B2B guests and internal guest users: after Entra SMS and voice MFA retire
Short answer: External users (B2B) lose Microsoft-provided SMS and voice on 1 July 2027. Internal guests, meaning accounts with credentials in your own tenant and UserType set to Guest, follow the 1 February 2027 date. Passkey support for B2B and internal guest users is planned by the end of calendar year 2026; until then, the resource tenant can trust MFA done in the guest's home Microsoft Entra tenant.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| Passkey, FIDO2 key or Windows Hello for Business in the home tenant | ✓ yes | External users from another Microsoft Entra tenant, when you trust their home tenant MFA. | Only counts when Trust multifactor authentication from Microsoft Entra tenants is on. These methods can't be completed in the resource tenant. |
| Authenticator push or software OATH token in your tenant | no | Guests who register MFA in your tenant because MFA trust is off. | Not phishing-resistant. Hardware OATH tokens, FIDO2 keys and Windows Hello for Business aren't accepted in the resource tenant. |
| Temporary Access Pass | no | Internal guests only. You can add a TAP to an internal guest, not to an external guest. | External guests can use a TAP from their home tenant only if you trust their home tenant MFA. |
What to do
- Split guests by type. External guests sign in with their own identity provider; internal guests have UserType Guest and authentication methods registered in your tenant.
- As a Security Administrator, go to Entra ID > External Identities > Cross-tenant access settings. Edit the inbound defaults, or add a partner under Organizational settings.
- On the Trust settings tab, select Trust multifactor authentication from Microsoft Entra tenants and save.
- In Conditional Access, require an authentication strength for external users, such as the built-in Phishing-resistant MFA strength. It works together with your MFA trust setting.
- For internal guests, consider inviting them to B2B collaboration so they sign in with their own credentials, as Microsoft suggests.
- Move internal guests off SMS and voice before 1 February 2027, and external users before 1 July 2027.
Watch out
- Passkey (FIDO2) registration isn't supported today for internal or external guest users, and passkey registration campaigns don't nudge guests.
- B2B direct connect users are blocked when MFA is required and MFA trust is off.
- If you limit apps in inbound settings and don't trust home tenant MFA, allow the My Sign ins app so guests can register MFA in your tenant.
- Authentication strength applies only to external users who authenticate with Microsoft Entra ID. For email one-time passcode, SAML/WS-Fed and Google federation guests, use the MFA grant control.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
- Microsoft Learn: Cross-tenant access settings
- Microsoft Learn: Authentication and Conditional Access for B2B users
- Microsoft Learn: Configure a Temporary Access Pass in Microsoft Entra ID to register passwordless authentication methods
- Microsoft Learn: B2B guest user properties
- Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID
- Microsoft Learn: Run a Registration Campaign to Set Up a Passkey or Microsoft Authenticator
Did this fix it?
Other situations
- Users without a smartphone
- Shared and kiosk Windows PCs
- Frontline workers and shared mobile devices
- FIDO2 security keys and passkey profiles
- Windows Hello for Business and Entra passkey on Windows
- Passkeys in Microsoft Authenticator
- Break-glass accounts and Global Administrators
- Self-service password reset (SSPR)