Entra ID SMS MFA Retirement Passkeys: The Migration Timeline

Entra ID SMS MFA Retirement Passkeys: What's Changing

Microsoft's Entra ID SMS MFA retirement passkeys migration replaces its own SMS and voice call delivery for multi-factor authentication (MFA) with passkeys as the default authentication experience. This is not a catalogue-only inference — it is a dated, published product-policy change documented directly by Microsoft (Passkeys by default and retirement of Microsoft-provided SMS and voice authentication, Microsoft Learn).

This is a different, narrower story than the general case we made in Azure Identity Security: Why MFA Alone Is Not Enough — that piece argues MFA presence isn't sufficient on its own; this one is about a specific, phishable delivery channel (Microsoft-provided SMS/voice) being switched off on a fixed date, alongside other weak legacy patterns like MFA fatigue / push bombing that phishing-resistant methods like passkeys are meant to close off.

The driver is explicit in Microsoft's own FAQ: SMS and voice codes are phishable and vulnerable to SIM-swapping, and no longer meet the bar Microsoft wants as a default for Entra ID authentication (FAQ for Microsoft-provided SMS and voice retirement, Microsoft Learn).

The retirement timeline

The retirement applies to public cloud tenants only (other cloud environments follow on a later, separately announced schedule), covers SSPR as well as sign-in MFA, and does not affect Azure AD B2C. Microsoft Entra External ID is affected on a separate, later timeline with its own announcement still to come.

A temporary opt-out exists for the auto-enrollment window (September 1, 2026 → February 1, 2027) — not for the February 1 enforcement itself — via the passkeyDynamicMigration property on the tenant's authentication methods policy:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
{
   "optOutSettings": {
     "passkeyDynamicMigration": true
   }
}

Detection: Who in Your Tenant Is Still Exposed

Before this rolls out on your tenant automatically, find out how many users are actually still relying on Microsoft-provided SMS or voice — and whether your existing Conditional Access and registration-campaign settings will interact cleanly with Microsoft's own Sept 1 changes. If you haven't reviewed your Conditional Access baseline recently, see Entra ID Conditional Access Gaps first.

Remediation

1. Inventory exposed users first. Use the official PowerShell script to list every account still enabled for or using SMS/voice. Any non-zero result means the tenant is in scope.
2. Move users to passkeys proactively, on your own timeline. Enable Passkey (FIDO2) as an authentication method, put your SMS/voice population into a passkey-enabled Authentication Methods Policy group, and turn on a Registration Campaign yourself (Entra admin center → Authentication methods → Registration campaign → State: Microsoft Managed, scoped to your SMS/voice security group) — this is the same mechanism Microsoft will apply automatically on September 1, 2026, but you control the messaging and timing.
3. If a segment has a genuine compliance or operational need for SMS/voice, document the specific regulation or scenario now, then evaluate a customer-managed telecom provider through the Microsoft Security Store from September 18, 2026, and configure it from October 30, 2026 — before the February 1, 2027 cutover.
4. Use the passkeyDynamicMigration opt-out only as a bridge, not a long-term plan. It delays the auto-enrollment and Registration Campaign push while you complete migration work; it does not delay or exempt the February 1, 2027 enforcement.
5. Communicate early. Microsoft recommends a phased awareness → action → reminder communication plan and publishes end-user templates for the passkey switch — scope messaging to the security group you built in step 1 so the right users hear about it before the nudge starts.
6. Re-check Conditional Access. A tenant that already blocks legacy authentication and enforces MFA broadly for all users, not just admins, absorbs this change with far less disruption than one relying on SMS/voice as a silent fallback. For a full walkthrough, see How to Audit Microsoft Entra ID Security.

How EtcSec Detects This

EtcSec's Azure/Entra audit flags tenants that are still exposed to this retirement before it becomes an involuntary migration. AUTH_METHODS_SMS_ENABLED reports when SMS is enabled as an authentication method at all; MFA_PHONE_ONLY flags accounts where phone-based methods (SMS, voice) are the only MFA option enrolled — exactly the population that will hit the blocking passkey prompt on February 1, 2027. MFA_NO_PASSWORDLESS and MFA_NO_FIDO2 flag tenants that haven't enabled passwordless or FIDO2/passkey methods at all, which is the prerequisite gap you need to close before any proactive migration can start.