SMS MFA Is Retiring: Move to Passkeys in Microsoft Entra

Maya’s phone buzzes with a six-digit code. She types it in and she’s signed in. That code travelled through the phone network to reach her, and anyone who can sit on that path, or convince her carrier to move her number to their SIM card, gets it too.

On February 1, 2027, Microsoft-provided text message and voice call verification retires in Microsoft Entra ID, and passkeys take its place. Here’s what changes and when, why passkeys are the replacement, and the five steps we walked through in a lab tenant.

What’s changing, and when

• September 1, 2026: passkeys became the default. Users enabled for text message or voice verification were automatically enabled for passkeys too. The next time they complete multifactor authentication, they’re asked to set up a passkey. For now they can snooze the prompt, and by default the snoozes are unlimited.
• October 30, 2026: bring your own telephony provider. Organizations that need to keep text messages or voice calls can set up their own provider through the Microsoft Security Store.
• February 1, 2027: Microsoft stops delivering those texts and calls. Users whose only multifactor method is text or voice get a prompt they can’t skip: register a passkey, or they don’t get in. There’s no opt-out.

Global Administrators and external users get more time and move on July 1, 2027. Internal guests follow the February date. This timeline is for the public cloud, and Azure AD B2C isn’t affected.

Why text and voice codes are weak

A code sent by text or voice can be taken without ever touching your phone:

• Phishing: Maya clicks a link in an email and lands on a page that looks exactly like her sign-in page. She types her password, then the code from her phone. The fake page passes both to the real one in real time, and the attacker is in.
• SIM swap: the attacker calls Maya’s carrier, pretends to be her and gets her number moved to a new SIM card. Now her codes arrive on their phone.
• Replay: the code is just six digits, so anything that can read it, along the way or on a screen, can reuse it before it expires.

Microsoft’s own guidance says it plainly: move away from text messages and voice calls for multifactor authentication.

What a passkey actually is

A passkey isn’t a code. It’s a pair of keys that belong together:

1. When Maya creates a passkey, her device makes two keys. The private key stays with her, locked behind her face, fingerprint or PIN. The public key goes to Microsoft Entra ID.
2. When she signs in, Entra sends a challenge. Her device asks her to unlock it, signs the challenge with the private key and sends the answer back.
3. Entra checks the answer with the public key. The private key itself is never sent.

Now the phishing page again. The passkey was made for Microsoft’s real sign-in address. The fake page has a different address, so Maya’s device has nothing to offer it, and with no code to type there’s nothing to steal. That’s why passkeys are called phishing-resistant. They’re built on the FIDO2 standards and work as multifactor authentication on their own: something you have (the device) plus something you are or know (your face or your PIN).

Device-bound vs synced passkeys

• Device-bound passkeys never leave the device that made them. Microsoft Authenticator on iPhone and Android stores passkeys this way, and so do FIDO2 security keys, the small USB or NFC keys.
• Synced passkeys are backed up by a passkey provider, like Apple Passwords with iCloud Keychain or Google Password Manager, and show up on the user’s other devices. Microsoft Entra ID has supported them since March 2026.

Admins choose which kinds to allow, and one setting decides a lot: attestation. With attestation enforced, Entra checks what made the passkey, so only device-bound passkeys qualify. Synced passkeys can’t be attested.

Microsoft’s guidance is security keys for highly regulated industries or privileged users, while for most users synced passkeys are a convenient, low-cost alternative to traditional MFA.

Passkeys are one of several phishing-resistant options in Entra ID. The full list is Windows Hello for Business, Platform Credential for macOS, synced passkeys, FIDO2 security keys, passkeys in Microsoft Authenticator, and certificate-based authentication.

What it means for your tenant

• Who’s affected: any user who’s enabled for text message or voice verification. If nobody in your tenant is, there’s nothing to do.
• Temporary opt-out: until February 1, a tenant can pause the automatic passkey enablement and the registration prompts through a Microsoft Graph setting. It only buys time and doesn’t stop the February enforcement.
• Your own telephony provider: if you truly need text or voice, for regulatory or operational reasons, you can bring your own provider through the Microsoft Security Store from October 30. The first providers in the preview are Soprano and Telesign. You contract with them directly, and you pay them.

A few things people miss:

• Self-service password reset uses the same text and voice delivery, so it’s part of the retirement too, unless you use a provider.
• SMS sign-in, where frontline workers sign in with just their phone number and a code, also retires on February 1, 2027, and a telephony provider doesn’t keep it alive.
• Guests: passkey support for internal guests is rolling out now, with external users to follow.
• Cost: passkeys are included in every Microsoft Entra ID edition, even Free. The activity reports and Conditional Access used below need at least Microsoft Entra ID P1. Check Microsoft Learn for what your plan includes.

