Is Microsoft retiring SMS and voice MFA, and what are the deadlines?

Yes. Microsoft-provided SMS and voice authentication in Entra ID retires on 1 February 2027. The first stage has already happened: passkeys became the default authentication experience on 1 September 2026, and tenants with users enabled for SMS or voice are being auto-enabled for passkeys and nudged to register. SMS and voice survive after 1 February 2027 only if a business pays a third-party telecom provider through the Microsoft Security Store. Microsoft announced the change on 14 July 2026 in message centre notice MC1426371.

The precision matters: SMS and voice are not being abolished as MFA methods. Microsoft is withdrawing its own telecom delivery of them. For almost every business the sensible response is a planned migration to passkeys, which costs nothing in licensing, rather than paying to keep the weakest method alive. New to the term? See what a passkey actually is first.

What has already happened

1 September 2026: passkeys became the default authentication experience. Microsoft began rolling this out per tenant, so not every tenant saw it on day one, but the mechanism is the same everywhere. Users enabled for SMS or voice in the authentication methods policy, or in legacy per-user MFA settings, are auto-enabled for passkeys and placed in a passkey profile that permits all passkey types. The registration campaign is switched to Microsoft-managed state targeting passkeys, so those users get a prompt to register a passkey when they next complete MFA. The prompt can be snoozed without limit until February.

What is still ahead

18 September 2026: Microsoft publishes telecom provider options, pricing and commercial terms in the Microsoft Security Store. 30 October 2026: admins can select and configure a customer-managed telecom provider. 1 February 2027: Microsoft-provided SMS and voice delivery is retired. From that date, users whose only available MFA method is SMS or voice get a blocking registration prompt and cannot sign in until they register a passkey. Microsoft's wording on this is unusually direct: "There is no opt out from this February 1 behavior. It will be enforced for all tenants." These dates apply to the Entra ID public cloud; other cloud environments follow a separate timeline, and Azure AD B2C is out of scope entirely. The authoritative detail is Microsoft's retirement article and its retirement FAQ on Microsoft Learn.

Who is actually in scope

The September auto-enablement covers users enabled for SMS or voice in the tenant's authentication methods policy or in legacy per-user MFA settings, not users whose day-to-day method is Authenticator push. The trap is that scope is what the policy permits, not what users actually tap: SMS and voice are very commonly left enabled as a fallback even when nobody uses them, and enabled-but-unused is exactly what gets caught. Separately, the registration campaign change applies to all users in eligible tenants, so even push-only users start seeing passkey prompts. Users already on passkeys, Windows Hello for Business, FIDO2 security keys or smart cards carry on unaffected, and external MFA methods are out of scope unless those users are also enabled for SMS or voice.

Guest and contractor accounts are the scope question most businesses miss. B2B and internal guest users are inside the retirement, but Microsoft has said passkey support for them is only planned to arrive by the end of calendar year 2026. If external collaborators sign in to your tenant on SMS today, the replacement method may not be available until close to the deadline, so plan those accounts separately rather than assuming they follow the staff rollout.

What to do now, before 1 February 2027

Start by measuring exposure. Run Microsoft's own SMS/Voice Usage Analyzer script against every tenant, which needs only a Global Reader, Authentication Policy Administrator or Security Reader role. Any non-zero result means the tenant is in scope.

The pre-September lever has closed. Until 1 September the simplest fix was removing SMS and voice from the authentication methods policy before auto-enablement ran. What remains is the temporary opt-out, which covers the 1 September 2026 to 1 February 2027 window. It is a single Microsoft Graph call against the authentication methods policy, setting optOutSettings.passkeyDynamicMigration to true, and it requires the Policy.ReadWrite.AuthenticationMethod permission. Reserve it for tenants genuinely mid-transition to a telecom provider or another method. It delays passkey auto-enablement and the registration campaign, it does not exempt anyone from the February enforcement.

