In brief: Microsoft enforces migration from SMS/voice MFA to Passkeys in Entra ID with hard block starting February 1, 2027, shifting costs to paid third-party providers for organizations with compliance requirements.
Microsoft is discontinuing native support for SMS and voice-based multi-factor authentication in Entra ID and making Passkeys the standard method. Organizations must transition their authentication infrastructure by February 2027.
Microsoft is introducing Passkeys as the default authentication method in Entra ID starting September 1, 2026. Users still using SMS or voice calls for multi-factor authentication will be prompted to register a Passkey at their next login. Starting February 1, 2027, native support for SMS and voice MFA will end completely. From that point forward, users cannot skip the registration prompt — they cannot log in without a registered Passkey.
Organizations that require SMS or telephone calls for regulatory or compliance reasons must switch to paid third-party providers. These can be configured via the Microsoft Security Portal starting October 30, 2026. Microsoft justifies this measure by citing growing threats from AI-driven phishing methods and SIM-swapping attacks. The company reports that AI-generated phishing campaigns achieve a 54 percent click-through rate, while traditional phishing emails achieve only 12 percent.
CISOs should launch registration campaigns promptly, as the enforced blocking starting February 2027 will cause access disruptions for unprepared users. Entra ID supports a range of Passkey variants: cloud-based synchronized Passkeys such as iCloud Keychain or Google Password Manager, device-bound solutions like Microsoft Authenticator and Windows-native options, and physical FIDO2 security keys. These steps are part of Microsoft’s broader authentication initiative — since May 2026, SMS codes for personal accounts in Xbox, OneDrive, Outlook, and Windows have been phased out.
Source: www.it-daily.net · Published July 14, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification via Lumi News Pipeline v1.7.3.