StashGrid

Home › The Stash

Entra Retires SMS and Voice MFA: Passkeys by Default

TrainingOctober 15, 2026

Identity ticketUpdated 14 Oct 2026

Identity ticket of the week. If any of your users still get their MFA code by text or phone call, you have a deadline and a default change coming. Microsoft is making passkeys the default now and retiring its own SMS and voice in 2027.

What changed

From 1 September 2026, passkeys became the default authentication experience in Entra ID and are auto-enabled for anyone currently set up for SMS or voice, who then get nudged to register one at their next MFA (per Microsoft Learn). Microsoft-provided SMS and voice MFA then retires on 1 February 2027 for almost everyone, with a later carve-out of 1 July 2027 for Global Administrators and external users; if you still need text or voice after that, you can configure a third-party telephony provider through the Microsoft Security Store from 30 October 2026.

The tickets it will generate

  • “It’s nagging me to set up a passkey and I don’t know what that is.”
  • “My text-message code stopped arriving.”
  • “I don’t have a work phone to register — what am I meant to use?”

What to check

  • Inventory now, not in January: Entra admin center → Authentication methods → User registration details, or the Graph report GET /reports/authenticationMethods/userRegistrationDetails, filtered to users whose only registered methods are phone-based.
  • Decide per group: move them to passkeys or the Authenticator app, or stand up a telephony provider (Security Store opens 30 October 2026) if a population genuinely can’t move off phone codes.
  • Need breathing room: the temporary Graph opt-out (passkeyDynamicMigration set to true in optOutSettings) pauses the default-passkey changes between 1 September 2026 and 1 February 2027 — it does not stop the retirement.

The line for the help desk

Microsoft is retiring text-message and phone-call verification. Passkeys are now the default, so you may be asked to set one up — it’s a faster, phishing-resistant replacement and worth doing. Text and call codes keep working until 1 February 2027 (later for some admin and guest accounts), but please register either a passkey or the Microsoft Authenticator app now at aka.ms/mysecurityinfo so nothing breaks when the old methods switch off.

The date to write down is 1 February 2027 for normal users; the 1 July 2027 one is the later grace period for Global Admins and guests, not an earlier panic date. And yes, the irony of handing administrators the longest runway is not lost on me. — Nyx

What we have not verified. We don’t run your tenant. Every date here — 1 September 2026 default, 1 February 2027 retirement, 1 July 2027 for Global Admins and external users, and 30 October 2026 for third-party telephony — is from Microsoft’s own Learn page (message center MC1426371). Your rollout and any opt-out still need confirming in your Message Center.

Go deeper