Microsoft is switching off its own SMS and voice call delivery for multi-factor authentication in Microsoft Entra ID. The SMS MFA retirement runs on four dates, and the first one has already gone past. If anyone in your tenant was enabled for SMS or voice on 1 September 2026, Microsoft has already changed your authentication methods policy and your registration campaign settings. Most organisations were not watching.
The date for this week is 30 October 2026. That is when the only route to keeping SMS or voice opens, and it is a route you pay for.
The SMS MFA retirement is not Microsoft turning off MFA. It is Microsoft getting out of the business of delivering the text message. Your Conditional Access rules, your policies and the Authenticator app all carry on. What stops is Microsoft’s own telephony, and any user whose only method is SMS or voice eventually meets a sign-in prompt they cannot skip.
What Microsoft Is Switching Off, and What It Is Not
The thing being retired is narrow. Microsoft is ending its own telephony delivery, the service that actually sends the code to the phone. Its documentation puts it plainly: “SMS and voice are no longer positioned as secure authentication methods and will no longer be provided natively in Entra ID.”
Almost everything else stays. The Microsoft Authenticator app is unaffected, both the push approval and the verification codes. Time-based one-time password codes survive, and Microsoft is explicit that “TOTP remains supported for existing and new registrations after February 1, 2027”. FIDO2 security keys, Windows Hello for Business and passkeys all continue, because they are where Microsoft is pointing everyone.
External authentication methods are out of scope too. Asked directly whether they are affected, Microsoft answers: “No, only SMS and voice authentication method policies and legacy MFA policies are retired.” Azure AD B2C is out of scope entirely, and Microsoft Entra External ID gets its own announcement next year.
Two limits are worth knowing before you plan around any of this. The timeline covers public cloud tenants only, and Microsoft says other cloud environments “will follow on a later schedule”. And the reason behind it is the one Microsoft keeps repeating: an SMS code can be phished in real time, which is the mechanism our write-up of adversary-in-the-middle phishing walks through with a worked example.
The SMS MFA Retirement Dates in Order
Four dates matter. All four come from Microsoft’s own retirement timeline, last updated on 23 September 2026.
| Date | What Microsoft does | What it means for you |
|---|---|---|
| 1 September 2026 | Users enabled for SMS or voice are auto-enabled for passkeys in the authentication methods policy, and the registration campaign moves to Microsoft managed state targeting those users. | Already happened. Your tenant configuration changed without an admin doing anything. |
| 30 October 2026 | The configuration experience for a third-party telephony provider opens in Microsoft Security Store. | The first date on which you can start arranging to keep SMS or voice at all. |
| 1 February 2027 | Microsoft-provided SMS and voice retired for all users except Global Administrators and external users. Internal guest users are in scope on this date. | Anyone whose only method is SMS or voice meets a blocking passkey registration prompt at sign-in. |
| 1 July 2027 | Microsoft-provided SMS and voice retired for Global Administrators and external users. | Your most privileged accounts get five extra months. That is the wrong way round, so do them first. |
One caution on sourcing. Several third-party summaries of this change state a final deadline of 30 July 2027. Microsoft’s documentation does not contain that date. It says 1 July 2027 for Global Administrators and external users. Work from the Microsoft page, not the commentary, including ours.
Not Sure Who Still Uses SMS in Your Tenant?
Transputec runs Microsoft 365 Managed Services with end-to-end ownership across licensing, identity, security, productivity and adoption. Talk to our team about the authentication work behind the SMS MFA retirement, from finding who is still on SMS to moving them onto a phishing-resistant method without burying your service desk.
Talk to our teamWhat Already Happened on 1 September 2026
The SMS MFA retirement started quietly. On 1 September 2026, users enabled for SMS or voice in the Entra authentication methods policy, or in legacy MFA settings, were automatically enabled for passkeys. Microsoft describes putting them “into a passkey profile allowing all types of passkeys”, and setting the registration campaign to Microsoft managed state so those users come into scope on their own.
The next time one of those users signs in and completes MFA, the campaign prompts them to register a passkey. That prompt can be snoozed, and here is the line that hid the whole change: “By default, users will have unlimited snoozes of the nudge prompt.” Nothing broke. Nobody raised a ticket. The tenant configuration moved anyway.
There is a temporary opt-out, and it is narrower than it sounds. It covers the 1 September 2026 to 1 February 2027 changes only, and you set it through Microsoft Graph by patching the authentication methods policy with passkeyDynamicMigration set to true, which needs the Policy.ReadWrite.AuthenticationMethod permission. It delays the passkey enablement and the campaign. It does nothing about February. Microsoft puts the limit in bold on its own page: “There is no opt out for enforcement.”
So the useful step this week is to open your authentication methods policy and compare what it says now with what you believe you configured. If you run change control, this is a change nobody logged.
