Threat reportThreat IntelligenceTL-2026-4689
Microsoft to Retire SMS and Voice Authentication in Entra ID Workforce Tenants (Feb 1, 2027); Admins Urged to Migrate to Passkeys
Microsoft to Retire SMS and Voice Authentication in Entra ID (TL-2026-4689), also tracked as Entra ID SMS and voice authentication retirement, is a low-severity tracked intrusion set, first published 2026-10-29. It has no confirmed attribution, affects Microsoft Microsoft Entra ID (workforce tenants), maps to 5 MITRE ATT&CK techniques (T1078, T1111, T1451), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4689
- Threat ID
- TL-2026-4689
- Also known as
- Entra ID SMS and voice authentication retirement, MC1426371
- Severity
- LOW
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Microsoft to Retire SMS and Voice Authentication in Entra ID
Malware and tooling: Entra SMS/Voice Policy Scanner
How Microsoft to Retire SMS and Voice Authentication in Entra ID works
Microsoft will retire Microsoft-provided SMS and voice authentication for Entra ID workforce tenants starting February 1, 2027, and is urging administrators to move users to phishing-resistant methods such as passkeys, QR code authentication and FIDO2 security keys. Microsoft states SMS and voice are vulnerable to phishing and SIM-swap attacks.
This is a defensive hardening advisory, not an active threat campaign. No CVE, exploitation, PoC, threat actor or malicious infrastructure is associated with it. BleepingComputer (2026-10-28) reports that Microsoft is reminding Microsoft Entra ID administrators to migrate users off SMS and voice authentication before the retirement of the Microsoft-provided telephony service begins on February 1, 2027. Microsoft's stated rationale is that SMS and voice are vulnerable to phishing and SIM-swap attacks.
Per Microsoft message center post MC1426371, passkeys became the default authentication method starting September 1, 2026: passkeys are automatically enabled for eligible users and the passkey Registration Campaign is set to the Microsoft Managed state. Users are prompted to register a passkey at sign-in but can skip the prompt. Review of telecom providers in the Microsoft Security Store was scheduled from September 18, 2026, and customers can select a telecom provider for continued SMS/voice use from October 30, 2026. Microsoft-provided SMS and voice retire for most users on February 1, 2027, after which only customer-configured telecom providers will deliver SMS/voice. Retirement for Global Administrators and external users follows on July 1, 2027. A temporary opt-out is available between September 1, 2026 and February 1, 2027. Per BleepingComputer, SMS first-factor sign-in was retired for Free tenants in August 2026.
Scope: the change applies to Microsoft Entra ID workforce tenants and excludes Azure AD B2C and Microsoft Entra External ID scenarios. Approved alternatives are passkeys (the default), QR code authentication, FIDO2 security keys, and customer-managed telecom providers selected via the Microsoft Security Store. Organizations that rely solely on Microsoft-provided telephony and take no action will see sign-in disruption after the retirement date.
Microsoft published the Entra SMS/Voice Policy Scanner, a PowerShell script (github.com/microsoft/entra-sms-voice-usage-analyzer) that uses Microsoft Graph modules (Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Groups) with Policy.Read.All and Group.Read.All scopes to report registration campaign state, SMS/Voice policy configuration and targets (exported to CSV), and an impact summary. Minimum roles are Authentication Policy Administrator, Global Reader or Security Reader. For defenders, the relevant risk is that SMS/voice MFA remains exposed to phishing and SIM-swap abuse until users are migrated; sources do not describe any specific attack or actor.
MITRE ATT&CK techniques used in TL-2026-4689
Defense Evasion
Credential Access
T1111 Multi-Factor Authentication Interception; T1621 Multi-Factor Authentication Request Generation
initial-access
Initial Access
Affected products and versions in Microsoft to Retire SMS and Voice Authentication in Entra ID
- Microsoft — Microsoft Entra ID (workforce tenants)
Vulnerable versions: Tenants using Microsoft-provided SMS or voice authentication
Fixed in: Tenants migrated to passkeys, QR code authentication, FIDO2 security keys, or a customer-managed telecom provider
Remediation for Microsoft to Retire SMS and Voice Authentication in Entra ID
Immediate actions
- Run the Entra SMS/Voice Policy Scanner (microsoft/entra-sms-voice-usage-analyzer) to identify users and groups still targeted by SMS/voice policies
- Determine whether SMS/voice remains a business requirement and, if so, configure a customer-managed telecom provider via the Microsoft Security Store (recommended at least 4 weeks before February 1, 2027)
Workarounds
- Use the temporary opt-out available between September 1, 2026 and February 1, 2027 while completing transition activities
- Use customer-managed telecom providers for continued SMS/voice if required
Longer-term hardening
- Migrate users to phishing-resistant methods: passkeys, QR code authentication or FIDO2 security keys
- Plan user communication and passkey registration campaigns before the retirement date
Timeline of Microsoft to Retire SMS and Voice Authentication in Entra ID
- SMS first-factor sign-in retired for Entra Free tenants (August 2026, per BleepingComputer)
- Passkeys become the default authentication method; passkeys auto-enabled for eligible users and the passkey Registration Campaign set to Microsoft Managed (MC1426371)
- Telecom providers available to review in Microsoft Security Store (MC1426371)
- BleepingComputer reports Microsoft reminding Entra ID admins to migrate users to passkeys before SMS/voice retirement
- Customers can select customer-managed telecom providers for continued SMS/voice use (MC1426371)
- Microsoft-provided SMS and voice authentication retire for most Entra ID workforce users; only customer-configured providers remain; temporary opt-out window ends
- Microsoft-provided SMS/voice retire for Global Administrators and external users (MC1426371)
Sources cited for Microsoft to Retire SMS and Voice Authentication in Entra ID
- Microsoft urges Entra ID admins to migrate users to passkeys (BleepingComputer)
- MC1426371 - Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
- Microsoft Learn: SMS and voice authentication retirement
- Entra SMS/Voice Policy Scanner (microsoft/entra-sms-voice-usage-analyzer)
- Microsoft Learn: Plan prerequisites for phishing-resistant passwordless authentication
- Microsoft 365 admin center Message Center MC1528000
- Microsoft retiring Entra SMS authentication and Microsoft 365 companion apps (Redmondmag)
- Microsoft ditches SMS and voice authentication for Entra ID, passkeys rolling out as default (Cybernews)
Detection coverage for TL-2026-4689
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4689 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.