Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys

Microsoft urged Entra ID administrators to migrate from SMS and voice authentication in Entra ID to passkeys before retirement begins on February 1, 2027, to reduce phishing risks and prevent sign-in disruptions.

The reminder, published on October 27 under Message Center notice MC1528000, follows July announcements. Retirement covers Worldwide and Government Community Cloud environments and should finish in early February 2027. Administrators should not wait until the change reaches their tenant before preparing affected users.

According to the Microsoft retirement notice, users with another registered sign-in method will use that method. They will not need to register a passkey to continue accessing their accounts. This makes checking existing authentication methods an important first step for administrators.

Users whose only registered method is SMS or voice face a different process. Microsoft says they can use their existing method one final time to verify their identity. They must then register a passkey to keep signing in, making preparation important for organizations with many phone-dependent accounts.

The announcement continues the shift covered in Cybersecuritynews.com’s report on Microsoft making passkeys the default in Entra ID. However, this retirement applies specifically to Microsoft-provided phone authentication, not a complete ban on SMS and voice across Entra ID.

Microsoft Urges Passkey Migration

SMS and voice authentication remain exposed to phishing and SIM-swap attacks. Criminals can trick users into sharing verification codes or take control of an authentication phone number. Moving away from these methods reduces reliance on phone networks and codes that attackers can capture.

As Microsoft’s passkey documentation explains, passkeys use public-key cryptography under FIDO standards. The user’s authenticator keeps the private key, while the service stores the public key. During sign-in, the authenticator signs a challenge after the user unlocks it with a PIN or biometric check.

The credential works only with the website or application it was created for, helping prevent fake login pages from stealing reusable sign-in secrets. Cybersecuritynews.com’s coverage of UNC3944’s SIM-swap attacks shows why reducing dependence on phone-based verification matters.

Administrators should identify users relying on SMS or voice, prioritize accounts without another registered method, and help users adopt passkeys or another supported option. Microsoft also asks organizations to notify employees and helpdesk teams about the deadline and the registration process.

Organizations that need to retain phone authentication can configure a customer-managed telecom provider through the Microsoft Security Store.

Microsoft’s provider guidance says configuration will be available starting October 30, 2026. Customers must review coverage, pricing, support, and contractual terms before deployment.

Existing customer-managed providers are unaffected. Organizations that do not use Microsoft-provided SMS or voice need no action for this retirement. At the same time, affected customers must migrate or configure their provider before February 1.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys appeared first on Cyber Security News.