30 October Is When You Can Keep SMS, If You Pay for It
If a group of your users genuinely has to keep receiving codes by text or call, there is exactly one route, and it opens on 30 October 2026. Microsoft calls it Choose Your Own Telephony Provider. You pick a provider through Microsoft Security Store and, in Microsoft’s words, “manage the provider relationship for your organization”.
Until this week it was documentation only. The page carries the note: “Choose Your Own Telephony Provider isn’t available to configure yet. Information about the providers participating in the private preview is available now. The configuration experience becomes available beginning October 30, 2026.”
The initial providers are Soprano and Telesign, both in private preview, with more promised by general availability. Soprano lists a per-user offer and a per-transaction offer. Telesign lists Telesign Verify for Microsoft Entra. The costs are yours, not Microsoft’s, and the FAQ answers the money question without hedging: “Yes. Pricing varies by telephony provider and region.” Set against that, “migrating Microsoft provided SMS and voice users to Passkeys incur no additional cost.”
It is also more work than a settings change. Microsoft writes the responsibility list out: “selecting a telephony provider, reviewing its regional coverage and terms, completing the provider agreement, configuring the provider for Microsoft Entra ID, and monitoring the service.” That is a supplier contract, a data processing review, a procurement cycle and a new third party sitting in your sign-in path. Microsoft’s own advice is to use it “only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication”.
The honest reading for most UK organisations is that this is an escape hatch for a handful of people, not a plan for the tenant.
Who Is in Scope, and the Guest Account Trap
The scope split is where this gets missed. From 1 February 2027, Microsoft-provided SMS and voice stop for everyone except Global Administrators and external users. Those two populations run on until 1 July 2027.
Now the trap. Internal guest users are not in the July group. Microsoft says it twice, once in the timeline and again in the FAQ: “Internal guest users aren’t included in that July 1 group and still follow the February 1, 2027 retirement date.” Plenty of tenants have collected internal guests over the years, from contractors to agency staff to people who arrived as a B2B invite and later got a mailbox. If nobody has audited the difference between an internal guest and an external user in your directory, February will decide it for you.
There is a matching gap on the replacement side. Microsoft says passkey support for B2B users and internal guest users is “planned to be available by the end of calendar year 2026”, while those same users are already in scope for the February retirement. That is a narrow window, so guests are worth planning before staff, not after.
Working out where the SMS MFA retirement leaves you takes an afternoon. Microsoft publishes a PowerShell usage analyser for this exact question, and you need one of the Global Reader, Authentication Policy Administrator or Security Reader roles to run it. The FAQ sets the bar for being affected as low as it will go: “Any non-zero result means you’re in scope.” For the wider version of that exercise, our guide to auditing what has access to your tenant covers the accounts that never appear in a user report at all.
The Blocking Prompt Is a Service Desk Problem
After the applicable date, a user whose only available MFA method is SMS or voice has to register a passkey during sign-in. Microsoft is blunt about the mechanics: “This prompt is blocking. Users must register a passkey before they can continue to sign in to their account.”
Microsoft is equally clear that this is not a lockout. Asked whether customers will be locked out, the answer is “No”, followed by the explanation that affected users “will receive a blocking registration prompt to register a passkey” and “will no longer be able to skip this prompt”. Technically accurate. Operationally, a user standing in a warehouse with a shared device, or carrying a phone that cannot hold a passkey, or hearing the word passkey for the first time, is now a call to your service desk halfway through a sign-in.
That is the number to model. Not whether people get in eventually, but how many of them need help on the same Monday morning.
There is a cheap piece of insurance, and it sits in the FAQ. A second registered method is enough to avoid the blocking prompt: “Users who have registered and use TOTP for MFA won’t receive the blocking passkey registration prompt.” Getting OATH TOTP codes registered across the long tail buys time even where passkeys take longer.
Read the caveat before you lean on it. Microsoft notes that TOTP “isn’t phishing-resistant and doesn’t satisfy a Conditional Access policy that requires phishing-resistant authentication”. If you have already tightened Conditional Access in Microsoft 365, a TOTP fallback can fail the policy you wrote last year. The two need checking together, not in sequence.
Self-Service Password Reset Is in Scope Too
This is the part that catches organisations with a tidy MFA story and an untidy password reset story. The retirement is not limited to sign-in. Microsoft states it plainly: “The retirement of native SMS and voice applies across Microsoft Entra, including SSPR.”
If mobile phone text or call is one of the verification methods in your self-service password reset configuration, that method goes the same way on the same dates. SSPR methods are configured separately from authentication methods, in a different part of the portal, often by different people years apart. Checking one tells you nothing about the other.
There is also a piece Microsoft has not finished, and it is worth tracking. The FAQ says Microsoft “is also planning to introduce support to change password for users who authenticate with passwordless sign in. More details to come.” So the passwordless end state still has an open question about how those users change a password, and the answer is not published yet. If your reset path depends on a text message today, you need an interim answer that does not.