In the lab: five steps

We walked through the move in a lab tenant with test users. The settings below are what we picked for the demo, not requirements.

1. Find who’s on text and voice

In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Policies. SMS and Voice call show who they’re enabled for. In our lab, SMS was on for a group called SMS users.

To see the people, open Activity > User registration details and look at Methods registered: everyone with Mobile phone still has a phone number for MFA. This report needs at least Entra ID P1 and can lag by up to 36 hours.

Microsoft also publishes a PowerShell script on GitHub (entra-sms-voice-usage-analyzer) that reads your SMS and voice policy targets and your registration campaign state. It shows which groups are targeted, not individual users.

2. Turn on passkeys

Back in Policies, open Passkey (FIDO2). Our tenant was already opted in to passkey profiles. Once you opt in, you can’t opt out.

• On Configure, Allow self-service set up stays Yes, so users can register their own passkeys.
• The Default passkey profile decides what’s allowed. With Enforce attestation on, only device-bound passkeys are offered. In the lab we turned it off and allowed both Device-bound and Synced.
• Then Enable and target: in our lab, all users.

3. Run a registration campaign

Under Authentication methods > Registration campaign, State has three options: Microsoft managed, Enabled and Disabled. With Enabled, we kept the method on Passkey (FIDO2), set the snooze to 3 days (it goes from 0 to 14), turned on Limited number of snoozes (three snoozes), and targeted the SMS users group.

Now, at their next sign-in with MFA, those users are asked to set up a passkey. The prompt doesn’t show on Linux, and guests aren’t nudged.

4. Maya registers a passkey on her iPhone

We recorded this on a real iPhone running iOS 27. Passkeys in Authenticator need iOS 17 or later, and on Android the screens differ. Before the take, we installed Microsoft Authenticator and turned it on as a passkey provider in Settings > General > AutoFill & Passwords.

1. Maya opens myaccount.microsoft.com in Safari and signs in with her password, then verifies with a text message code.
2. The registration campaign appears: Let’s keep your account secure. She taps Next, then Next again on Sign in faster with your face, fingerprint, or PIN.
3. iOS offers two places to save the passkey: Authenticator or Apple’s Passwords app. Passwords would make a synced passkey in iCloud Keychain. Maya picks Authenticator, where passkeys are device-bound, so this one stays on this iPhone.
4. Touch ID confirms it, she names it, and: Passkey created.

Microsoft’s docs recommend creating the passkey inside the Authenticator app itself. This browser route only works with Authenticator because we turned Enforce attestation off in step 2. With attestation on, Maya would add her account in Authenticator and create the passkey there.

Then we tested sign-in. Safari suggested her passkey and asked for Touch ID. The first try ended with “Something went wrong”, so she tapped Try again and Use Passkey, used Touch ID again, and she was in. No password, no text code.

5. Require it with Conditional Access, then switch text and voice off

Registering a passkey doesn’t stop someone from still using a text code. To require it, we created a Conditional Access policy:

• Users: the SMS users pilot group.
• Target resources: one app for the test, Office 365.
• Grant: Require authentication strength, Phishing-resistant MFA. It can’t be combined with Require multifactor authentication in the same policy.
• Enable policy: Report-only. In this mode Conditional Access evaluates the policy but doesn’t enforce it, so nobody gets blocked while you check the results.

One trap from Microsoft’s docs: if a policy like this targets all resources, users can get stuck in a loop while registering a passkey in Authenticator. Scoping it to specific apps avoids that.

Once your users have moved, SMS and Voice call can be turned off, or the migrated groups excluded, on the same Policies page. In the lab we only showed where, and discarded the change. If you still use the old MFA and password reset settings, Manage migration at the top of Policies shows where you are. Once it’s set to Migration Complete, Entra only follows the Authentication methods policy.

Recap

1. Find who’s still on text and voice.
2. Turn on passkeys.
3. Run a registration campaign, so users are asked to create one when they sign in.
4. Pilot a Conditional Access policy that requires phishing-resistant MFA, in Report-only first.
5. Switch text and voice off once users have moved.

February 1, 2027 is the date to beat.

Sources

• SMS and voice retirement in Microsoft Entra ID and its FAQ
• Passkeys (FIDO2) in Microsoft Entra ID and how to enable them
• Register a passkey in Microsoft Authenticator
• Registration campaign
• Authentication strengths in Conditional Access
• Authentication methods activity
• Manage authentication methods (migration)
• Phone authentication options