Entra SMS MFA Retirement: Your Passkey Migration Playbook

Microsoft made it official on July 13, 2026: the Entra SMS MFA retirement is coming, and the clock is already running. Passkeys become the default sign-in experience in Entra ID on September 1, 2026, and Microsoft-provided SMS and voice authentication stops working entirely on February 1, 2027 (per Microsoft Learn). If any of your users still type six digit codes from a text message, you now have a real deadline to work against.

The reasoning is hard to argue with. Text messages can be intercepted, SIM cards can be swapped, and a convincing fake login page captures an SMS code as easily as a password. Microsoft's announcement cites research showing AI generated phishing campaigns reaching click-through rates as high as 54 percent, against roughly 12 percent for traditional ones (per the Microsoft Security Blog). We covered how these lures work in our visual guide to spotting phishing emails. The short version: some users will always click, so the credential itself has to resist phishing.

Key Takeaways

• Passkeys become the Entra ID default on September 1, 2026, with automatic enablement for SMS and voice users.
• Microsoft-provided SMS and voice authentication stops working on February 1, 2027, for every tenant.
• After the cutoff, users whose only MFA method is SMS face a blocking passkey registration prompt.
• Your migration options: Microsoft Authenticator passkeys, synced passkeys, Windows Hello for Business, and FIDO2 keys.
• Conditional Access authentication strengths let you require phishing-resistant MFA now, ahead of the deadline.

What the Entra SMS MFA Retirement Actually Changes

Three dates matter, and Microsoft has published all of them.

September 1, 2026. Any user enabled for SMS or voice in your authentication methods policy (or legacy MFA settings) is automatically enabled for passkeys. Microsoft also switches your registration campaign to a Microsoft Managed state targeting those users. The next time they complete MFA, they get nudged to register a passkey. By default they can snooze that prompt indefinitely, so the nudge alone won't finish the job.

February 1, 2027. Microsoft-provided telecom delivery for SMS and voice is fully retired. From that day, users whose only available MFA method is SMS or voice hit a blocking prompt: they must register a passkey before they can sign in at all. Microsoft is explicit that there is no opt-out from this enforcement, for any tenant.

In between. Organizations with a real regulatory need for text or voice codes will be able to review third party telecom providers through the Microsoft Security Store starting September 18, 2026, and configure one starting October 30, 2026. A temporary opt-out (the passkeyDynamicMigration property, set through Microsoft Graph) can pause the automatic enablement during the fall, but it changes nothing about the February date.

For a business of 20 to 200 seats, the practical read is simple: treat September 1 as the start of your rollout and February 1 as a hard cutover, because that is exactly what they are.

Your Passkey Migration Playbook

Here's the sequence we run with our managed IT clients. None of it requires premium licensing, and most tenants can finish well before the deadline.

Step 1: Find out who still uses SMS or voice

Microsoft published a PowerShell script, the Entra SMS and voice usage analyzer, that lists affected users. You need Global Reader, Security Reader, or Authentication Policy Administrator rights to run it. Put the results in a dedicated security group; every later step targets that group. Based on field observations, the list is usually longer than expected, because SMS lingers as a forgotten fallback method even for users who normally approve with the Authenticator app.

Step 2: Pick the right method for each user group

Entra ID gives you four phishing-resistant paths, and most businesses need a mix:

• Passkeys in Microsoft Authenticator. A device-bound passkey stored in an app many of your users already have. The natural default for anyone with a smartphone.
• Synced passkeys. Saved in iCloud Keychain or Google Password Manager and synced across a user's devices. Convenient for BYOD teams; confirm credential sync fits your security policies first.
• Windows Hello for Business. Face, fingerprint, or PIN sign-in on corporate Windows devices. If your fleet is managed with Intune, this is mostly configuration work.
• FIDO2 hardware keys. Physical keys for frontline staff, shared workstations, and users without smartphones. Order spares from day one.

Sizing that mix, and handling the exceptions, is where a cybersecurity partner saves you the most time.

Step 3: Run a registration campaign before Microsoft does

Don't wait for the September 1 auto-enablement. In the Entra admin center, open Authentication methods, then Registration campaign, set the state to Microsoft Managed, and target your SMS and voice group. Users get prompted to register a passkey right after completing MFA, while their old method keeps working. Starting early means you control the pace instead of absorbing it all in one week.

Step 4: Enforce with Conditional Access authentication strengths

Registration puts passkeys in users' hands; Conditional Access makes them the rule. Authentication strengths let a policy require phishing-resistant MFA (passkeys, Windows Hello for Business, or FIDO2 keys) rather than any MFA. Start with admin roles, then finance and leadership, then everyone. If you deployed our free Conditional Access baseline, this is the natural extension: clone your MFA policy, swap the grant control to the built-in phishing-resistant MFA strength, and roll it out ring by ring. Keep your break-glass account excluded, as always.

Step 5: Tell your users what's coming

Microsoft's guidance calls coordinated communication the biggest predictor of a smooth rollout, and provides templates at aka.ms/mfatemplates. Three short messages do it: what's changing and why, how to register on each device type, and a reminder for stragglers. Scope them to the affected group so you aren't spamming people who already use passkeys.

If You Genuinely Still Need SMS or Voice

Some scenarios legitimately resist passkeys: a regulator that requires out-of-band codes, or field crews sharing basic phones. Microsoft's answer is customer-managed telecom providers offered through the Microsoft Security Store. Provider details arrive September 18, 2026, and configuration opens October 30, 2026. You contract the carrier, you pay for message delivery, and Microsoft steps out of the SMS business.

Treat this as an exception lane, not a strategy. Document which regulation or scenario forces the requirement, scope it to the smallest possible group, and default everyone else to passkeys. If you use the temporary opt-out, remember what it buys: time to finish the transition, not a way around it. February 1, 2027 applies to every tenant regardless.

FAQ

When does SMS authentication stop working in Microsoft 365?

Microsoft-provided SMS and voice authentication retires in Entra ID on February 1, 2027. After that date, those methods no longer satisfy MFA unless your organization configured a third party telecom provider through the Microsoft Security Store. Passkeys become the default experience earlier, on September 1, 2026.

Will my users be locked out on February 1, 2027?

Not locked out, but interrupted. Users whose only MFA method is SMS or voice will face a blocking prompt requiring them to register a passkey before they can finish signing in. It's far better to get them registered months earlier through a controlled campaign.

What's the difference between synced and device-bound passkeys?

A synced passkey lives in a credential manager like iCloud Keychain or Google Password Manager and follows the user across devices. A device-bound passkey never leaves the device or security key where it was created, such as a passkey in Microsoft Authenticator or a FIDO2 key. Device-bound gives tighter control; synced gives more convenience.

Can we keep using SMS MFA after February 2027?

Only through a customer-managed telecom provider configured via the Microsoft Security Store, available starting October 30, 2026. Your organization contracts and pays that provider directly. Microsoft recommends reserving this for documented regulatory or operational needs and moving everyone else to phishing-resistant methods.

Do passkeys work for employees without smartphones?

Yes. FIDO2 hardware security keys provide device-bound passkeys with no phone required, and Windows Hello for Business turns a corporate Windows PC into a phishing-resistant authenticator with a PIN, face, or fingerprint. Between those two options, phone-free users are covered.

Sources

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (Microsoft Learn)
• Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID (Microsoft Security Blog)

Six months sounds like plenty until you're chasing the last fifteen holdouts the week of the cutover. If you'd like a second set of eyes on your tenant before September 1, our free IT assessment includes a review of your authentication methods and a passkey rollout plan sized for your team.