SMS retires in Microsoft Entra ID: organising the move to passkeys

Microsoft has set the timetable: Microsoft-provided SMS codes and voice calls for Entra ID multi-factor authentication disappear on 1 February 2027 for most accounts, and passkeys become the default. On paper, the change fits in one line. In an organisation, it affects hundreds of people, their devices, the service desk and a handful of special cases that are far better handled before the deadline than on the morning someone can no longer sign in.

What Microsoft has announced

• Since 1 September 2026, users enabled for SMS or voice have been automatically enabled for passkeys, and a Microsoft-managed registration campaign prompts them to create one when they authenticate. By default, they can snooze the prompt indefinitely.
• From 30 October 2026, organisations with a regulatory or operational need to keep SMS or voice can configure a telephony provider through Microsoft Security Store, under their own contract and at their own cost.
• On 1 February 2027, Microsoft-provided SMS and voice are retired for all accounts except Global Administrators and external users. Internal guest users follow this date.
• On 1 July 2027, the retirement extends to Global Administrators and external users.

The retirement applies across Entra ID, including self-service password reset. Azure AD B2C tenants are out of scope, and Microsoft has announced a separate timetable for Microsoft Entra External ID. The published dates apply to the public cloud.

What happens if nothing is done

Nobody is locked out overnight, but the experience changes abruptly. After the retirement date, a user whose only method is SMS or voice must register a passkey during sign-in and can no longer postpone it: the prompt is blocking. There is no opt-out from this requirement. A temporary setting only lets a tenant delay the automatic passkey enablement until 1 February 2027.

In practice, the question is not whether the move will happen, but whether it happens at a pace the organisation chooses, or on the first working day of February, in front of every employee’s screen, with a queue of calls to the service desk.

Treating the move as a process

A change of authentication method can be run like any other process: a scope, steps, owners and a measure of progress. This is the sequence we recommend.

1. Measure the scope

Microsoft publishes a PowerShell script that lists the users still enabled for SMS or voice. Its output shows the real size of the job and lets you build the security group that will be targeted by the campaign and the communications. Matched against the directory, it also tells you who is affected: department, site, device type, administrator or guest status.

2. Decide population by population

Not every group has the same answer. Staff with a recent Windows laptop and a company phone can usually move to passkeys without difficulty. Others need a decision: people working on shared devices, people without a company phone, administrative accounts, guests. For each population, choose the target method (synced passkey, device-bound passkey, FIDO2 security key, Windows Hello for Business) or, where there is a genuine need, a telephony provider, and document that need.

3. Prepare the service desk before you communicate

The service desk will receive the same questions again and again: registering a passkey on a given device, adding a second one, replacing a lost phone. These requests deserve a place in the service catalogue before the campaign starts, together with an identity-verification procedure for the most sensitive case: a person who no longer has any valid method.

4. Communicate in three stages

Microsoft recommends an announcement, a call to action with step-by-step guidance for each device type, then reminders targeted at those who have not yet registered a phishing-resistant method. Targeted, because the group from step 1 means you do not need to chase people who have already moved.

5. Turn on the campaign and track progress

The Entra ID registration campaign prompts users in the target group to create a passkey at their next authentication. The authentication methods activity report shows, week by week, how many accounts still depend on SMS, so that late movers can be followed up well before February.

6. Handle the exceptions, then remove SMS

The last accounts are almost always special cases: a shared account, someone on long-term leave, a contractor. Each one needs a written decision. Once the scope is empty, removing SMS and voice from the authentication methods policy stops accounts from drifting back to them.

What existing tools can contribute

The work is carried out in Entra ID, but it benefits from what is already in place. The directory and its groups define the populations. The device inventory tells you who has a compatible laptop or phone. The service management tool holds the standard requests, their approvals and their audit trail. Connecting these sources avoids running the migration from a spreadsheet nobody keeps up to date: this is the kind of link between directory, inventory and service management that ZAPP builds in its projects.

It is also a good moment to apply a simple rule from the Process Built method: describe the process before you automate it. Who decides the method for a population, who approves an exception, who verifies the identity of someone with no valid method? Once those answers are written down, automation becomes a consequence rather than a gamble.

Where to start this week

• Run Microsoft’s script and note the number of accounts in scope.
• List the populations that need a decision and name who takes it.
• Check that the service desk has a procedure for a user with no valid method.
• Set an internal completion date several weeks before 1 February 2027.

If you would like to plan this move, or connect it to your directory, your inventory and your service management tool, talk to our team.

Back to the blog