Microsoft SMS MFA Retirement: Passkeys by February 2027

The email from Microsoft is in English, long and easy to overlook. You shouldn't ignore it anyway.

In recent weeks, many IT departments and MSPs received an English-language email from Microsoft: “Passkeys by default and retirement of Microsoft-provided SMS and voice authentication.” At our company it also landed in the helpdesk as a ticket, as one of many automatic notification emails that are easy to lose among the rest.

This one shouldn't be missed. Microsoft is ending SMS and voice call sign-in in Entra ID. If you have users who still sign in with an SMS code, you need to switch them by February 1, 2027, otherwise they will get a block message at their next sign-in. Here is what changes and how to proceed.

What exactly is Microsoft changing?

Microsoft is ending sign-in by SMS and voice call and making passkeys the default. According to the notice to all Entra ID tenants:

• September 1, 2026 – Users with SMS or voice call are automatically enabled for passkeys and prompted to register at their next MFA sign-in
• September 18, 2026 – Microsoft publishes providers and prices for your own SMS delivery
• October 30, 2026 – Your own telecommunications providers can be set up
• February 1, 2027 – Sign-in by SMS and voice call provided by Microsoft ends completely
• after February 1, 2027 – Users whose only MFA method is SMS or voice call have to set up a passkey before signing in, with no exception

If you have no users with SMS or voice call, you don't have to do anything.

Why is Microsoft abolishing SMS?

Because SMS and voice calls are among the least secure sign-in methods. Codes can be intercepted, captured through fake sign-in pages or redirected by SIM swapping. Passkeys, by contrast, only work on the genuine sign-in page, so a phishing link gets the attacker nothing.

What is a passkey?

A passkey replaces password and code with a key on the device. It is stored:

• in the Microsoft Authenticator app on the phone,
• on the PC (Windows Hello),
• or on a security key (FIDO2, e.g. as a USB stick).

It is released with a fingerprint, face recognition or PIN. For users this is usually easier than an SMS code: no typing, no waiting for the message.

Step 1: Find the affected users

In the Microsoft Entra admin center:

1. Protection › Authentication methods › User registration details.
2. Filter by Methods registered: SMS or Voice call.
3. Particularly important: users for whom SMS is the only method.

With Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "AuditLog.Read.All","UserAuthenticationMethod.Read.All"
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { $_.MethodsRegistered -contains 'mobilePhone' } |
  Select-Object UserPrincipalName, MethodsRegistered

For MSPs: check this separately for each customer tenant, because the notice went to all tenants.

Step 2: Enable passkeys

1. Protection › Authentication methods › Policies › enable Passkey (FIDO2).
2. Define which groups it applies to, ideally a test group first.
3. If needed, set which kinds of passkeys are allowed (Authenticator, security keys).

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

Microsoft Authenticator as a stopgap: if you don't want to set up a passkey yet, you can also move users to push notifications in the Authenticator app. That is much more secure than SMS, but not quite as phishing-resistant as a passkey.

Step 3: Kick off registration

Microsoft offers a registration campaign for this. Under Authentication methods › Settings › Registration campaign you can prompt users to set up a passkey at sign-in. Since September 1, 2026, this happens automatically for SMS users anyway. If you want to control when and how, start the campaign beforehand.

Add a short note for employees:

• What is changing: SMS codes go away, sign-in is by phone app or fingerprint instead.
• By when: before February 2027, ideally now.
• What to do: install the Authenticator app and choose “Set up a passkey” at the next prompt.
• Who to ask: IT or your MSP.

Step 4: Sort out special cases

• Employees without a company phone: security key (FIDO2) or Windows Hello at the workstation.
• Shared accounts: Ideally abolish them and replace them with personal accounts; otherwise security keys.
• Legal or operational reasons for SMS: Only then set up your own telecommunications provider, which according to Microsoft is possible from October 30, 2026.
• Emergency access: For admin accounts, register at least two methods so that losing a phone doesn't lock you out.

What happens if you do nothing?

From February 1, 2027, users with SMS as their only method are stopped at sign-in and have to set up a passkey first. That then happens under time pressure, without instructions, and lands as a wave of calls with IT. If you switch now, you decide the timing yourself.

More on sign-in and access: VPN: authentication failed and the IT checklist for new employees.

How does SuperSupport help with the switch?

Changes like this bring many similar questions: “How do I set up the passkey?”, “The app is asking for something, what should I do?” The SuperSupport agent answers them in the chat, guides you step by step through the setup and passes only the cases to IT that really need someone, such as a lost phone. What this looks like for internal IT teams and MSPs is described on the respective pages.

Frequently asked questions

When is Microsoft turning off SMS sign-in?

According to Microsoft, the SMS and voice call authentication provided by Microsoft in Entra ID will be discontinued completely on February 1, 2027. Since September 1, 2026, users with SMS or voice call have already been enabled for passkeys automatically and prompted to register at their next sign-in.

What happens to users who only have SMS as a second factor?

After February 1, 2027, they get a blocking prompt at sign-in to set up a passkey first. Only then can they continue working. According to Microsoft, there is no exception for this.

What is a passkey?

A passkey is a sign-in without a password and without a code: the secret key is stored on the phone, the PC or a security key and is released with a fingerprint, face or PIN. It only works on the genuine sign-in page and is therefore protected against phishing.

How do I find out who still uses SMS?

In the Microsoft Entra admin center under Protection › Authentication methods › User registration details, filter by the method SMS or voice call. Alternatively, use Microsoft Graph PowerShell.

Can I keep using SMS?

Only through your own telecommunications provider, which according to Microsoft you connect through the Microsoft Security Store. The SMS and voice call delivery provided by Microsoft ends for all tenants.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial