Frontline workers and shared mobile devices: after Entra SMS and voice MFA retire
Short answer: Microsoft's frontline guidance puts synced passkeys first, with FIDO2 security keys and smart cards as the phishing-resistant options when synced passkeys can't be used. For shared iOS, iPadOS or Android devices, use shared device mode, and treat QR code sign-in as a single-factor method that needs Conditional Access around it. If workers use SMS sign-in today, plan a replacement: it is configured in the SMS authentication method policy, which is being retired.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| Synced passkey | ✓ yes | Workers who use their own phone. | Synced passkeys don't support attestation. Check that the device meets the passkey provider requirements. |
| FIDO2 security key | ✓ yes | No corporate phone, or workers who move between shared devices. Microsoft lists key registration on behalf of the worker as the preferred onboarding step. | Admin provisioning through Microsoft Graph is in preview. Plan for lost keys. |
| QR code and PIN | no | Shared iOS, iPadOS or Android devices. The QR code can go on a badge and the PIN is 8 to 20 digits. | Single-factor. Doesn't work with desktop apps or browsers. Enable it only for the frontline group. |
| Temporary Access Pass | no | First sign-in or a lost key, to register a passkey or security key. | Not meant as a daily sign-in method. |
What to do
- Create a group for frontline workers. Passkey profiles let you set different rules for groups such as admins and frontline staff.
- Enable passkeys (FIDO2) with a profile for this group. Allow both Synced and Device-bound passkey types if workers will use their own phones as well as keys.
- For workers without a phone, provision FIDO2 security keys on their behalf with the Microsoft Graph APIs (preview). This needs the Authentication Administrator role or an app with
UserAuthenticationMethod.ReadWrite.All. - Set up shared mobile devices in shared device mode through Intune or another supported MDM, and require compliant devices with Conditional Access.
- If you use QR codes, enable QR code in the Authentication methods policy for the frontline group only (it is off by default). Adding the method for a user creates a standard QR code and PIN. Use a custom authentication strength with QR code under Single factor authentication for frontline apps.
- Require phishing-resistant authentication or MFA when workers access resources from outside the store or workplace network.
Watch out
- A user newly enabled for QR code must sign in once with another method, or they see an Incorrect QR code error.
- QR code has no self-service PIN reset and no bulk provisioning in the current release.
- Microsoft suggests moving frontline workers who use SMS sign-in to QR code authentication.
- Passkey registration campaigns run in mobile browsers and native iOS apps, but not native Android apps yet. Authenticator campaigns don't run on mobile devices.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: Considerations for specific personas in a phishing-resistant passwordless authentication deployment
- Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID
- Microsoft Learn: QR code authentication method in Microsoft Entra ID
- Microsoft Learn: Shared device mode overview
- Microsoft Learn: Best practices to protect frontline workers
- Microsoft Learn: SMS-based user sign-in for Microsoft Entra ID
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
- Microsoft Learn: Run a Registration Campaign to Set Up a Passkey or Microsoft Authenticator