Microsoft has officially signalled the phased retirement of legacy telephony-based authentication methods. Starting 1 February 2027, Microsoft-provided SMS and automated voice authentication will be formally discontinued across Microsoft Entra ID.
To facilitate this migration, Microsoft is rolling out passkeys as the default sign-in experience. Since 1 September 2026, users who rely on text messages or automated voice calls to verify their identity have begun encountering in-line registration prompts during routine multifactor authentication (MFA) challenges, steering them towards modern, phishing-resistant credentials. For IT directors, chief information security officers (CISOs), and compliance leads, this update represents far more than a minor administrative adjustment, it marks a fundamental transition towards resilient, modern identity architecture.
The Vulnerabilities of Legacy MFA
When multifactor authentication was first deployed at enterprise scale, one-time SMS passcodes and automated phone calls delivered an essential layer of defence beyond simple static passwords. Now, however, industry authorities have to be listened to when they highlight the critical vulnerabilities inherent in telephony-based verification, prompting unified advice to move toward cryptographic solutions. 🔗 Read the Cybersecurity and Infrastructure Security Agency’s (CISA) guidance on implementing phishing-resistant MFA.
The primary attack vectors exploiting legacy MFA include:
| Adversary-in-the-Middle (AiTM) Phishing Modern reverse-proxy toolkits seamlessly duplicate legitimate corporate login portals, capturing session tokens, passwords, and transmitted SMS codes simultaneously in real time. |
| SIM Swapping and Telecoms Exploitation Threat actors routinely leverage social engineering, compromised carrier portals, or protocol weaknesses (such as SS7) to intercept cellular codes before they ever reach the user’s handset. |
| Voice and Helpdesk Impersonation Sophisticated voice-phishing (vishing) and SMS relay techniques routinely deceive end-users into verbally reading out or entering verification codes into fraudulent portals. |
In contrast, passkeys are built directly upon the FIDO2 / WebAuthn open cryptographic standards. Because passkey authentication relies on asymmetric public-key cryptography bound inextricably to the authentic website origin, credentials cannot be harvested, spoofed, or intercepted by an intermediate proxy. 🔗Review the FIDO Alliance’s enterprise deployment guidelines for a deeper technical breakdown of device-bound security.
Authentication Methods Compared
| Authentication Method | Phishing Resistance | Reliance on Telecoms | Entra ID Status |
| SMS / Voice Calls | None (Vulnerable to AiTM & SIM Swaps) | High (Carrier dependent) | Retiring 1 Feb 2027 |
| Push Notifications (Authenticator) | Moderate (Requires Number Matching) | None (Data/IP based) | Supported / Interim option |
| FIDO2 Passkeys / Windows Hello | High (Mathematically Phishing-Resistant) | None | Default Target Architecture |
Key Timelines for IT Administrators
Failing to plan for this shift risks widespread account lockouts, user frustration, and an avoidable surge in service-desk tickets.
Current In-Flight Phasing |
As of September 2026, Microsoft is actively nudging accounts enabled for SMS and voice authentication to register passkeys (via Windows Hello, device-bound platform authenticators, or hardware security keys) during routine sign-in workflows. |
1 February 2027 (Deprecation Cut-Off) |
The built-in Microsoft delivery engine for SMS and voice MFA prompts will be permanently decommissioned for standard users. Those lacking an alternative registered method will encounter enforced enrollment barriers before gaining access to corporate resources. |
1 July 2027 |
Microsoft SMS/Voice delivery will be entirely switched off for Global Administrators and external B2B guests. |
Securing the Transition
Transitioning an entire enterprise estate away from the familiarity of SMS verification requires an equal balance of technical hygiene and user change management:
- Run Entra ID sign-in activity and registration coverage reports to establish precisely which user cohorts, frontline staff, and external identities remain dependent on SMS or voice telephony. Note that even users who primarily use an Authenticator app but have SMS registered as a backup method fall within the scope of this migration.
Action: Audit Active Authentication Methods - Migrate legacy, per-user multifactor settings into the modern Authentication Methods Policy within the Microsoft Entra admin centre. Define FIDO2 key restrictions, Attestation requirements, and Authenticator App Guidance Identifiers (AAGUIDs) to control approved hardware key types.
Action: Consolidate Authentication Methods Policies - Identify edge cases early. For shared terminals, air-gapped zones, or shop-floor environments where mobile phones are restricted, provision hardware security keys (such as FIDO2 tokens or smart-card alternatives).
Action: Address Non-Standard and Frontline Personas - End-users frequently mistake biometric prompts for an invasion of privacy. Clear internal communications must clarify that biometric data (such as fingerprint scans or facial recognition) remains strictly local to the device and is never transmitted to Microsoft or external servers.
Action: Deploy Clear, Empathetic User Training
Identity security is evolving rapidly, and staying ahead of platform deprecations requires strategic foresight rather than reactive panic. If your organisation is struggling to map out the technical and cultural requirements of this migration, the specialists at Mondas can provide the architectural guidance needed to ensure a frictionless transition. Contact us today to evaluate your Entra ID tenant and modernise your access management programme.
Article brought to you by Lance Nevill – Cyber Security Director, Mondas 🔗Connect with Lance on LinkedIn
Article First Published 29 October 2026
