Break-glass accounts and Global Administrators: after Entra SMS and voice MFA retire
Short answer: Microsoft-provided SMS and voice ends for Global Administrators on 1 July 2027; users in other admin roles follow the 1 February 2027 date. Microsoft's emergency access guidance is two or more cloud-only accounts with the Global Administrator role that use a passkey (FIDO2), which is recommended, or certificate-based authentication. These accounts shouldn't be tied to any one person's phone.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| FIDO2 security key | ✓ yes | Recommended for emergency access accounts. Keep the keys in secure, separate locations. | Use a different method from your daily admin accounts. |
| Certificate-based authentication | ✓ yes | Emergency accounts in organizations that already run a PKI. | More complex to set up. Make sure the configuration really completes multifactor authentication. |
| Passkey in Microsoft Authenticator | ✓ yes | Daily admin accounts. Microsoft lists it as an alternative portable credential for admins. | Not for emergency accounts, which shouldn't be connected to employee phones. |
| SMS or voice | no | Not a fit for emergency accounts. | A cell network outage is one of the cases emergency accounts exist for, and Microsoft-provided delivery ends for Global Administrators on 1 July 2027. |
What to do
- List accounts with the Global Administrator role and accounts in other admin roles that still use SMS or voice. Global Administrators follow 1 July 2027; other admins follow 1 February 2027.
- Keep at least two cloud-only emergency access accounts on the *.onmicrosoft.com domain, not federated or synced from on-premises, with Global Administrator assigned as permanent active in Privileged Identity Management.
- Enable passkeys (FIDO2) with a device-bound, attestation-enforced profile for admins (as in Microsoft's IT admin example) and register a FIDO2 security key for each emergency account. Use certificate-based authentication instead if you already run a PKI.
- Put the accounts in a dedicated group (for example EmergencyAccess) and exclude it from Conditional Access policies that block or restrict sign-in.
- Alert on every sign-in by these accounts, for example with an Azure Monitor log search alert on SigninLogs, and test sign-in at least every 90 days.
- Check that no MFA or SSPR method on these accounts points to one person's device or personal details.
Watch out
- There is no opt-out from enforcement. After 1 July 2027, a Global Administrator whose only MFA method is SMS or voice, including an emergency account, gets a blocking passkey prompt.
- Admin SSPR uses a fixed two-gate policy: two pieces of data such as email, authenticator app or phone number, and no security questions. SSPR is part of the retirement, so give admins a pair that doesn't rely on SMS or voice.
- Emergency account credentials and devices must not expire or fall under automated cleanup for lack of use.
- Report-only Conditional Access policies don't block access and don't need an emergency account exclusion.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: Manage emergency access admin accounts
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
- Microsoft Learn: Self-service password reset policies
- Microsoft Learn: Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
- Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID