Microsoft is retiring SMS for MFA: in February 2027 Entra ID stops sending them. The strange part is that it lasted this long

On July 13 Microsoft published an administrative notice (MC1426371) with no press release and no keynote: Entra ID will stop providing SMS and voice calls as an authentication method. Passkeys by default from September 1, 2026; full retirement on February 1, 2027, with no opt-out, for every tenant. One of the corporate world's most widespread verification methods dies by Message Center memo. And honestly: it was about time.

We manage Microsoft 365 tenants every day, and this announcement affects us and every client with users who still get the six-digit code by text. So instead of the umpteenth "Microsoft bets on a passwordless future", let's do the useful thing: the exact timeline of what happens on each date, the fine print almost nobody is covering, and the plan we would apply — and are applying — to any tenant.

The timeline, date by date (and what happens if you do nothing)

Two more notes from the official fine print: the retirement also applies to self-service password reset (SSPR), not just sign-in MFA; and for now it covers the public cloud — other cloud environments will follow later, on their own schedule. B2B guest users are in scope, and passkey support for them is planned for late 2026: that's one of the pieces worth watching.

The myth that dies: "we have MFA"

For years, "we have MFA" has been a box ticked in audits without asking which MFA. And not all second factors are worth the same. SMS has three problems known for a decade: SIM swapping (the attacker convinces your carrier to hand over your number), interception of the phone channel, and the most important, least-told one: a six-digit code types into a fake page just as easily as a password does. In a modern phish, the victim enters username, password and the SMS code on the attacker's page, and the attacker replays them on the real one within seconds. SMS doesn't resist the attack that is today's daily bread; it only resists the ones from fifteen years ago.

The distinction that matters from now on is a different one: phishable MFA versus phishing-resistant MFA. A passkey can't be typed into the wrong page, because there's nothing to type: it's a cryptographic key pair bound to the legitimate domain. The fake page can copy the design pixel by pixel, but it cannot impersonate login.microsoftonline.com to the browser, so the passkey simply doesn't respond. That's the category jump, and it's the foundation of any Zero Trust architecture that takes identity seriously.

The fine print: staying on SMS will start costing you money

Here's the part almost no headline covers. From February 2027, keeping SMS or voice won't be ticking a box: it will mean contracting a telecom provider through the Security Store and paying per message, at prices that vary by provider, volume and region. In other words: the insecure option goes from "free and default" to "paid and with paperwork", while the secure one — passkeys — is included at no extra cost in every Entra plan. As incentive design, it's flawless.

And in the interest of saying it all: this move also suits Microsoft, which offloads the cost and fraud of delivering telephony to half the world. We don't mind — for once, the vendor's interest and the customer's point the same way — but it's worth keeping in mind so you read the announcement for what it is: a business decision with a real security upside, not an act of philanthropy. The usual caveat applies too: to enforce MFA by policy with Conditional Access you'll still need Entra P1 or P2 licences; registering passkeys itself costs nothing.

Passkeys without the hype: what they are and which to pick

A passkey is a key pair: the private key lives on your device (or in your credential manager) and signs a challenge only the legitimate domain can pose; Entra ID holds the public key. There is no shared secret to steal, no code to relay, no phone number to hijack. Entra ID supports two flavours, and the choice matters:

The plan we would apply to any tenant (starting today)

And a dose of calm: when NOT to rush

If your tenant already lives on Microsoft Authenticator, Windows Hello and well-built conditional access policies, this is not an emergency: it's an improvement that arrives with half the work done and six months to do the other half. The at-risk group is a different one: the tenant that doesn't know how many of its users depend on the phone alone, and will find out on February 1, 2027 from the ticket queue. The difference between the two groups isn't budget; it's having run a script and read a Message Center notice in time. That is, in fact, the honest summary of this whole article.

Sources (verified): official retirement documentation and timeline (passkeys by default Sep 1, 2026, Security Store Sep 18, providers configurable Oct 30, retirement Feb 1, 2027 with no opt-out, SSPR and B2B in scope, per-message costs, temporary opt-out Aug 1) — learn.microsoft.com; MC1426371 announcement of Jul 13, 2026 and the P1/P2 licensing caveat for Conditional Access — office365itpros.com; phone-channel authenticators classified as "restricted" — NIST SP 800-63B.