Runbook Lab · Security · Updated 27 October 2026 · dates checked against MC1519855 and Microsoft Learn
Microsoft retires its own SMS and voice MFA for all users except Global Administrators and external users on 1 February 2027, and for those two groups on 1 July 2027. Users whose only method is SMS or voice then get a blocking passkey prompt at sign-in, with no opt-out for enforcement. Six steps to get the number of affected users to zero first.
Get the free Top 5 kitMicrosoft 365 hardening checklist| Date | What happens |
|---|---|
| 30 Oct 2026 | Organisations with a documented need can set up a telephony provider from Microsoft Security Store. |
| 1 Feb 2027 | Microsoft-provided SMS and voice retire for all users except Global Administrators and external users. Internal guests are included. |
| 1 Jul 2027 | Retirement for Global Administrators and external users. |
Source: Microsoft 365 message MC1519855 (21 Oct 2026) and Microsoft Learn, "Passkeys by default and retirement of Microsoft-provided SMS and voice authentication". Public cloud only. Dates can change: re-check the message before you plan around them.
Read-only. Needs Entra ID P1/P2, AuditLog.Read.All and a reader role. Put the result in a group such as SMS-Voice-Exit.
$r = @(Get-MgReportAuthenticationMethodUserRegistrationDetail -All)
$ph = @('mobilePhone','alternateMobilePhone','officePhone')
$weak = $ph + @('email','securityQuestion')
$only = $r | Where-Object {
$m = @($_.MethodsRegistered)
($m | Where-Object { $ph -contains $_ }) -and
-not ($m | Where-Object { $weak -notcontains $_ }) }
"Phone-only users: $(@($only).Count)"
$only | Select-Object UserPrincipalName, UserType, IsAdmin |
Export-Csv -NoTypeInformation .\phone-only-users.csvIn the Entra admin center: Entra ID > Authentication methods > Policies > SMS and Voice call. Microsoft's own scanner, microsoft/entra-sms-voice-usage-analyzer on GitHub, reports the policy scope (not users).
Authentication methods > Policies > Passkey (FIDO2). Users can use a passkey in Microsoft Authenticator, a synced passkey or a FIDO2 security key. Pilot with IT first.
Authentication methods > Registration campaign, target the group and passkeys. Snoozes are unlimited by default, so set the date when you stop allowing them.
Awareness now, action with per-device steps, then reminders to whoever is still on the list. Microsoft publishes templates at aka.ms/mfatemplates.
The only number that matters is how many users would be blocked on the date. Escalate the remaining names two weeks before 1 February 2027.
Global Admins have until 1 July 2027, but move them first. Break-glass accounts should use FIDO2 keys, never SMS.
The retirement applies to SSPR too. Phone-only users need another reset method.
Use a short-lived, one-time Temporary Access Pass after identity verification, not a password or SMS.
Steps 1–5 as a guide, a Jira import, a tracker CSV and read-only PowerShell checks that export phone-only-users.csv.
Download freeAdds admins and break-glass, internal guests, SSPR, the telephony-provider decision, the opt-out check, helpdesk onboarding with Temporary Access Pass and weekly tracking. 7 read-only checks.
€29
Get the Complete kitMicrosoft-provided SMS and voice authentication retires on 1 February 2027 for all users except Global Administrators and external users (internal guests are included), and on 1 July 2027 for Global Administrators and external users. The timeline applies to public cloud tenants (Microsoft 365 message MC1519855 and Microsoft Learn).
After the retirement date they get a blocking prompt to register a passkey during sign-in and can't skip it. Microsoft says there is no opt-out for enforcement. Users moved to a telephony provider from Microsoft Security Store before their date don't get the prompt.
Use the user registration details report (Entra ID > Authentication methods > Activity, or Microsoft Graph reports/authenticationMethods/userRegistrationDetails, cmdlet Get-MgReportAuthenticationMethodUserRegistrationDetail) and keep users whose registered methods are only phone methods, plus email or security questions. The report needs Entra ID P1 or P2 and a role such as Reports Reader.
Yes. Microsoft says the retirement applies across Microsoft Entra, including SSPR, so users who reset passwords only by SMS or call need another method.
Only if you have a documented regulated or operational need for SMS or voice. Microsoft recommends passkeys for everyone else, and moving SMS and voice users to passkeys has no additional cost. Provider pricing varies by provider and region.