The pragmatic move is to get a second SSPR method registered now, while the old one still works. Our note on balancing password security against user experience covers why a reset path nobody can complete creates more risk than the password policy it was meant to protect.
How We Approach the SMS MFA Retirement in a Microsoft 365 Tenant
We run this as a tenant project with a deadline, not an awareness campaign. Transputec’s Microsoft 365 Managed Services take end-to-end ownership across licensing, identity, security, productivity and adoption, and the SMS MFA retirement touches most of that list at once.
The order of work matters more than the tooling. We start with the inventory, because the analyser output is the only honest scope anyone is going to get. Then we segment: privileged accounts first even though they have until July, then internal guests, then the long tail of staff. Most of the risk sits in accounts that have exactly one registered method, and that set is usually smaller than people fear and spread worse than they expect.
After that it is configuration we already do every week. Our Microsoft 365 work covers Conditional Access, MFA enforcement, Defender baselines and Intune profiles, with a tenant security baseline measured against NCSC and Microsoft Zero Trust guidance. On the modern workplace side the target state is the one Microsoft is now forcing anyway: conditional access, MFA, PIM and password-less wherever possible, on Entra ID, Intune and Defender configured to zero-trust baselines.
Two steps get skipped when organisations do this alone. The first is the communications sequence, which Microsoft supports with end-user templates and a phased awareness, action and reminder plan. Our 24/7 service desk picks up whatever the communications miss. The second is the clean-up, and Microsoft’s instruction on it is explicit: after users register and test a replacement, “remove them from the SMS and Voice calls policy scope if they no longer need those methods to prevent further nudges”. Teams migrate the users, leave the policy scope alone, then wonder why the prompts keep coming.
If your identity estate is not all in Entra ID yet, that is a different piece of work, and our write-up on Ping migration to Entra ID is the better place to start. On the device side, Windows Hello for Business across a Windows 11 estate removes a large share of this problem without anyone registering anything new.
Where to Start Before February
Four things, in this order.
Run the usage analyser this week and write the number down. It is the only figure that tells you whether the SMS MFA retirement is a project for you or a footnote.
Decide before 30 October whether any population genuinely needs telephony, because that route now has a procurement cycle attached to it and February is a hard stop. Get a second method registered for everyone else, since the blocking prompt only reaches users who have nothing but SMS or voice. And do your Global Administrators first, whatever their July date says.
None of this is a change of direction. The NCSC has ranked message-based authentication last for years, below FIDO2 credentials, authenticator apps, app-based code generators and hardware token generators, and its guidance on recommended types of MFA says message-based methods “are only likely to be appropriate when no other strengthening method is possible”. Microsoft has removed the option to ignore that. For anyone heading into the Cyber Security and Resilience Bill and the reporting duties attached to it, a documented move to phishing-resistant authentication is one of the easier wins to evidence.
If you want help scoping it, talk to our team about the authentication work behind Microsoft 365 Managed Services.
Frequently Asked Questions
Is Microsoft turning off multi-factor authentication?
No. MFA stays exactly as mandatory as it was. What ends is Microsoft’s own delivery of the text message or the phone call. Your Conditional Access policies, your MFA enforcement and every other registered method carry on working. Microsoft’s wording is that SMS and voice “will no longer be provided natively in Entra ID”, which is a sentence about plumbing rather than policy.
Does this affect the Microsoft Authenticator app?
No. The Microsoft Authenticator app sits outside the scope of this retirement, both push approvals and verification codes. Microsoft confirms that time-based one-time password codes continue: “TOTP remains supported for existing and new registrations after February 1, 2027”. A user who already has Authenticator registered will not meet the blocking passkey prompt either.
What will it cost to keep SMS after February 2027?
Microsoft is not charging for it, and it is not free. You contract with a telephony provider through Microsoft Security Store, and the FAQ says “Pricing varies by telephony provider and region”, with costs depending on usage, geography, provider and offer. Soprano and Telesign are the initial providers, both in private preview, and Soprano lists per-user and per-transaction options. Moving the same users to passkeys instead carries no additional cost.
Can we opt out of the SMS MFA retirement?
Partly, and only for a while. A temporary opt-out covers the 1 September 2026 to 1 February 2027 changes, set by patching the authentication methods policy in Microsoft Graph with passkeyDynamicMigration set to true. It delays the automatic passkey enablement and the registration campaign. It does not delay the retirement. Microsoft states that “there is no opt out for enforcement”, so the February and July dates apply to every tenant regardless.
Will our users be locked out on 1 February 2027?
No, and Microsoft says so directly. Users still on SMS or voice “will receive a blocking registration prompt to register a passkey” and cannot skip it, but they can complete the registration and carry on. The risk is not permanent lockout. It is a queue at your service desk made up of users who cannot complete that registration unaided. Anyone with a second registered method, TOTP included, avoids the prompt entirely.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
