FIDO2). Set Enable to Yes. Under Include, add your SG-SMS-Voice-Users group. Allow all attestation types unless your security policy requires hardware-bound keys only.
💡 "Microsoft managed" means Microsoft controls the default — currently enabled. Set explicitly to avoid surprises if the default changes.
Verify Microsoft Authenticator passkey support
In Authentication methods → Microsoft Authenticator: confirm the policy is enabled for your target group. Under Configure, ensure Authentication mode is set to Any — this allows both push notifications and device-bound passkeys (the newer flow).
Confirm Windows Hello for Business is enabled
If you manage Windows 11 devices with Intune: Endpoint security → Account protection → Windows Hello for Business. Ensure it's configured as a sign-in option. WHfB uses passkey infrastructure and automatically satisfies the migration requirement for domain-joined users.
📣 Step 3 — Configure the Registration Campaign
The Registration Campaign is the mechanism that actually moves users. When enabled, it shows a passkey registration nudge at sign-in after MFA completes. It's the highest-ROI action you can take — it drives adoption without a help desk call for the majority of users.
On September 1, 2026, Microsoft will set this to Microsoft Managed automatically for your SMS/voice users, with unlimited snoozes — meaning users can keep dismissing the prompt forever. Don't wait. Set it up yourself, now, with a snooze limit.
| Group | Users | Status |
|---|---|---|
| SG-SMS-Voice-Users | 303 | In scope |
🎯 Campaign Configuration Recommendations
- State: Enabled (not Microsoft Managed — you control the scope)
- Days allowed to snooze: 3–7 days. Unlimited is the auto-default — that's too lenient when you have a hard deadline.
- Target:
SG-SMS-Voice-Activefirst (users who've used SMS in the last 30 days). AddSG-SMS-Voice-Users2 weeks later. - Method to promote: Passkey (FIDO2) — covers Authenticator passkeys, Windows Hello, and hardware keys in one policy
The nudge appears after the user successfully completes MFA — so it never blocks access during the campaign period. Only after February 1, 2027 does the prompt become blocking for users with no alternative method.
📡 Step 4 — Telecom Fallback (Regulated Environments)
Most organizations should migrate fully to passkeys. But if you operate in a regulated industry with specific compliance requirements that mandate out-of-band SMS — or if you have operational scenarios where passkeys genuinely aren't feasible for a user segment — Microsoft is introducing customer-managed telecom providers through the Microsoft Security Store.
⚠️ This Is Not the Default Path
Customer-managed telecom is for exceptions: a specific compliance regime that explicitly requires SMS, or a user population where no other method is technically workable. It's not a way to delay migration. It comes with per-message costs, carrier contracts, and additional configuration overhead. Default to passkeys. Use telecom only where you have documented, justified need.
Timeline for Telecom Providers
| Date | Action |
|---|---|
| Sep 18, 2026 | Microsoft publishes available telecom providers, pricing, and regional coverage in the Microsoft Security Store |
| Oct 30, 2026 | Customer-managed telecom configuration becomes available in Entra ID settings |
| Before Feb 1, 2027 | Complete carrier contract, tenant configuration, and pilot testing if you need telecom for any users |
Evaluation Criteria for Telecom Providers
- Regional coverage: Does the carrier deliver reliably to your user locations? SMS delivery rates vary significantly by country.
- Compliance certifications: Does the carrier meet your industry's requirements (FedRAMP, ISO 27001, SOC 2)?
- Per-message pricing: Volume discounts? Per-country pricing? Evaluate your monthly SMS volume against the cost model.
- Failover: What happens when the carrier has an outage? Is there a secondary channel or backup carrier?
Detailed provider information, including terms and integration docs, will be published at the Microsoft Security Store starting September 18, 2026.
💬 Step 5 — User Communication Plan
The registration campaign drives the technical enrollment. But the help desk volume you take on during rollout is almost entirely determined by how well-prepared your users are before the nudge appears. Coordinated communications are the single biggest predictor of a smooth transition.
📧 Wave 1 — Awareness (4–6 weeks before Sep 1)
Subject: "How you sign in to [Company] apps is changing — here's what you need to know"
- SMS and voice OTP codes are being retired industry-wide for security reasons
- Your account will be prompted to register a passkey starting [date]
- It takes 2 minutes. Here's how to do it on [Windows / iPhone / Android]
- Link to self-service registration:
aka.ms/mysecurityinfo
🔔 Wave 2 — Action (1–2 weeks before campaign goes live)
Subject: "Action required: Register your passkey before [specific date]"
- Registration window opens [date] — you'll see a prompt at next sign-in
- You have [N] days to complete it before it becomes mandatory
- Device-specific instructions: Windows Hello / iPhone Face ID / Android fingerprint
- IT helpdesk contact for questions: [email/Teams]
⏰ Wave 3 — Reminder (2 weeks before Feb 1, 2027)
Subject: "⚠️ Last chance: SMS codes stop working February 1 — have you registered your passkey?"
- Target: users who have NOT yet registered any phishing-resistant method
- Explicit: after February 1, you will see a mandatory screen at sign-in
- Drop-in session offered: [Teams meeting link, IT office hours]
- Recovery option: temporary access pass for users who get locked out (covered in FAQ below)
Microsoft provides official end-user communication templates at aka.ms/mfatemplates — email, Teams message, and intranet post formats. Use them as a starting point and customize for your brand and support contacts.
🔒 After February 1, 2027 — What Actually Happens
This is the section that matters most for risk planning. Here is exactly what happens on the ground for different user states.
