Find every Entra ID user who still depends on SMS or voice MFA (free script)
One read-only PowerShell script lists the users whose only MFA method is SMS or a voice call, the date that applies to each of them (1 February or 1 July 2027) and what to move them to.
Download Find-SmsOnlyUsers.ps1 Free · read-only · Windows PowerShell 5.1 or PowerShell 7 · version 1.0.0 (27 Oct 2026) · MIT
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
What it reads
| Source | What you learn | Needs |
|---|---|---|
| User registration details | Methods each user registered, default MFA method, member or guest | Entra ID P1 or P2, AuditLog.Read.All |
| Global Administrator members | Who gets the 1 July 2027 date (active assignments) | RoleManagement.Read.Directory |
| Authentication methods policy | Whether SMS and Voice call are enabled | Policy.Read.All |
How to run it
- Install the module once:
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser. - Download the script above, read it (it only sends Graph GET requests), then unblock it:
Unblock-File .\Find-SmsOnlyUsers.ps1. If PowerShell refuses to run scripts, allow it for that window only:Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass. - Run
.\Find-SmsOnlyUsers.ps1and sign in with a role such as Global Reader, Reports Reader or Security Reader. - Open
SmsOnlyUsers-<date>.html(a CSV is written next to it).
What the verdicts mean
- SMS/VOICE ONLY: only phone methods (email and security questions are not MFA methods). From their date these users get a blocking prompt to register a passkey.
- DEFAULT IS SMS: another method exists but SMS or voice is the default. Make the other method the default.
- HAS ANOTHER METHOD: test the other method, then remove the user from the SMS and Voice policy to stop the nudges.
- NO MFA METHOD: not part of this retirement, but check that your MFA policies cover the account.
Limits: the registration report can be up to 36 hours old. Guests with #EXT# in their user principal name count
as external users (July), other guests as internal guests (February). Eligible PIM Global Administrators are not seen. Users moved to
a telephony provider are not blocked; the script can't see that setting. Tested with sample data on 27 Oct 2026.
Then pick a replacement per situation
Overview and options: no smartphone, shared PCs, frontline workers, guests, security keys, Windows Hello and admin accounts.