The change, documented by Microsoft Learn and independently reported by TechRadar and IT Pro, does not ban SMS from Entra ID outright. It changes who operates—and pays for—the delivery channel. Organizations with a regulatory, operational, or technical reason to retain SMS or voice must configure a customer-managed telecom provider through the Microsoft Security Store before the cutoff. Everyone else is being pushed toward passkeys, Windows Hello for Business, or FIDO2 security keys.
For administrators, the important distinction is that this is not a recommendation buried in a security baseline. Microsoft has set an enforcement date, and the only durable exceptions will require a provider relationship and configuration work that are not available to start until late October.
September starts the registration push
Microsoft’s first operational milestone arrives on September 1, 2026. Users who are enabled for SMS or voice in the Entra Authentication Methods Policy will be automatically enabled for passkeys and brought into a Microsoft-managed registration campaign. After an eligible user completes MFA, Entra will prompt that user to register a passkey.
The prompt is initially deferrable. That should prevent a September support-desk spike from immediately becoming an access outage, but it should not be mistaken for a permanent grace period. The February 2027 enforcement has no tenant-wide opt-out.
Microsoft provides a temporary escape hatch for the September-to-February transition. An administrator with the Microsoft Graph Policy.ReadWrite.AuthenticationMethod permission can update the authentication methods policy and set passkeyDynamicMigration to true, delaying the automatic passkey enablement and registration campaign while the tenant completes migration work.
That setting is a scheduling tool, not an exemption. On February 1, 2027, a tenant that retains Microsoft-managed SMS or voice users without configuring a customer-managed telecom provider loses Microsoft’s delivery service. For users with no alternative method, the passkey prompt becomes blocking.
The practical implication is easy to miss: delaying the campaign increases the amount of work left before the hard cutoff. It can make sense where a company is deploying FIDO2 keys, resolving shared-device problems, or contracting with a carrier. It is a poor substitute for identifying affected users and testing the intended authentication route now.
Microsoft’s own documentation defines the September automatic-enablement scope in terms of the Authentication Methods Policy. That is more precise than treating every historic phone-based MFA registration as automatically in scope. Administrators should audit the active SMS and voice policy assignments, registration-campaign configuration, Conditional Access authentication strengths, and the actual methods users have registered. A user with a phone number on file is not necessarily a user whose only workable sign-in path is SMS.
The calendar has one conflicting date—and the primary record wins
Microsoft’s retirement page specifies February 1, 2027, repeatedly: in its timeline, its enforcement description, and its FAQ. TechRadar and IT Pro also report the February 1 date.
Yet Microsoft’s own GitHub repository for its Entra SMS/Voice Policy Scanner currently says January 28, 2027 in its sample output and retirement timeline. The repository links back to the February 1 retirement documentation, making the three-day discrepancy look like a stale or erroneous scanner reference rather than a revised deadline.
Administrators should plan to the official February 1 date while treating January 28 as a warning that operational documentation is still being adjusted. More importantly, no responsible migration plan should leave production cutover, carrier validation, or user enrollment to either date. A telecom provider that works in a pilot but fails to deliver consistently in a required country is still an outage; the calendar discrepancy does not change that risk.
Microsoft says it will publish more customer-managed telecom information on September 18, 2026, and that customers needing to preserve SMS or voice will be able to select and configure a provider in the Security Store starting October 30, 2026. Pricing is not included in the retirement notice. Microsoft says charges will vary by provider, region, message volume, and geographic distribution, which means this is a shift of both responsibility and cost from Microsoft’s bundled authentication service to the customer.
The retirement timeline applies to public-cloud environments. Microsoft says other cloud environments will receive a later schedule. That matters for organizations operating sovereign, government, or otherwise specialized Entra deployments: they should not assume February 1 applies to those environments, but they also should not assume the eventual requirement will be materially different.
Passkeys change the phishing transaction
Microsoft frames the move as preparation for wider enterprise AI use, but the underlying security case predates the current AI marketing cycle. NIST’s digital identity guidance treats public-switched telephone network authentication as restricted and says verifiers should consider indicators including SIM changes, device swaps, and number porting before sending an out-of-band secret by phone. NIST also requires alternatives because phone coverage and access are not universal.
