Users without a smartphone: after Entra SMS and voice MFA retire
Short answer: Give these users a FIDO2 security key: a device-bound passkey on a physical key that needs no phone. On their own Windows PC they can also use Windows Hello for Business or a Microsoft Entra passkey on Windows. A hardware OATH token (TOTP) also keeps them out of the blocking passkey prompt that starts after 1 February 2027, because that prompt only targets users whose only MFA method is SMS or voice, but it is not phishing-resistant.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| FIDO2 security key | ✓ yes | No phone needed. Signs in to Microsoft Entra joined and hybrid joined Windows 10 and 11 PCs and to web sign-ins. Microsoft's persona guidance mentions handing out keys where users won't use phone apps. | A lost key means help desk recovery work. Register a second method and plan how users get a replacement key. |
| Windows Hello for Business | ✓ yes | User has their own Windows PC. Sign-in uses a PIN or biometrics and the credential stays on that PC. | Works only on that device. The user still needs a portable method for other devices. |
| Microsoft Entra passkey on Windows | ✓ yes | Windows PC that isn't Entra joined or registered. The passkey lives in the local Windows Hello container. | Device-bound and not synced. It can't be used to sign in to Windows itself. |
| Hardware OATH token (TOTP) | no | Key fob that shows a one-time code. A registered token keeps the user out of the blocking passkey prompt. | Not phishing-resistant and doesn't satisfy Conditional Access that requires phishing-resistant MFA. Hardware OATH token management is in preview. |
| Temporary Access Pass | no | Time-limited passcode the user signs in with to register a security key or Windows Hello for Business. | For bootstrap and recovery only. With a one-time TAP, registration must finish within 10 minutes of sign-in. |
What to do
- List the SMS-only users with the free read-only script (Microsoft's
entra-sms-voice-usage-analyzershows only which policies enable SMS or voice), then put users without a smartphone in their own group. - As an Authentication Policy Administrator, go to Entra ID > Security > Authentication methods > Policies > Passkey (FIDO2), opt in to passkey profiles, set Allow self-service set up to Yes, and assign the group a profile with Passkey types set to Device-bound.
- Enable Temporary Access Pass in the Authentication methods policy for the group. An Authentication Administrator then creates a TAP under Entra ID > Users > Authentication methods > Add authentication method.
- The user signs in to Security info with the TAP, chooses Add sign-in method > Passkey, and saves the passkey to a security key. You can also provision keys for users with the Microsoft Graph provisioning APIs (preview).
- For users who can't use a key, enable Hardware OATH tokens (Preview) under Entra ID > Authentication methods, add and assign tokens with Microsoft Graph, and have users activate them in Security info with Add sign-in method > Hardware token.
- After the new method works, remove the user from the SMS and Voice calls policy scope so the passkey nudges stop.
Watch out
- Users must complete MFA within the past five minutes to register a passkey. Users with no MFA method yet can sign in with a TAP instead.
- TOTP, from a hardware token or an app, doesn't satisfy a Conditional Access policy that requires phishing-resistant authentication.
- In the hardware OATH token preview refresh, a token can be assigned to only one user.
- Microsoft recommends at least two registered methods per user, so a lost key or a new PC doesn't lock the user out.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
- Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID
- Microsoft Learn: Register a passkey with a FIDO2 security key
- Microsoft Learn: FIDO2 Security Key Sign-in to Windows
- Microsoft Learn: OATH tokens authentication method
- Microsoft Learn: How to manage OATH tokens in Microsoft Entra ID (Preview)
- Microsoft Learn: Configure a Temporary Access Pass in Microsoft Entra ID to register passwordless authentication methods
- Microsoft Learn: Enable Microsoft Entra passkey on Windows
- Microsoft Learn: Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
- Microsoft Learn: Considerations for specific personas in a phishing-resistant passwordless authentication deployment
Did this fix it?
Other situations
- Shared and kiosk Windows PCs
- Frontline workers and shared mobile devices
- B2B guests and internal guest users
- FIDO2 security keys and passkey profiles
- Windows Hello for Business and Entra passkey on Windows
- Passkeys in Microsoft Authenticator
- Break-glass accounts and Global Administrators
- Self-service password reset (SSPR)