Microsoft Entra: passkeys by default; Microsoft-provided SMS/voice MFA retires Feb/Jul 2027
Microsoft Learn (Passkeys by default and retirement of Microsoft-provided SMS and voice authentication) sets Entra ID workforce tenants on a phishing-resistant path: from 1 September 2026, users still enabled for SMS or voice in Authentication Methods Policy (or legacy MFA) are auto-enabled for passkeys and nudged via Registration Campaign; from 1 February 2027 Microsoft-provided telecom SMS/voice delivery is retired for all users except Global Administrators and external users (those two populations retire 1 July 2027; internal guest users stay on the February date). Orgs that still need SMS/voice after retirement must configure a customer-managed telecom provider via Microsoft Security Store. Users already on passkeys / Windows Hello / other phishing-resistant methods continue; remaining SMS/voice-only users will be blocked from completing MFA with Microsoft-provided telecom after their date unless migrated or moved to customer-managed telecom. Australia-relevant given SIM-swap and SMS-OTP abuse history. Distinct from desk card ms-passkey-phishing-20260909 (helpdesk AiTM lures). Wire amplify: Cyber Security News 21 September 2026 (framed partly as SMS first-factor — primary here is Microsoft’s SMS/voice MFA telecom retirement + passkeys-default programme). FAQ: concept-sms-voice-retirement-faq.
- Product
- Microsoft Entra ID (workforce) — Authentication Methods / MFA SMS & voice
- Versions
- Passkeys auto-enable from 2026-09-01 for SMS/voice-enabled users; Microsoft-provided SMS/voice retired 2027-02-01 (most users) / 2027-07-01 (Global Admins + external users)
- Exploited in Australia?
- unknown
- Patch to
- Inventory SMS/Voice-enabled users (Microsoft’s PowerShell finder); enable passkeys (FIDO2) / WHfB; run Registration Campaign; communicate before enforcement; for regulated SMS need, plan Security Store customer-managed telecom before Feb/Jul 2027; do not rely on Microsoft-provided SMS/voice past those dates.
Primary: Microsoft Learn — Passkeys by default; SMS/voice retirement (Entra ID) · Vendor: Microsoft Entra ID primary guidance · Microsoft Learn — SMS and voice retirement FAQ