Microsoft 365 SMS and Voice MFA Is Ending: What to Do Now

To prepare, move staff to a passkey or Microsoft Authenticator approval prompts. If you need to keep texts and calls, arrange a separate telephony provider. The dates and exceptions are below.

We checked every date below against Microsoft's documentation on 22 October 2026.

What changes and when

Microsoft's FAQ on the retirement sets out the timeline:

• 1 September 2026: Passkeys start to become the default sign-in experience. Users enabled for SMS or voice are switched on for passkeys automatically. Microsoft's Message Center notice (MC1426371) says the rollout is gradual, so your tenant may not have changed yet.
• 30 October 2026: Setting up a telephony provider becomes possible.
• 1 February 2027: Microsoft-provided SMS and voice retire for everyone except Global Administrators and external users. Internal guest users stay on this date.
• 1 July 2027: The same retirement applies to Global Administrators and external users.

Sign-in can be disrupted if staff are not ready. Affected users who still rely only on Microsoft-provided text or voice must register a passkey before they can continue. Test registration on their devices before the deadline. Someone who cannot register one, such as a person with an older phone, is stuck at sign-in, so test those users first.

Until then, Microsoft nudges these users to register a passkey after they sign in with MFA. By default, they can snooze it without limit. The change also covers self-service password reset (SSPR). Microsoft is changing which methods SSPR accepts too.

Microsoft also documents a temporary opt-out for the 1 September to 1 February changes. An admin sets passkeyDynamicMigration to true in Microsoft Graph. It delays the passkey switch-on and registration prompts, but not the 1 February 2027 date.

Find who still relies on text or voice codes

1. Sign in to the Microsoft Entra admin center as an administrator.
2. Go to Entra ID > Authentication methods > Activity.
3. Open the Registration tab. Under Users registered by authentication method, select each phone method. Microsoft lists Mobile phone, Alternate Mobile Phone and Office phone.
4. In the user list, use the controls at the top to filter the Methods registered column. Note anyone whose only methods are phones.
5. Open the Usage tab. Sign-ins by authentication method shows whether people still use text or voice day to day.

Three limits apply. Microsoft says these reports need a Microsoft Entra ID P1 or P2 licence. The data can lag by up to 36 hours. And a registered phone shows someone could use it, not that they do.

Without that licence, open each person in the Microsoft Entra admin center (Entra ID > Users) and select Authentication methods. Microsoft's PowerShell scanner shows whether your policies still target SMS or voice. Its notes say the results are not user counts or proof of use.

If you use security defaults, Microsoft says users register for Authenticator notifications, so fewer people may be affected. Run the check anyway.

Your options

Microsoft names passkeys, Windows Hello and FIDO2 as phishing-resistant. For most small firms, three routes matter.

1. A passkey in Microsoft Authenticator. Microsoft recommends passkeys as the main route away from text and voice. Microsoft says this option costs nothing extra and needs no extra licence in any Entra ID edition. Staff approve with a fingerprint, face scan or device PIN. Phones need iOS 17 or Android 14 or later. Staff with an older phone can use a FIDO2 security key or Windows Hello, which Microsoft also names as phishing-resistant.
2. Authenticator approval prompts. Staff get a prompt in the app, enter the number shown and approve. Microsoft supports this MFA method but does not list it as phishing-resistant. The blocking passkey prompt targets only users whose sole method is text or voice.
3. A telephony provider. This is a company that sends the texts and makes the calls for you. Microsoft says it is for firms with a business, regulatory or technical need. You contract with one through Microsoft Security Store and pay it for usage. Microsoft lists Soprano and Telesign as the initial providers, in private preview. Setup also needs a routing function in your own Azure subscription, with standard Azure charges that Microsoft expects to be small.

One catch: providers do not keep SMS sign-in alone (a phone number and text code, no password). Microsoft's telephony FAQ says that retirement applies even with a provider. Message Center post MC1474104 dates it 1 February 2027.

A simple plan to finish before 1 February 2027

A little over 14 weeks remain from today.

1. This week, list the people. Use the steps above and include every admin. Global Administrators have until 1 July 2027; other internal admins still have the 1 February deadline. Prioritise accounts with elevated access.
2. By mid-November, decide on a provider. Skip it unless someone has a real regulatory or operational need. If so, review the Security Store listings. Microsoft advises finishing before 1 February, to leave time for testing and a phased rollout.
3. Check passkeys are switched on. Go to Entra ID > Authentication methods > Policies and open Passkey (FIDO2). On Enable and target, confirm Enable is On and your staff are targeted. On Configure, confirm Allow self-service set up is Yes. Microsoft says people cannot register a passkey in Security info if it is No.
4. Check the registration campaign. Go to Entra ID > Authentication methods > Registration campaign. Microsoft sets the state to Microsoft managed for tenants with text or voice users. You can also target a group of those users yourself.
5. Pilot, then roll out. Try two or three people first, including whoever looks after IT. Roll out to everyone in December with the message below.
6. Chase the rest in January. Re-run the report weekly, and allow for the 36-hour lag.

What to tell staff

Microsoft's end-user rollout templates include posters and emails you can brand.

Affected users receive passkey registration prompts before their retirement date. The blocking prompt starts on 1 February for most users and 1 July for Global Administrators and external users. Users migrated to a telephony provider do not receive that blocking prompt.

Here is a message you can adapt:

From 1 February 2027, Microsoft will stop sending text and voice codes when you sign in to work. Please set up a passkey in the Microsoft Authenticator app before then.

1. Install Microsoft Authenticator from the App Store or Google Play.
2. Open it, add your Work or school account and sign in.
3. If you already had your account in the app, tap it, then tap Create a passkey. Otherwise, carry on with the prompts.
4. Follow the prompts. You may need to set a screen lock and let Authenticator manage passkeys in your phone settings.

Your phone needs iOS 17 or Android 14 or later. Tell us if yours is older.

Where Cyber Essentials fits

The NCSC's Cyber Essentials requirements v3.3 took effect on 27 April 2026. They say authentication to cloud services must always use MFA, where available. They add that SMS is not the most secure MFA but beats none, and recommend alternatives where they work.

IASME says missing MFA on cloud services means an automatic fail. So the aim is to keep MFA on for every user, not to lose it.

How cloud365.io can help

We can check which of your users still rely on text or voice codes and help you move them before 1 February 2027. You can ask for a Microsoft 365 audit and we will review sign-in and MFA settings alongside the rest of your tenant. Our Microsoft 365 security checklist covers the other settings worth checking.