Cybersecurity

Microsoft Pushes Entra ID Admins to Adopt Passkeys Ahead of SMS Authentication Retirement

Analyst 207||Source: BleepingComputer
Person working at desk with laptop and smartphone in modern office setting.

"Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.

What Microsoft is changing and why

Microsoft has again urged Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of a planned retirement of Microsoft-provided SMS and voice multifactor authentication. The company framed the move as a security-driven change: "SMS and voice are vulnerable to phishing and SIM-swap attacks," and Microsoft has recommended passkeys "for stronger, phishing-resistant protection." Administrators who do not complete migrations will find SMS and voice unusable to finish multifactor authentication and sign in after the retirement date.

Scope: which tenants and scenarios are affected

The retirement applies specifically to Microsoft Entra ID workforce tenant authentication scenarios. It does not apply to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Microsoft will retire its telecom delivery for SMS and voice on February 1, 2027, after which SMS and voice will no longer be offered as a native Microsoft Entra capability.

Available alternatives and the passkey rollout

Admins may migrate users to passkeys, QR code authentication, FIDO2 security keys, and other Entra ID–supported sign-in methods. In July Microsoft announced that passkeys would start rolling out as the default authentication experience for Entra ID beginning in September. "As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multifactor authentication, they'll be prompted to register a passkey," Microsoft said. Organizations that must continue using phone-based authentication can retain that capability by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store or by choosing another supported authentication method.

Administration: tools, roles, and practical steps

Microsoft reiterated operational guidance for administrators. Accounts with the Authentication Policy Administrator, Global Reader, or Security Reader roles can locate users still configured for SMS or voice authentication by running the Entra SMS/Voice Policy Scanner PowerShell script. Microsoft also points admins to a dedicated documentation page with detailed guidance on deploying and managing phishing-resistant, passwordless authentication in Entra ID.

How technologists, procurement teams, and end users will respond

  • Technologists and security teams: Expect to prioritize passkey and FIDO2 deployments and to run the Entra SMS/Voice Policy Scanner PowerShell script to identify remaining SMS/voice users. The stated security rationale—phishing and SIM-swap vulnerabilities—frames the urgency to move users away from telephony-based MFA.
  • Procurement and IT operations: Organizations that require phone-based delivery will need to evaluate third‑party telecom providers available through the Microsoft Security Store and plan for customer-managed telecom configurations if they wish to retain SMS/voice functionality after February 1, 2027.
  • End users: As passkeys become the default in enrolled organizations, users currently relying on SMS or voice should expect to be prompted to register a passkey the next time they complete multifactor authentication. After retirement, SMS and voice sent via Microsoft's service will no longer function for MFA in workforce tenants.

Microsoft has already moved in this direction before: it retired SMS first-factor sign-in for Microsoft Entra ID Free tenants in August, citing phishing, fraud, and account compromise risks, and stopped enabling that option for newly created tenants. The company also highlighted measurement findings from the Blue Report 2026, noting that "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." That observation underscores the emphasis on phishing-resistant methods.

For administrators, the deadline is concrete: migrate users or implement a customer‑managed telecom solution before February 1, 2027, to avoid interruptions. Microsoft’s Message Center update makes the timeline and the options clear; the practical work—running scanners, selecting passkeys or FIDO2 keys, or configuring third‑party telecom providers—falls to tenant administrators now.

Read the original Microsoft reminder on BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/

Emerging ThreatsMicrosoftMFAEntra IDPhishing-Resistant AuthenticationPasskey AuthenticationAuthentication MethodsSMS AuthenticationVoice Authentication
Related Intelligence

Continue Reading

Security analysts work at desks in a brightly-lit operations center surrounded by computer screens displaying data…

AI Augments SOC Workflows with Automated Threat Insights

Tired of drowning in a sea of security alerts? AI-powered automation can be a game-changer for Security Operations Centers (SOCs), helping to streamline workflows, reduce analyst fatigue, and uncover critical threats that might otherwise be missed.

Analyst 207
Server room with computer servers on racks, cables, and networking equipment.

UEFI Firmware Exposes Servers to Code Execution Before Secure Boot

A 16-year-old vulnerability in EDK II's UEFI firmware, known as CVE-2026-97631, leaves servers exposed to code execution before Secure Boot even kicks in, allowing attackers to interfere with or run code on machines during network boot. This flaw can be triggered by a simple 504-byte overflow in the PXE driver, enabling malicious code to overwrite nearby memory and wreak havoc.

Analyst 207
Hospital corridor with healthcare professionals, patient room, and medical equipment in bright natural daylight.

Healthcare Must Embed Cyber Resilience from the Outset

As healthcare becomes increasingly interconnected, sharing patient data across providers and cloud environments improves care efficiency, but also widens the vulnerability window, making cyber resilience a critical priority. Protecting sensitive information requires complete visibility into data movement, access, and processing - including third-party providers and AI-enabled workflows.

Analyst 207
Security camera mounted on a wall in a public area with a blurred screen.

Intelbras IP Cameras Exposed to Denial-of-Service Vulnerability

With over 4 million downloads of the Intelbras Mibo Smart app, a single security vulnerability in its IP cameras has become a major concern, leaving millions of users exposed to potential hacking threats. A recently discovered unauthenticated firmware endpoint has put these devices at risk of a Denial-of-Service attack.

Analyst 207