Microsoft is putting a firm end date on a security habit many organizations still rely on: SMS and voice-based multifactor authentication in Microsoft Entra. According to reporting from Windows Latest, Microsoft-provided SMS and voice authentication will be retired for Entra tenants by February 1, 2027, with passkeys becoming the expected path forward well before then.

For IT teams, the important point is not simply that passkeys are more modern. It is that Microsoft is treating telephony MFA as an increasingly weak control in a world where phishing kits, SIM-swap fraud, automated social engineering, and AI-assisted credential attacks are easier to scale. If users can still approve sign-ins through a text message or phone call, attackers have a bigger target than they would with phishing-resistant methods tied to a device and cryptographic key.

What is changing in Entra

The transition begins before the final 2027 cutoff. Starting September 1, 2026, Entra users can be prompted to register a passkey during an MFA challenge. Microsoft is expected to publish telecom provider details later in September 2026 for organizations that have a regulatory or operational need to keep SMS or voice, but that path moves away from Microsoft-provided telephony and toward customer-managed providers.

By October 30, 2026, organizations that still need telephony-based MFA are expected to have a supported telecom provider configured through Microsoft’s Security Store. Then, on February 1, 2027, Microsoft-provided SMS and voice MFA reaches the hard stop. Windows Latest notes that Microsoft is not describing this as an optional change, and admins should plan around the assumption that the deadline will hold.

This does not mean accounts are deleted or data disappears. The operational risk is more practical: users who have only SMS or voice registered may be blocked at sign-in until they register a passkey. That kind of forced registration flow is manageable for a prepared IT department, but painful for a help desk that discovers the problem on deadline day.

Why Microsoft is pushing passkeys

Passkeys are based on public-key cryptography. The private key remains on the user’s device or security hardware, while the service validates authentication using the matching public key. Unlike a password, one-time code, or phone-based approval path, there is no shared secret for a fake sign-in page to collect.

That distinction matters. SMS codes can be intercepted, socially engineered from users, redirected through SIM-swap attacks, or abused through telecom weaknesses. Voice calls can be manipulated in similar ways. Passkeys reduce the value of a cloned login page because the credential is bound to the legitimate service and, depending on the implementation, to the device or authenticator.

For Windows environments, the likely options are Windows Hello for Business, FIDO2 security keys, the Microsoft Authenticator app, and platform passkeys on supported desktop and mobile ecosystems. Highly privileged users should be treated more strictly than ordinary users. Administrators, finance staff, security personnel, and regulated roles are good candidates for device-bound credentials or hardware security keys rather than the most convenient synced option.

Admin checklist: start with discovery

The first practical step is to measure exposure. Identify users who still have SMS or voice as an available or primary authentication method. Do not rely on assumptions, because legacy MFA settings often survive for years after a passwordless project begins.

Create a report that separates users into useful groups: administrators, executives, frontline workers, contractors, shared operational accounts, guests, and ordinary employees. The migration path may differ for each group. An office worker with a modern Windows 11 laptop can usually move to Windows Hello for Business more easily than a field worker using a shared device or a contractor signing in from unmanaged hardware.

This is also the right time to review self-service password reset. The retirement is not only about interactive sign-ins. If password reset flows still depend on SMS or voice, those workflows need the same attention before the deadline.

Check device readiness before you campaign

A passkey migration can fail for boring reasons: old operating systems, unsupported browsers, missing platform configuration, unclear mobile policy, or users who do not understand what they are being asked to register. Windows Latest highlights Windows 10 22H2 as a minimum baseline for Windows Hello for Business and Windows 11 22H2 as the better experience for modern passkey use.

Organizations with older endpoints are not necessarily stuck, but they may need external FIDO2 security keys or a phased hardware refresh. That planning should happen early, especially for remote workers and high-risk accounts. Procurement delays for security keys are much easier to handle in 2026 than during the final weeks before enforcement.

Communicate the change as a security upgrade, not an inconvenience

Users will experience this as a sign-in change, so messaging matters. Explain that text messages and phone calls are being retired because attackers can trick, redirect, or automate attacks against them. Keep the instruction simple: what users need, when they need to register, and where to get help.

A good rollout should include pilot groups, screenshots, short internal videos, and help desk scripts. Start with IT and security staff, then administrators and executives, then broader employee groups. Track registration progress weekly and escalate to managers before the deadline becomes urgent.

The bottom line

The Entra passkey mandate is not just another Microsoft roadmap item. It is a countdown for organizations that still treat SMS and voice as acceptable MFA defaults. The safest approach is to discover affected users now, decide which passkey methods fit each population, test registration flows, and begin a controlled migration well before September 2026.

The distinctive operational takeaway is simple: treat February 1, 2027 as a help-desk deadline, not just a security deadline. If users wait until the block appears, IT will own the disruption. If admins start now, the move away from SMS MFA can become a measured security improvement rather than a last-minute access crisis.

Source: Windows Latest source