Check self-service password reset at the same time. Microsoft has confirmed the retirement applies across Entra, including SSPR, so a tenant relying on SMS or voice to reset forgotten passwords loses that path too on 1 February 2027. Microsoft has said it plans to add password-change support for users who sign in passwordless, but has not committed to a date, so treat SSPR as a problem to solve rather than one that will solve itself.

Then tell staff what the prompt is. It is already appearing in tenants that have been switched, it can be snoozed without limit until February, and a workforce that has not been told what it is generates avoidable helpdesk calls.

Should you pay to keep SMS?

Our answer is no. Blue Arc IT Solutions does not recommend the telecom provider path and will not propose it as a default. It is a recurring per-message cost to preserve the weakest authentication method available, and it leaves in place exactly the exposure the retirement exists to close. An attacker who relays a staff member through a proxy login still captures the code, and a SIM swap still works, whoever delivers the message. Paying a carrier changes who sends the code, not whether it can be stolen.

The bar for even considering it should be a specific regulation or contract clause that names SMS or voice, not a general preference for the familiar. Where that bar is genuinely met, it should cover only the users that clause applies to, with everyone else moved to passkeys, and with a plan to retire the exception rather than renew it indefinitely. For almost every Australian business the honest recommendation is to treat 1 February 2027 as a passkey deadline, not a procurement decision.

How Blue Arc IT Solutions helps

We run the SMS and voice exposure audit across client tenants, report per business exactly which users September caught and what February will block, and manage the passkey migration end to end: policy, pilot, enrolment, enforcement and user comms. We have supported Australian businesses since 2004 and deliver nationally from Canberra. Start at our passkeys for Microsoft 365 businesses hub, check the compliance angle in do passkeys meet Essential Eight ML2, or get in touch.

Last reviewed: 11 September 2026, against Microsoft's Learn retirement article (updated 10 August 2026) and its retirement FAQ (updated 4 September 2026). The 1 September 2026 passkeys-by-default milestone has passed and the page reflects that. Remaining milestones: telecom provider options and pricing 18 September 2026, provider configuration 30 October 2026, retirement 1 February 2027. Check the Microsoft Learn links above for the latest.

Frequently asked questions

Is Microsoft Authenticator push MFA being retired as well?

No. Push notifications in Microsoft Authenticator remain available after February 2027. However, users on push are not out of scope for the change: the passkey registration campaign has applied to all users in eligible tenants since September 2026, and any user still enabled for SMS or voice in the tenant policy was auto-enabled for passkeys even if they never use SMS day to day.

Can we keep SMS MFA after 1 February 2027?

Technically yes, by contracting a third-party telecom provider through the Microsoft Security Store, with options published from 18 September 2026 and configuration available from 30 October 2026. Costs are per message, vary by provider and region, and are billed to your business. Blue Arc IT Solutions does not recommend it. It is a recurring cost to preserve the weakest authentication method available, and it leaves the phishing and SIM-swap exposure the retirement exists to close. We treat it as a last resort for a specific, named regulatory obligation, not as a way to defer a passkey rollout.

What happens to users who only have SMS or voice registered?

Since 1 September 2026 they have been prompted to register a passkey at sign-in, and can snooze that prompt without limit. From 1 February 2027 the prompt becomes blocking: they cannot complete sign-in until they register a passkey, unless the tenant has a paid telecom provider in place. Microsoft has stated there is no opt out from the February behaviour and that it will be enforced for all tenants.

Does the retirement affect password reset as well as sign-in MFA?

Yes. Microsoft has confirmed the retirement applies across Entra, including self-service password reset, not only MFA at sign-in. A tenant that relies on SMS or voice for SSPR needs an alternative reset method in place before 1 February 2027.

Are guest and contractor accounts affected?

Yes. B2B and internal guest users are in scope for the retirement, but Microsoft has said passkey support for those users is only planned to be available by the end of calendar year 2026. That lands close to the February deadline, so plan guest and contractor accounts separately rather than assuming they follow the staff rollout. Azure AD B2C is out of scope, and Microsoft Entra External ID follows under a separate announcement.