On February 1, 2027, Microsoft stops sending SMS and voice codes for most Entra ID sign-ins. Here is what changes, who it hits, and what to do with the 84 days left.

What Microsoft announced

Microsoft is making passkeys the default in Entra ID and retiring the SMS and voice codes it delivers itself. The change comes in three steps. On September 1, 2026, users enabled for SMS or voice were automatically enabled for passkeys and began seeing a registration nudge after MFA. On February 1, 2027, Microsoft-provided SMS and voice end for everyone except Global Administrators and external users. On July 1, 2027, they end for those two groups too.

What matters most is what happens to a user whose only MFA method is SMS or voice. After the cutoff, their next sign-in turns into a blocking prompt to register a passkey, and they cannot continue until they do. Microsoft is explicit: “There is no opt out for enforcement.” A temporary opt-out set through Microsoft Graph only delays the September nudges, and it stops applying on February 1.

Two details catch people out. Internal guest users stay on the February date. And according to Microsoft’s FAQ, a Global Administrator who is only eligible for the role through Privileged Identity Management, and hasn’t activated it, is treated as a regular user. The July date applies only while the role is active.

Microsoft’s timeline, with this post’s date marked: 84 days from November 9 to the February 1 cutoff.

Why Microsoft is doing it

The FAQ is blunt: SMS and voice are “among the most vulnerable authentication methods available today.” A code sent to a phone can be typed into a look-alike sign-in page as easily as a password, and the number it goes to can be moved to another SIM. NIST reached the same conclusion first. NIST SP 800-63B-4 names exactly one restricted authenticator, out-of-band authentication over the public telephone network, and tells verifiers to look for SIM changes and number porting before trusting it.

Microsoft’s authentication strengths put the same judgment into policy. The built-in Phishing-resistant MFA strength accepts Windows Hello for Business or a platform credential, a FIDO2 security key, or certificate-based authentication configured as multifactor. SMS sign-in on its own meets none of the built-in strengths.

Two paths, and a detour

The first path keeps SMS. Since October 30, organizations can bring their own telephony provider through Microsoft Security Store. Microsoft’s provider page lists Soprano, Telesign and Infobip. Entra still generates and checks the code, but the message goes out through an Azure Function in your subscription to a carrier you contract with. You pay the carrier and the Azure costs, and you own the fraud controls. Microsoft recommends it only for users with a “business, regulatory, or technical requirement” for telephony.

The second path moves people to a phishing-resistant method: a passkey, Windows Hello for Business, a FIDO2 key or a certificate. Microsoft notes that moving SMS and voice users to passkeys costs nothing extra.

The detour is authenticator-app codes. The FAQ confirms that these codes keep working after February 1, and users who have them won’t see the blocking prompt. It is a reasonable fallback, but it is still a code a person can type into the wrong page, and Microsoft says it doesn’t satisfy a Conditional Access policy that requires phishing-resistant authentication.

Only a passkey, or a certificate set up as multifactor, both survives February 1 and meets Entra’s phishing-resistant strength.

The hard cases

The users still on SMS are rarely the ones at a desk with a managed laptop. They are the edge cases, and each one needs a plan before February.

• Shared PCs. A nurses’ station, a front desk or a warehouse terminal belongs to no one, so a credential enrolled on the machine belongs to the machine. The credential needs to travel with the person.

• Frontline staff who sign in rarely. They will meet the blocking prompt mid-shift, at the moment they need to clock in or open a record. Get them registered before the date, not at it.

• People without a work phone. SMS was popular because it worked on any phone. Its replacement has to work on a personal phone without the company managing that phone, or come as a hardware key you hand out.

• Administrators. Global Administrators get until July 1, but theirs are the accounts attackers want most. Move them first.

Keep the phone, drop the number

Almost everyone on SMS already carries the thing SMS relied on. The weak part was never the phone. It was the phone number: a code that crosses a network the user doesn’t control and can be read off one screen and typed into another.

Allthenticate keeps the phone and drops the number. Its keys stay on the phone, so there is no code to read out, nothing to type into a fake page and no SIM to swap. The app acts as a passkey provider for websites. On Entra-joined Windows PCs it signs in with a certificate that your own certificate authority issues to the phone, carrying the user’s Entra UPN and revoked when they lose access. Entra checks it through certificate-based authentication, which counts toward the phishing-resistant strength when it is configured as multifactor. Walk away and the desktop locks.

That covers the hard cases. On a shared PC, the certificate travels on each person’s own phone instead of living on the machine. A personal phone works without a phone number on file. And the same phone that answers Entra also opens SSH sessions, SSO apps and doors, so the people you move off SMS get one authenticator instead of a new one for every system.

What to do this week

• Find who is still on SMS or voice. Microsoft publishes a PowerShell script for it, and any non-zero result means your tenant is in scope.

• Decide, group by group, whether there is a genuine regulatory need for SMS. If there is, start the Security Store setup now; Microsoft’s own steps include a pilot before broad rollout.

• Turn on a passkey registration campaign for everyone else, so people register on an ordinary day instead of at a blocking prompt.

• Move Global Administrators first, including those who are only eligible for the role through PIM.

• For shared PCs and frontline staff, choose a method that follows the person, and test it through one real shift.

February 1 isn’t really a deadline for SMS. It is a deadline for every user who still has nothing better, and the calm way to meet it is to give them something better now. If you want to see the phone you already carry replace those codes on Windows, the web and the door, download Allthenticate and try it.