The larger weakness is phishability. An SMS one-time code may expire quickly and may be usable only once, but it is still a value a victim can read and type into an attacker-controlled page. A reverse proxy phishing kit can relay that code to the legitimate Entra sign-in flow in real time. The code is valid long enough for one successful fraudulent session.
Passkeys use FIDO2 and WebAuthn cryptography instead. Entra stores a public key while the corresponding private key stays with the user’s authenticator or passkey provider. At sign-in, the authenticator signs a challenge after local approval by a biometric gesture or PIN. The credential is tied to the legitimate service’s web origin, so a lookalike Microsoft sign-in page cannot obtain a valid signature for the real Entra service.
AI does not somehow make SMS technically fail. It lowers the effort required to create plausible lures, localized text, fake sites, and targeted impersonation. Microsoft’s 2025 Digital Defense Report cited research in which AI-automated phishing messages achieved a 54 percent click-through rate, compared with 12 percent for standard messages. That figure should not be read as a prediction for every company’s workforce, but it illustrates why a defense that depends on users recognizing every fraudulent prompt is becoming less credible.
A passkey also does not eliminate compromise. Attackers can still target endpoint malware, session theft, account recovery, help-desk processes, or a user’s broader cloud-account security. What it removes is the reusable human action at the center of SMS phishing: receiving a code and entering it somewhere else.
The passkey choice needs an assurance policy
Microsoft Entra supports synced passkeys as well as device-bound passkeys in Microsoft Authenticator and FIDO2 security keys. The distinction matters more than a generic instruction to “enable passkeys.”
Synced passkeys can reduce enrollment friction for users moving among personal phones, tablets, and computers. Entra supports providers including Apple’s iCloud Keychain and Google Password Manager, subject to platform support and tenant policy. Microsoft’s documentation characterizes them as phishing-resistant, while noting that they carry the security posture of other unattested authenticators.
For privileged administrators, break-glass-adjacent workflows, and groups subject to strong assurance requirements, device-bound passkeys or hardware FIDO2 security keys deserve separate treatment. Microsoft’s passkey-profile documentation allows organizations to apply different settings for device-bound versus synced credentials, require attestation at registration, and restrict permitted authenticators by AAGUID. Those controls must be tested carefully: changing key restrictions can prevent previously enrolled users from signing in if their authenticator is later removed from the allowed list.
Windows administrators should also check device readiness rather than assume every endpoint is eligible. Microsoft says the best Entra-joined Windows experience requires Windows 10 version 1903 or later; hybrid-joined devices require Windows 10 version 2004 or later. The passkey registration flow also requires the user to have completed MFA within the prior five minutes. Those details can turn a clean policy rollout into a failed enrollment campaign if they are discovered only after users receive prompts.
Microsoft does not charge extra for passkey capability in Entra ID editions, including Entra ID Free. The exception path for retained SMS is where cost, carrier coverage, contractual terms, and support ownership enter the picture.
The migration should be measured in users, not policy switches
The first job is to identify every user within active SMS or voice policy scope and determine whether that user already has a viable phishing-resistant method. Microsoft provides a PowerShell-based analyzer for finding affected Authentication Methods Policy assignments, and says Global Readers, Authentication Policy Administrators, or Security Readers can use it.
The next job is segmentation. Privileged users, frontline workers without managed phones, shared-device populations, users in low-connectivity regions, B2B collaborators, and accounts subject to local telecom requirements should not receive the same enrollment plan. Microsoft expects passkey support for B2B users and internal guests by the end of calendar year 2026, but those users are included in the SMS and voice retirement scope. That leaves little room for a late guest-access design.
A sensible rollout should include a passkey pilot, tested recovery procedures, a verified fallback for lost or replaced devices, and targeted user communication before September 1. Tenants that genuinely require SMS must use the fall to evaluate providers, contract, configure delivery, and test regional routing well before the February cutoff.
On February 1, 2027, the policy change will be visible to end users as a blocked sign-in and a passkey-registration requirement. For organizations that inventory the affected population now, that date is an administrative switchover. For those that leave SMS as an unmeasured default, it becomes a preventable authentication incident.
