Microsoft Entra ID Retires SMS One-Time Passcode as a First-Factor Sign-In Method for Workforce Tenants
Microsoft Entra ID Retires SMS One-Time Passcode as a First-Factor Sign-In Method for Workforce Tenants
Starting February 1, 2027, Microsoft Entra ID will block phone number plus SMS OTP as a primary sign-in method for workforce tenants. Administrators need to identify affected users and migrate them to alternative authentication methods before that date.
Microsoft Entra ID will stop accepting a registered phone number and SMS one-time passcode (OTP) as a first-factor sign-in method for workforce tenants on February 1, 2027. Microsoft refers to this method internally as SignInNoPassword. SMS will remain blocked as a primary sign-in method after enforcement begins. SMS as a second factor (MFA step-up) is not addressed by the source.
Users who rely solely on phone number plus SMS OTP for first-factor authentication will lose the ability to sign in. The source specifically calls out shared devices, users without corporate smartphones, and emergency access accounts as areas requiring special attention. The source does not specify whether external or guest tenants are affected.
Enforcement begins February 1, 2027, as stated by the source. The source does not give a preview, announcement, or gradual rollout date.
The source does not state specific licensing or platform prerequisites for the retirement itself.
| Area | Detail |
|---|---|
| Tenant type | Workforce tenants (the source does not address external or guest tenants) |
| Alternatives named | Passkeys, Windows Hello for Business, FIDO2 security keys, QR code + PIN |
| Pilot note | Available authentication options may depend on the organization's devices, browsers, and Conditional Access authentication strengths (source-stated) |
- Identify all users whose only registered sign-in method is phone number + SMS OTP.
- Check whether those users have a second registered authentication method that will still work after February 1, 2027.
- Evaluate Passkeys, Windows Hello for Business, and FIDO2 security keys as replacements for general users.
- Evaluate QR code + PIN authentication for frontline and shared-device scenarios.
- Pilot each replacement option against your existing device estate, browsers, and Conditional Access authentication strength policies before broad rollout.
- Review emergency access (break-glass) accounts and recovery processes to confirm they do not depend on SMS first-factor authentication.
- Update enrollment documentation and help-desk procedures to reflect the new authentication methods.
- Run a staged, monitored registration campaign to surface issues before the February 1, 2027 deadline.
- Communicate the change and re-enrollment steps to affected users ahead of enforcement.
My read is that this retirement removes only the first-factor use of SMS OTP (the SignInNoPassword flow). Whether SMS continues to be available as an MFA second factor after February 1, 2027 is not addressed by this source and should be confirmed against Microsoft's official documentation. Shared device and frontline scenarios warrant early attention because those users are least likely to have a passkey or FIDO2 key already registered, and QR code + PIN may require additional Entra configuration that takes time to test and deploy at scale.
I would prioritize the audit of SMS-only accounts now rather than late 2026. Accounts that have no fallback method registered will generate helpdesk load or access outages if migration is left to the final weeks. Break-glass account review is the highest-risk item: confirm those accounts use a method unaffected by this retirement before doing anything else.
The source is a third-party blog post summarizing the Microsoft Entra change; it does not link to or reproduce the original Microsoft announcement, Message Center post, or documentation, so official retirement scope, licensing requirements, and second-factor SMS status cannot be confirmed from this source alone.