✅ Users with passkey, WHfB, or Authenticator passkey
No change. They sign in normally. They may still get nudged to register additional phishing-resistant methods if they don't have them, but existing sign-in is unaffected. This is the zero-impact state you're targeting for every user.
⚠️ Users with customer-managed telecom configured
SMS and voice continue to work — but delivered by the carrier you contracted through the Security Store, not Microsoft's native telecom infrastructure. These users experience no disruption if your telecom configuration was completed before February 1.
🚨 Users whose ONLY method is SMS or voice — no telecom configured
At next sign-in after February 1: they complete their password (or passwordless factor), then hit a blocking passkey registration screen. They cannot close it. They cannot snooze it. They must complete passkey registration before they can access their account. This is not a sign-out — their session attempt just waits at this screen until they register.
Handling Users Who Get Stuck
If a user hits the blocking screen and doesn't know what to do, you have one administrative option: issue a Temporary Access Pass (TAP). A TAP is a time-limited, one-time passcode that lets the user authenticate once to register a new strong method.
# Issue a Temporary Access Pass via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"
New-MgUserAuthenticationTemporaryAccessPassMethod `
-UserId "user@contoso.com" `
-LifetimeInMinutes 60 `
-IsUsableOnce $true
# Output: temporaryAccessPass (the actual code to share with user)
# User authenticates with TAP, then registers their passkey at aka.ms/mysecurityinfoTAP requires the Temporary Access Pass method to be enabled in your Authentication Methods Policy before February 1. Enable it now — it's your recovery tool for the post-retirement world.
❓ Frequently Asked Questions
Will users be auto-migrated, or do I have to do it?
Partially. On September 1, 2026, users enabled for SMS/Voice in the Authentication Methods Policy will be auto-enabled for passkeys, and a Registration Campaign will be set to Microsoft Managed state. But auto-enabling is not the same as registration — users still need to go through the enrollment flow at their next sign-in. You don't have to trigger the campaign manually, but proactive configuration (with a snooze limit and targeted communications) will get you a much higher registration rate before the deadline.
Does this affect SSPR (Self-Service Password Reset)?
Yes. The retirement of native SMS and voice applies across Entra — including SSPR flows. Users who had SMS as their SSPR verification method will need an alternative (email, Authenticator app, security questions if enabled). Update your SSPR policy to reflect the new method landscape before February 1. Microsoft is also planning passwordless password-change support — details to come.
Can I opt out of the September 1 changes?
Yes — a temporary opt-out API will be available starting August 1, 2026. This lets you delay the auto-passkey enable and Registration Campaign update while you finish your own transition activities (e.g., configuring a customer telecom provider or migrating users to other methods). The opt-out applies only to the September 1 changes. There is no opt-out for February 1, 2027. That enforcement is absolute.
Will there be costs with customer-managed telecom?
Yes. Pricing varies by provider, region, and volume — typically per-message rates. You'll need to evaluate providers in the Security Store for specifics. Migrating users to passkeys incurs no additional cost. The economics strongly favor passkeys for all but the most constrained scenarios.
Which cloud environments are in scope?
This timeline applies to public cloud environments only. Government clouds (GCC, GCC High, DoD) and sovereign clouds (Azure China, Azure Germany) will follow on a later schedule with separate advance communications.
Are users going to get locked out on February 1?
Not locked out — but blocked at sign-in. A user whose only method is SMS or voice will be shown a passkey registration prompt they cannot skip. They can register a passkey in the moment (if they have a compatible device) or contact IT for a Temporary Access Pass. The risk is help desk volume spike if you haven't pre-migrated users. That's what this guide is for.
✅ Admin Action Checklist
Use this as your migration tracking board. Work through it in order — each phase builds on the last.
Phase 1 — Immediate (Now → August 2026)- Run the Microsoft SMS/Voice usage analyzer script — export CSV of all affected users
- Create security group
SG-SMS-Voice-Users(all users enabled in AMP) - Create security group
SG-SMS-Voice-Active(users who used SMS/Voice in last 30 days) - Enable Passkey (FIDO2) in Authentication Methods Policy — target
SG-SMS-Voice-Users - Verify Windows Hello for Business is configured in Intune for managed devices
- Enable Temporary Access Pass in Authentication Methods Policy (recovery tool)
- Send Wave 1 awareness communication to all SMS/Voice users
- Configure Registration Campaign — target
SG-SMS-Voice-Active, snooze limit 3–7 days, state: Enabled - Send Wave 2 action communication with device-specific registration instructions
- Run pilot — 20–30 users from SMS/Voice group, validate registration flow end-to-end
- Monitor registration rate in Entra admin center → Authentication methods → Activity
- Assess need for customer-managed telecom — document which user segments require it
- Decide: opt out of Sep 1 auto-enable? If yes, file opt-out via API after Aug 1
- Expand Registration Campaign to full
SG-SMS-Voice-Usersgroup - Review Security Store telecom providers (published Sep 18, 2026) if needed
- Configure customer-managed telecom provider for regulated users (available Oct 30, 2026)
- Run weekly reports on remaining SMS/Voice users — track toward zero
- Conduct drop-in registration sessions for users who haven't self-enrolled
- Send Wave 3 reminder to all users still on SMS/Voice with 2 weeks to February 1
- Audit: zero users with SMS/Voice as their only MFA method
- Disable SMS and Voice methods in AMP for all users (remove the method, don't leave it enabled)
- Brief help desk — volume playbook for post-Feb 1 TAP issuance
- Update SSPR policy to remove SMS/Voice verification methods
- Confirm telecom provider is live and tested if configured for regulated segments
- February 1: monitor sign-in logs for authentication failures — triage with TAPs as needed