Entra ID SMS and voice MFA retirement: who gets blocked on 1 February 2027

Short answer: Microsoft Entra ID stops delivering MFA codes by SMS and voice call itself. On 1 February 2027 (1 July 2027 for Global Administrators and external users) anyone whose only MFA method is SMS or voice must register a passkey before they can sign in again. Move those users to a passkey, Windows Hello, a security key or an authenticator app first.

Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.

Timeline

1 Sep 2026	Passkeys became the default. Users enabled for SMS or voice were auto-enabled for passkeys and get a snoozable registration prompt after MFA (registration campaign set to Microsoft managed).
30 Oct 2026	Tenants that must keep SMS or voice can configure a paid telephony provider in Microsoft Security Store.
1 Feb 2027	Microsoft-provided SMS and voice retired for everyone except Global Administrators and external users. Internal guest users are in this group. SMS-only users get a blocking passkey registration prompt.
1 Jul 2027	The same for Global Administrators and external users.

Who is affected and who isn't

Blocked at sign-in: users whose only available MFA method is Microsoft-provided SMS or voice.
Not blocked: users who already sign in with a passkey, Windows Hello for Business or another phishing-resistant method, users who registered and use verification codes (TOTP), and users moved to a configured telephony provider. Users still enabled for SMS or voice can keep getting the snoozable prompt until you remove them from the SMS and Voice policy.
Self-service password reset is included: SMS and voice codes stop there too unless you use a telephony provider.
Out of scope: Azure AD B2C; Entra External ID tenants get their own announcement later; external MFA methods; the timeline is for the public cloud only.

Find the users who will be blocked

Microsoft's entra-sms-voice-usage-analyzer shows which policies still allow SMS and voice; its README says it is not a per-user inventory. For the people themselves:

Free script: Find-SmsOnlyUsers.ps1 (read-only) lists every SMS/voice-only user with their date (February or July), flags users whose default method is still SMS, and suggests the replacement per user.
Admin center: Entra ID → Authentication methods → Activity → Registration tab → the user registration details list, filtered on Methods registered. Needs Entra ID P1 or P2; the data can be up to 36 hours old.
PowerShell (Microsoft Graph, AuditLog.Read.All, same licence): users whose only methods are phone numbers (email and security questions don't count, they are not MFA methods):

Connect-MgGraph -Scopes AuditLog.Read.All
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { ($_.MethodsRegistered -match 'Phone$') -and -not ($_.MethodsRegistered -notmatch 'Phone$|^email$|securityQuestion') } |
  Select-Object UserPrincipalName, UserType, IsAdmin, @{n='Methods'; e={$_.MethodsRegistered -join ' '}} |
  Export-Csv .\sms-only-users.csv -NoTypeInformation

IsAdmin is true for any admin role, but only Global Administrators get the July date. Guests: external (B2B) users get July, internal guest users February.

What to move users to

Method	Phishing-resistant	Best for	Watch out
Passkey in Microsoft Authenticator	✓ yes	Users with a smartphone they can use for work.	Device-bound: a new phone means registering again.
Synced passkey (iCloud Keychain, Google Password Manager)	✓ yes	Users who already use a platform password manager.	The passkey follows the user's personal account across devices.
FIDO2 security key	✓ yes	No smartphone, shared PCs, places where mobile passkeys don't work.	Hardware to buy, hand out and replace.
Windows Hello for Business	✓ yes	Users on their own Windows PC.	Tied to that PC; users who already have it can keep using it.
Verification codes (TOTP app or OATH token)	no	A fallback that avoids the blocking prompt: still supported after 1 Feb 2027.	Doesn't satisfy Conditional Access policies that require phishing-resistant MFA.
SMS or voice through a telephony provider	no	A documented regulatory or operational need for SMS or voice.	Paid, priced by provider and region; set up in Microsoft Security Store from 30 Oct 2026 and move users before the date.

By situation

Users without a smartphone: Give these users a FIDO2 security key: a device-bound passkey on a physical key that needs no phone.
Shared and kiosk Windows PCs: Give each user of a shared Windows PC their own FIDO2 security key, a portable passkey they can use on any PC that has security key sign-in turned on.
Frontline workers and shared mobile devices: Microsoft's frontline guidance puts synced passkeys first, with FIDO2 security keys and smart cards as the phishing-resistant options when synced passkeys can't be used.
B2B guests and internal guest users: External users (B2B) lose Microsoft-provided SMS and voice on 1 July 2027.
FIDO2 security keys and passkey profiles: Turn on Passkey (FIDO2) in the Authentication methods policy, opt in to passkey profiles, and give security key users a profile with Passkey types set to Device-bound.
Windows Hello for Business and Entra passkey on Windows: Users who already sign in with Windows Hello for Business can keep using it after the retirement, and Microsoft lists it as a phishing-resistant method.
Passkeys in Microsoft Authenticator: A passkey in Microsoft Authenticator is a device-bound, phishing-resistant passkey kept on the user's iOS or Android phone.
Break-glass accounts and Global Administrators: Microsoft-provided SMS and voice ends for Global Administrators on 1 July 2027; users in other admin roles follow the 1 February 2027 date.
Self-service password reset (SSPR): The retirement of Microsoft-provided SMS and voice applies to SSPR as well, unless you configure a telephony provider through Microsoft Security Store.

Delay the automatic passkey rollout (not the deadline)

A temporary opt-out stops the automatic passkey enablement and registration campaign until 1 February 2027. It needs Policy.ReadWrite.AuthenticationMethod:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
{ "optOutSettings": { "passkeyDynamicMigration": true } }

It does not move the retirement: from each group's date the blocking prompt applies whatever this setting says.

Tell your users

Microsoft suggests three messages to the SMS and voice group: awareness (what changes and why), action (how to register a passkey on Windows, iPhone or Android) and a reminder for those who haven't. It publishes end-user communication templates for email and Teams.

Sources

Did this fix it?