Microsoft Entra ID:
SMS and Voice MFA Ending in 2027

What is changing?

From 1 February 2027, SMS and voice will no longer be available as Microsoft-provided authentication methods in Microsoft Entra ID.

Users who rely solely on these methods will need to register an alternative authentication method, such as a passkey, to continue signing in.

Organisations should therefore review their current MFA configuration now, identify users who may be affected and decide which alternative authentication methods are most appropriate.

This change is part of Microsoft’s wider move towards stronger, phishing-resistant authentication, so it is also a good opportunity to review your wider identity security approach.

Who needs to take action?

IT teams should review their Microsoft Entra ID configuration if users currently have:

• SMS enabled as an MFA method
• Voice calls enabled as an MFA method
• Legacy MFA configurations that allow SMS or voice authentication
• Users who have not yet registered an alternative authentication method

Organisations that have already adopted stronger authentication methods, such as passkeys, Windows Hello for Business or FIDO2 security keys, are less likely to be affected.

However, it is still worth reviewing your policies and authentication methods to make sure they are being applied consistently across your organisation.

Why is Microsoft making this change?

SMS and voice authentication are more vulnerable to certain types of attack than modern authentication methods.

For example, attackers can use phishing and social engineering to persuade users to reveal verification codes. Phone numbers can also be targeted through techniques such as SIM swapping.

Moving away from SMS and voice authentication is therefore part of Microsoft’s wider push towards phishing-resistant authentication.

Passkeys provide a stronger alternative. Rather than relying on a code sent by text message or read over the phone, passkeys use cryptographic credentials to authenticate the user, making them significantly harder for attackers to intercept or steal.

Other options, including Windows Hello for Business and FIDO2 security keys, can also provide stronger protection depending on your users, devices and security requirements.

What should IT teams do now?

The 1 February 2027 deadline gives organisations time to prepare, but identifying affected users and moving them to alternative authentication methods can take time.

1. Identify affected users

Start by reviewing your Microsoft Entra ID authentication methods and policies.

Establish which users currently have SMS or voice enabled and, more importantly, whether any users rely solely on these methods to complete MFA.

This gives you a clearer picture of the potential impact and helps prioritise your migration.

2. Review your authentication policies

Consider whether your existing MFA and Conditional Access policies are still appropriate.

The removal of SMS and voice authentication is an opportunity to look beyond the immediate change and consider whether you can strengthen authentication more broadly.

For example, you may want to review where stronger authentication requirements could be introduced for administrators, privileged accounts, remote access or applications containing sensitive information.

3. Choose the right authentication methods

There is no single approach that will necessarily suit every user.

Consider the devices your employees use, their working environments and your security requirements when deciding which methods to adopt.

Microsoft is encouraging organisations to move towards phishing-resistant authentication methods, including passkeys, Windows Hello for Business and FIDO2 security keys.

4. Prepare your users

Users should not encounter a completely unexpected change when they are asked to register a new authentication method.

Give employees advance notice, provide clear guidance and allow time for registration and support.

This is particularly important for users who have relied on SMS or voice authentication for a long time or who may have limited access to IT support.

5. Review your wider identity security

The removal of SMS and voice authentication is also a useful opportunity to review your wider identity security strategy.

Consider whether your organisation is making full use of the capabilities already available within Microsoft Entra ID, including MFA, Conditional Access, identity protection and risk-based access controls.

You may also find that different users have different security requirements, creating opportunities to review whether your Microsoft licensing and identity configuration are properly aligned.

Is your Microsoft Entra environment ready?

The 1 February 2027 deadline may still seem some way off, but the earlier you identify affected users, the more time you have to plan and implement the change properly.

For larger organisations in particular, moving users away from SMS and voice authentication can involve more than simply changing a setting. Authentication policies, user devices, applications, security requirements and licensing all need to be considered.

It is therefore worth treating the change as part of a wider review of your identity and access environment, rather than simply a deadline to meet.

How Xeretec can help

At Xeretec, we take an assessment-led approach to Microsoft environments.

We can help you establish a clear picture of your current Entra ID configuration, understand how authentication is being managed today and identify where changes may be needed before Microsoft’s February 2027 deadline.

We can help you assess:

• Which users currently rely on SMS or voice authentication
• Your existing MFA and Conditional Access policies
• The authentication methods available to different users
• Where stronger, phishing-resistant authentication could be introduced
• Whether your current Entra ID capabilities are being fully utilised
• How your identity and access controls align with your wider security requirements
• Whether your Microsoft licensing is appropriately aligned with your requirements

This can also provide an opportunity to right-size your wider Microsoft ecosystem.

Rather than treating Entra ID, Microsoft 365 licensing and security as separate considerations, we can help you understand how they fit together, where capabilities overlap and whether your current setup is delivering the right level of functionality and protection for your organisation.

The aim is to use the change as an opportunity to improve your identity security, simplify your environment and make sure your Microsoft investment is aligned with how your organisation operates today.

Don’t wait until February 2027

The retirement of SMS and voice authentication is part of a broader shift towards stronger, phishing-resistant identity security.

If you are unsure whether your organisation is affected, or want to understand how ready your Microsoft Entra environment is, Xeretec can help you assess your current position and plan the transition.

Speak to Xeretec to review your Microsoft Entra ID environment, identify areas for improvement and build a more secure, right-sized Microsoft ecosystem.