Microsoft has announced the retirement of Microsoft-provided SMS and voice authentication in Entra ID.

Starting September 1, 2026, affected users will begin seeing passkey registration prompts. Microsoft-provided SMS and voice delivery will then retire on February 1, 2027.

This article focuses on tenant preparation: identifying affected users, checking which authentication methods they already have, and deciding whether your environment is ready for the rollout.

Who Is Affected?

Users enabled for SMS or voice in the Authentication Methods Policy or legacy MFA fall within the scope of this change.

Microsoft provides an SMS and voice usage analyzer that that identifies the affected users and reviews the current policy configuration, registration campaign settings, and included or excluded users and groups.

The tool outputs an impact summary, such as:

Registration campaign: Microsoft managed

SMS state: disabled
Voice state: enabled

  Voice scope:
    Include: ALL USERS
    Exclude group: Service Accounts

===== IMPACT SUMMARY =====
  Sep 1, 2026:  Users in SMS/Voice scope auto-enabled for passkeys. Reg campaign set to Microsoft Managed.
                To prevent: move users out of SMS/Voice AMP scope before Sep 1.

Review the included users and check their registered authentication methods.

The User registration details view in Entra ID provides this information together with MFA capability.

Expand

Remember to include Self-Service Password Reset, since SMS and voice retirement applies there as well.

Delaying the September Rollout

If you need more time to prepare, you can temporarily opt out of the automatic passkey migration.

The change requires the Microsoft Graph Policy.ReadWrite.AuthenticationMethod permission. Update the authentication methods policy and set passkeyDynamicMigration to true:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy 
Content-Type: application/json 

{
	"optOutSettings": { 
		"passkeyDynamicMigration": true 
	} 
}

This pauses the Microsoft-managed rollout during the transition period, but the February 1, 2027 retirement date still applies.

Replacement Methods

Microsoft recommends passkeys as the primary migration path for users moving away from SMS and voice.

Some users may already use Microsoft Authenticator for MFA. However, not every Authenticator method is considered phishing-resistant. A normal push notification can still satisfy MFA, while a passkey stored in Microsoft Authenticator meets the phishing-resistant requirement.

The right replacement depends on the sign-in scenarios you need to support. Windows Hello for Business may already cover managed Windows sign-ins, but the same users may still need passkeys or FIDO2 security keys for other devices or platforms.

Review accounts that do not follow the normal interactive user flow separately. Administrative or operational accounts and infrequently used identities may need a different approach, especially if they are unlikely to encounter the MFA flow that triggers the registration campaign.

Registration Campaign and Rollout

The Entra registration campaign prompts targeted users to register a passkey after they complete MFA during sign-in. It can be scoped to selected users or groups, and the prompt can be snoozed during the transition period.

Expand

There are no additional license requirements for the feature itself. Passkeys must already be enabled for the targeted users in the Authentication Methods Policy, and self-service passkey registration must be allowed.

I would start with a small pilot group and keep the snooze settings lenient. Send the user instructions before enabling the campaign, give the group time to register, and review any failed registrations or support requests before expanding the scope.

If you prefer not to use this approach, users can still register passkeys directly through their Security info page. In that case, adoption depends much more on user communication and follow-up, because Entra is no longer prompting them during sign-in.

Post-Rollout Review

Give users enough time to complete registration before reviewing the result. Re-run the same audit and confirm that users who previously depended on SMS or voice now have a usable replacement method registered.

Any accounts still relying on SMS or voice should be handled before expanding the campaign further.

If Phone-Based Authentication Is Still Required

Organizations with a specific regulatory or operational requirement can retain these methods through a customer-managed telecom provider available through the Microsoft Security Store.

Provider availability, configuration and pricing are still evolving, so check Microsoft’s current telephony provider FAQ before planning around it.