Microsoft is urging administrators to move users in Microsoft Entra ID workforce tenants to phishing-resistant authentication methods before the company retires its SMS and voice authentication services, starting February 1, 2027.
The change applies only to workforce tenant authentication. It does not apply to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. After retirement, users will no longer be able to use Microsoft-provided SMS or voice authentication to complete multifactor authentication and sign in.
Microsoft recommends passkeys. Other supported options include QR code authentication and FIDO2 security keys. Organizations that need phone-based authentication can retain SMS and voice by configuring a customer-managed telecom provider through the Microsoft Security Store.
In a Microsoft 365 Message Center update on Tuesday, Microsoft said the retirement rollout will begin on February 1, 2027, and advised administrators to complete migration beforehand to avoid sign-in disruptions. The company cited phishing and SIM-swap attacks as risks associated with SMS and voice authentication.
Microsoft said passkeys are being rolled out as the default authentication experience for Entra ID, with the rollout announced in July and starting in September. As each organization receives the change, users enabled for SMS or voice will also be enabled for passkeys and prompted to register one at their next multifactor authentication.
Administrators with the Authentication Policy Administrator, Global Reader, or Security Reader roles can use Microsoft's Entra SMS/Voice Policy Scanner PowerShell script to identify users relying on these methods.
Comments
0No comments yet. Be the first to comment.