Microsoft Mandates Passkey Migration for Entra ID Users, Phasing Out SMS and Voice Authentication
Microsoft is retiring SMS and voice authentication in Entra ID by February 1, 2027, urging administrators to migrate users to passkeys to mitigate phishing and SIM-swap risks.
Microsoft has issued a critical reminder to Entra ID administrators, urging them to transition users away from SMS and voice-based authentication methods before the planned retirement on February 1, 2027. This move, detailed in Message Center notice MC1528000, aims to bolster security by reducing susceptibility to phishing attacks and SIM-swap fraud, which commonly target phone-based verification codes.
The retirement affects both Worldwide and Government Community Cloud environments, with the full transition expected to conclude in early February 2027. Administrators are advised to proactively prepare their users, especially those who rely solely on phone authentication, to prevent sign-in disruptions. Users who already have alternative sign-in methods registered, such as a passkey or password, will automatically fall back to those methods and will not be required to register a passkey.
However, users whose only registered sign-in method is SMS or voice authentication face a more direct path to migration. These users will be able to use their existing method one final time to verify their identity, after which they must register a passkey to maintain access to their accounts. This necessitates a focused effort by organizations to identify and assist these vulnerable user groups.
Passkeys, which leverage FIDO standards and public-key cryptography, offer a significant security upgrade over traditional phone-based methods. Unlike SMS or voice codes, passkeys are resistant to phishing and credential theft. They utilize a cryptographic key pair, with the private key stored securely on the user's device (protected by a PIN or biometric scan) and the public key on the service. This mechanism ensures that the credential is only valid for the specific service it was created for, rendering fake login pages ineffective.
The urgency of this migration is underscored by ongoing threats like SIM-swap attacks, where attackers compromise a user's phone number to intercept verification codes. By moving to passkeys, organizations can significantly reduce their exposure to such attacks and enhance overall account security. Microsoft's documentation provides detailed guidance on how passkeys work and their security benefits.
Organizations are encouraged to communicate this upcoming change clearly to their employees and ensure helpdesk teams are equipped to support users through the passkey registration process. For entities that require continued phone authentication capabilities, Microsoft is enabling configuration of customer-managed telecom providers starting October 30, 2026. This option allows organizations to retain control over their telecom provider selection, pricing, and support, with existing customer-managed providers remaining unaffected.
Ultimately, this initiative represents Microsoft's continued commitment to enhancing identity security within its ecosystem. By phasing out less secure authentication methods and promoting the adoption of more robust solutions like passkeys, Microsoft aims to create a more resilient and secure digital environment for its users against an evolving threat landscape.