Microsoft sets 1 February 2027 deadline to end SMS and voice sign-in for Entra ID

Microsoft sets 1 February 2027 as the cutoff

The notice, MC1528000, says Microsoft will end the SMS and voice authentication it provides starting 1 February 2027. BleepingComputer reported it on 28 October and WindowsReport on 29 October.

For administrators, that is a fixed date with no automatic migration. Either they move users themselves or they wire up a third-party carrier. Microsoft has not said what a missed deadline looks like beyond sign-in disruptions for users still on SMS or voice. The change covers Entra ID workforce tenants only. Azure AD B2C and Entra External ID, its customer identity products, are not affected. Microsoft says SMS and voice codes are vulnerable to phishing and SIM swapping, where an attacker ports a phone number to receive codes meant for its owner.

That leaves administrators with a hard cutover and a short list of approved methods.

What administrators have to do

Admins must move users to phishing-resistant methods: passkeys, QR code authentication and FIDO2 security keys. Organisations that still need phone-based sign-in have one route left. They must connect an external carrier through the Microsoft Security Store, a setup Microsoft calls a customer-managed telecom provider. Microsoft points administrators to a scanner script. The Entra SMS/Voice Policy Scanner PowerShell script finds affected users and configurations. Users who still have SMS or voice enabled become eligible for passkeys. They get a registration prompt at their next multifactor attempt, according to WindowsReport's account of the advisory.

Passkeys are already the default, and most are synced

Microsoft has been switching the Entra ID workforce default authentication method to passkeys since September 2026, according to the two reports. It announced the plan in July. In August 2026 it also halted a feature that let free Entra ID customers use SMS as a primary login method. The passkeys those users register are mostly synced ones. Hana Kim, a senior product manager at Microsoft, said at Authenticate 2026 that 75% of passkeys registered in Entra in the previous month were synced. Synced passkeys grew 330% month over month, she said.

Synced passkeys trade hardware binding for recoverability. Arie Olshtein of Palo Alto Networks called that a deliberate trade-off at Authenticate 2026: no shared secret to phish, but a larger surface around the key.

The recovery path is the weak link

Part of that surface is the cloud account, the sync service and the endpoint that opens it. The attack Olshtein showed does not touch the passkey itself. The UNC6671 campaign phishes iCloud Keychain recovery, relays a real Apple verification code and then asks for the iPhone passcode. The attacker's device then joins the keychain and receives every synced passkey. The gap shows in assurance levels. Synced passkeys sit at NIST AAL2 and device-bound ones at AAL3, while most recovery paths using SMS codes, email links or help desk calls are roughly AAL1. SecurityWeek made a related point on 30 October: passkeys strengthen authentication, but they do not settle whether an account was legitimately established in the first place.

What happens next

The retirement begins on 1 February 2027. Microsoft warns that organisations which fail to prepare could face user sign-in disruptions.

Personal Microsoft accounts, including Outlook.com, OneDrive and consumer Microsoft 365, follow a separate setup flow in account security settings. Microsoft's guidance there is simple. Create a replacement passkey before removing an old one.