# Microsoft to Retire SMS and Voice Authentication in Entra ID Workforce Tenants (Feb 1, 2027); Admins Urged to Migrate to Passkeys

> Microsoft will retire Microsoft-provided SMS and voice authentication for Entra ID workforce tenants starting February 1, 2027, and is urging administrators to move users to phishing-resistant methods such as passkeys, QR code authentication and FIDO2 security keys. Microsoft states SMS and voice are vulnerable to phishing and SIM-swap attacks.

- **Published:** 2026-10-29T01:02:36Z
- **Last reviewed:** 2026-10-29T01:02:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4689
- **ID:** TL-2026-4689
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a defensive hardening advisory, not an active threat campaign. No CVE, exploitation, PoC, threat actor or malicious infrastructure is associated with it. BleepingComputer (2026-10-28) reports that Microsoft is reminding Microsoft Entra ID administrators to migrate users off SMS and voice authentication before the retirement of the Microsoft-provided telephony service begins on February 1, 2027. Microsoft's stated rationale is that SMS and voice are vulnerable to phishing and SIM-swap attacks.

Per Microsoft message center post MC1426371, passkeys became the default authentication method starting September 1, 2026: passkeys are automatically enabled for eligible users and the passkey Registration Campaign is set to the Microsoft Managed state. Users are prompted to register a passkey at sign-in but can skip the prompt. Review of telecom providers in the Microsoft Security Store was scheduled from September 18, 2026, and customers can select a telecom provider for continued SMS/voice use from October 30, 2026. Microsoft-provided SMS and voice retire for most users on February 1, 2027, after which only customer-configured telecom providers will deliver SMS/voice. Retirement for Global Administrators and external users follows on July 1, 2027. A temporary opt-out is available between September 1, 2026 and February 1, 2027. Per BleepingComputer, SMS first-factor sign-in was retired for Free tenants in August 2026.

Scope: the change applies to Microsoft Entra ID workforce tenants and excludes Azure AD B2C and Microsoft Entra External ID scenarios. Approved alternatives are passkeys (the default), QR code authentication, FIDO2 security keys, and customer-managed telecom providers selected via the Microsoft Security Store. Organizations that rely solely on Microsoft-provided telephony and take no action will see sign-in disruption after the retirement date.

Microsoft published the Entra SMS/Voice Policy Scanner, a PowerShell script (github.com/microsoft/entra-sms-voice-usage-analyzer) that uses Microsoft Graph modules (Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Groups) with Policy.Read.All and Group.Read.All scopes to report registration campaign state, SMS/Voice policy configuration and targets (exported to CSV), and an impact summary. Minimum roles are Authentication Policy Administrator, Global Reader or Security Reader. For defenders, the relevant risk is that SMS/voice MFA remains exposed to phishing and SIM-swap abuse until users are migrated; sources do not describe any specific attack or actor.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1111 Multi-Factor Authentication Interception
- T1451 SIM Card Swap
- T1621 Multi-Factor Authentication Request Generation

## Sources

- [Microsoft urges Entra ID admins to migrate users to passkeys (BleepingComputer)](https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/)
- [MC1426371 - Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication](https://mc.merill.net/message/MC1426371)
- [Microsoft Learn: SMS and voice authentication retirement](https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement)
- [Entra SMS/Voice Policy Scanner (microsoft/entra-sms-voice-usage-analyzer)](https://github.com/microsoft/entra-sms-voice-usage-analyzer)
- [Microsoft Learn: Plan prerequisites for phishing-resistant passwordless authentication](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)
- [Microsoft 365 admin center Message Center MC1528000](https://admin.microsoft.com/#/MessageCenter/:/messages/MC1528000)
- [Microsoft retiring Entra SMS authentication and Microsoft 365 companion apps (Redmondmag)](https://redmondmag.com/articles/2026/09/21/microsoft-retiring-entra-sms-authentication-and-microsoft-365-companion-apps.aspx)
- [Microsoft ditches SMS and voice authentication for Entra ID, passkeys rolling out as default (Cybernews)](https://cybernews.com/security/microsoft-entra-id-passkeys-transition-eliminates-sms-voice/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4689