Microsoft Entra is retiring its built-in SMS and voice sign-in codes and making passkeys the default

Microsoft has published a timeline for changes to how people sign in to work and school accounts that use Microsoft Entra ID (the sign-in service behind Microsoft 365). Microsoft says passkeys are becoming the default sign-in method, and that SMS and voice codes provided by Microsoft itself are being retired. Its page says SMS and voice are “no longer positioned as secure authentication methods”.

The timeline Microsoft gives

• 1 September 2026: passkeys became the default. Users enabled for SMS or voice are automatically enabled for passkeys and prompted to register one.
• 30 October 2026: organisations that still need SMS or voice can choose a third-party telephony provider through Microsoft Security Store.
• 1 February 2027: Microsoft-provided SMS and voice retire for all users except Global Administrators and external users.
• 1 July 2027: retirement extends to Global Administrators and external users.

After each date, users whose only sign-in method is SMS or voice will have to register a passkey to keep signing in. Microsoft says there is no opt-out from enforcement. People already using passkeys, Windows Hello for Business or another phishing-resistant method aren’t affected.

What Microsoft says administrators should do

Microsoft recommends identifying which users are enabled for SMS or voice, moving them to passkeys, running a registration campaign, and only using a telephony provider where there’s a documented regulatory or operational need. It also provides communication templates for staff.

Our guides to MFA methods compared and how passkeys work explain the difference between these sign-in methods.