Microsoft Is Retiring SMS Authentication — Is Your Business Ready?

If your organization still relies on SMS or voice calls to verify user identities, the clock is ticking. Microsoft has officially announced that Microsoft-provided SMS and voice authentication in Microsoft Entra ID will be fully retired on February 1, 2027. For business leaders who treat cybersecurity as a strategic priority, this is not a distant deadline. It is a call to act now. 

Why SMS and Voice Authentication Are No Longer Enough 

SMS and voice-based multi-factor authentication (MFA) were once considered solid security measures. They are not anymore. These methods are now among the most vulnerable authentication options available, leaving organizations exposed to a growing list of threats, including: 

• Phishing attacks, where users are tricked into surrendering their one-time codes 

• SIM-swap fraud, where attackers hijack a phone number to intercept verification messages 

• Replay attacks, where intercepted authentication tokens are reused to gain unauthorized access 

The reality is that cybercriminals have become highly sophisticated, and AI has only accelerated their capabilities. Relying on a six-digit text message to protect sensitive business systems is a risk that organizations, particularly those in insurance, finance, healthcare, and logistics, simply cannot afford to take. 

“The retirement of SMS and voice authentication is not just a Microsoft policy change. It is a reflection of how the threat landscape has fundamentally shifted,” says Bill Woody, President of Level 10 Solutions. “Businesses that delay this transition are leaving a door open that attackers are actively looking to walk through.” 

What Microsoft Has Announced and Dates you need to know: 

Microsoft has laid out a clear and structured timeline for this transition: 

• September 1, 2026: Users currently enabled for SMS or voice authentication will be automatically enabled for passkeys and prompted to register one. 

• February 1, 2027: Microsoft-provided SMS and voice authentication methods are fully retired in Microsoft Entra ID. 

• After February 1, 2027: Any user whose only registered MFA method is SMS or voice will encounter a blocking prompt, preventing access until they register a passkey. 

Microsoft’s move toward passkeys, its preferred phishing-resistant authentication method, represents a significant step forward in enterprise security. Unlike SMS codes, passkeys are designed to resist interception, sharing, and phishing because they use cryptographic authentication tied to a user’s device or account ecosystem. 

The Four Steps Every Business Should Take Now 

Microsoft has outlined a clear action plan for organizations navigating this change. Business leaders should prioritize the following: 

1. Identify affected users. Run a report in Microsoft Entra ID to determine which users are currently relying solely on SMS or voice as their MFA method. These are your highest-priority accounts. 

1. Migrate users to passkeys. Work with your IT team to enable and promote passkey registration across your organization. Microsoft provides built-in prompts starting September 2026, but getting ahead of that window reduces disruption. 

1. Communicate the change clearly. User adoption is only as strong as the communication behind it. Proactively inform employees about what is changing, why it matters, and how they can register a passkey before the deadline. 

1. Evaluate regulatory needs. If your organization operates in a regulated industry that requires SMS or voice-based verification for compliance reasons, assess whether a customer-managed telecom provider is necessary as an interim solution. 

“The businesses that will handle this transition smoothly are those that start the conversation now, not in late 2026,” says Bill Woody. “That means assessing your current authentication posture, identifying gaps, and building a migration plan that works for your users and your compliance requirements.” 

The Bigger Picture: Authentication in the AI Era 

This transition reflects a broader truth about cybersecurity in an AI-driven world. As artificial intelligence lowers the barrier to entry for sophisticated attacks, the authentication methods protecting your systems must evolve in kind. Phishing-resistant passkeys are not just a compliance requirement; they are a strategic investment in your organization’s long-term security posture. 

For C-level executives, the question is not whether to make this change. Microsoft has already answered that. The question is whether your organization will be proactive or reactive. 

Take the Next Step with Level 10 Solutions 

Navigating identity security transitions, compliance requirements, and enterprise IT strategy requires more than internal resources — it requires the right partner. Level 10 Solutions works with small to mid-enterprise organizations to design and implement secure, scalable IT strategies that keep pace with an evolving technology landscape. 

Whether your team needs support auditing your current authentication setup, planning your passkey migration, or building a broader cybersecurity framework, Level 10 Solutions is ready to help. 

Reach out today and ensure your organization is ahead of the February 2027 deadline, not scrambling to meet it.