Vendor retirement notices rarely sound like emergencies. They arrive as Message Center blurbs, Learn-doc updates, and quietly optimistic blog posts. Then the first Monday after enforcement hits, and the helpdesk queue looks like a correlated failure after a bad change window. That is the story behind Microsoft’s plan to make passkeys the default in Entra ID and to stop providing SMS and voice multifactor delivery as a native service. The easy login path office workers have treated like a seatbelt is being retired on a published schedule—and if your tenant is still phone-OTP-first, tickets will explode unless you migrate before the blocking prompts begin.
According to Microsoft Learn’s retirement guidance, Microsoft Entra will retire SMS and voice MFA telecom delivery that Microsoft itself provides, while pushing phishing-resistant passkeys as the default sign-in experience. The hook for operators is simple: SMS and voice are no longer positioned as secure methods in Entra, and the calendar is not optional theater.
Microsoft Entra Will Retire SMS and Voice MFA as Passkeys Take Center Stage
The public-cloud timeline is concrete. Beginning September 1, 2026, users enabled for SMS or voice are auto-enabled for passkeys, and the registration campaign moves to a Microsoft-managed state that nudges those users to register a passkey after MFA. Microsoft’s Security Blog announcement frames the same dates: passkeys roll out as the default experience from that September start, with Microsoft-provided SMS and voice telecom delivery ending February 1, 2027 for most users.
After February 1, 2027, users in scope whose only remaining MFA method is SMS or voice hit a blocking passkey-registration prompt. There is no opt-out from that enforcement for that population. Learn and the accompanying FAQ also spell out a later date for Global Administrators and external users: July 1, 2027. Internal guest users stay on the February schedule. Treat those as two change windows, not one shrug.
Organizations that still have a legitimate regulatory or operational need for telephony can move to customer-managed telecom providers through the Microsoft Security Store—provider details arrive September 18, 2026, with configuration available from October 30, 2026. Passkey migration itself carries no extra Microsoft charge; carrier SMS after retirement does not.
Why the Quiet Deprecation Turns Into Office Panic
SMS MFA felt free, familiar, and “good enough.” Frontline workers, executives who refuse Authenticator installs, and break-glass folklore all gravitated to “text me a code.” Helpdesks optimized for that path: reset the phone number, wait for the carrier, close the ticket. When the native rail goes away, every user who never registered a stronger method becomes an incident. Unlimited snoozes on the September–February nudge window train people to click Skip. Enforcement does not honor Skip.
Microsoft’s security rationale is not subtle. Passkeys use public-key cryptography instead of shared secrets that can be phished, SIM-swapped, or replayed. The Security Blog cites Microsoft Threat Intelligence observing AI-enabled phishing campaigns with click-through rates as high as 54%, versus roughly 12% for more traditional campaigns. Whether or not your SIEM has already logged MFA fatigue attacks, the vendor has decided phone OTP is the wrong default for an AI-era identity threat model.
Self-service password reset is in scope too. The FAQ is explicit that native SMS and voice retirement applies across Entra, including SSPR, unless you stand up a Security Store telecom provider. If your recovery story still ends with “we’ll text the user’s phone,” rewrite that runbook before February.
What Operators Should Do Before the Blocking Prompt
Inventory first. Microsoft publishes guidance—and a PowerShell usage analyzer—to find who is still in SMS or Voice authentication methods policy scope. Non-zero results mean you are in the blast radius. Split the list: knowledge workers who can move to synced or device-bound passkeys, frontline cohorts that may need authenticator passkeys or FIDO2 keys, and any regulated pockets that truly require telephony.
Enable passkeys deliberately. Entra supports synced passkeys (platform credential managers such as iCloud Keychain or Google Password Manager) and device-bound options (Passkey in Microsoft Authenticator, Entra passkey on Windows, FIDO2 hardware keys). Pick profiles that match device reality, then turn on a registration campaign early so the September auto-enablement is catching leftovers, not starting from zero.
Communicate like a change window. Awareness, action steps by device type, and reminder waves beat a Friday email titled “authentication update.” Scope messages to the SMS/voice security group so finance does not get the same blast as contractors on shared tablets. Temporary opt-out via the Graph passkeyDynamicMigration setting can delay auto-enablement until February 1, 2027—but it does not delay final retirement. Use it to finish carrier contracting or staged migrations, not to pretend the date vanished.
Watch the Failure Domains
Shared devices, users without personal phones on the corporate policy, and B2B/guest edge cases are where correlated login failures hide. Passkey support for B2B and internal guests is planned by end of calendar year 2026 per the FAQ; do not assume every guest can register today. Azure AD B2C is out of scope for this announcement, and Entra External ID gets a later separate timeline—useful if your consumer stack is separate from workforce Entra.
Also remember: configuring a customer-managed telecom provider avoids the blocking passkey prompt for users who still need SMS or voice and have been migrated onto that provider. Leaving people on Microsoft-provided telephony until the cutover date while hoping for a soft landing is how you invent a Monday morning outage.
Passkeys Are the New Login Boss—Plan Like It
This is not a branding refresh. Microsoft is removing the native SMS/voice crutch and making passkeys the default path in workforce Entra on a public schedule. Operators who treat Message Center item MC1426371-class notices as optional reading will discover the hard way that “easy MFA” was a dependency with a retirement date. Inventory the phone-OTP population, register phishing-resistant methods before February 1, 2027 (July 1 for Global Admins and external users), and only keep telephony where policy truly requires a Security Store carrier. Do that, and the helpdesk stays boring. Skip it, and your login path fails closed with a blocking prompt nobody practiced.