Published: 16 August 2026. Updated: 16 October 2026. Source: Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication / Microsoft 365 Message Center MC1426371 archive
When does Microsoft stop providing SMS and voice MFA?
Microsoft stops providing its own SMS and voice MFA on 1 February 2027, or on 1 July 2027 for Global Administrators and external users. A user whose only method is SMS or voice must then register a passkey at sign-in before continuing. To keep SMS, configure a telephony provider from Microsoft Security Store.
Microsoft is ending the SMS codes and voice calls it sends itself for Microsoft Entra ID sign-in. The change, announced in MC1426371, affects every tenant where some users still complete MFA by phone. For SharePoint Online, where every sign-in goes through Entra ID, a user who reaches their retirement date with SMS or voice as their only method cannot open a site, team or document until they register a passkey.
What MC1426371 announces
The announcement has two parts. First, from 1 September 2026, passkeys were enabled automatically for users who were enabled for SMS or voice, and the passkey Registration Campaign was set to Microsoft Managed. Those users see a prompt to register a passkey when they next complete MFA, and by default they can snooze it as often as they like.
Second, Microsoft-provided SMS and voice authentication retires: on 1 February 2027 for most users, and on 1 July 2027 for Global Administrators and external users. After a user's date, if SMS or voice is their only available method, the passkey prompt can no longer be skipped. Microsoft's Learn page is blunt about it:
"This prompt is blocking." - Microsoft Learn, on sign-in after the retirement date.
SMS and voice themselves do not disappear. A tenant that has a real need for them can configure a telephony provider through Microsoft Security Store, and users covered by that provider keep SMS or voice after the retirement date, at the tenant's cost.
Key dates for Microsoft 365 admins
| Date | What changes | Admin action |
|---|---|---|
| 1 September 2026 | Passkeys enabled automatically for users enabled for SMS or voice; Registration Campaign set to Microsoft Managed | Tell users the prompts are coming. A temporary opt-out delays this until 1 February 2027 |
| 30 October 2026 | Telephony providers can be selected and configured in Microsoft Security Store | If some users genuinely need SMS or voice, choose a provider and test it with a pilot group |
| 1 February 2027 | Microsoft-provided SMS and voice retired for all users except Global Administrators and external users. Internal guest users are in this group | Every user in scope needs a passkey or other phishing-resistant method, or a configured telephony provider, before this date |
| 1 July 2027 | Microsoft-provided SMS and voice retired for Global Administrators and external users | Move Global Administrators and external users before this date. Admin accounts are the ones you least want blocked |
How to find the users the retirement affects
The first job is a list of everyone still enabled for SMS or voice. Microsoft publishes a PowerShell script for exactly this, the Entra SMS and voice usage analyzer. It needs Global Reader, Authentication Policy Administrator or Security Reader. The Authentication methods activity report in the Entra admin center (Entra ID > Authentication methods > Activity) is a useful cross-check, and its export gives one row per user with the methods they have registered.
Split the list in two before you plan anything: Global Administrators and external users, who have until 1 July 2027, and everyone else, who has until 1 February 2027. Internal guest users belong to the February group.
What to do once you have the list
- Run a targeted passkey Registration Campaign. In the Entra admin center (Entra ID > Authentication methods > Registration campaign), set the state to Microsoft Managed and target a security group holding the SMS and voice users you found. Each user is prompted to register a passkey the next time they complete MFA, which moves most people without a helpdesk ticket.
- Tell users before the prompts become blocking. Someone who meets a passkey prompt they cannot skip, with no warning, raises a ticket. Microsoft suggests three messages: what is changing and why, how to register a passkey on their device, and a reminder for anyone who has not done it yet.
- Decide early about users who genuinely need SMS. Shared kiosks, workers without a suitable device, or a regulation that requires an out-of-band SMS need a different path. Configure a telephony provider in Microsoft Security Store once providers are available from 30 October 2026. The Message Center post recommends finishing that at least four weeks before the retirement date so there is time to test.
- Use the opt-out only to buy time. The temporary opt-out holds back the automatic passkey and Registration Campaign enablement until 1 February 2027. It does not move the retirement, and there is no opt-out from the blocking prompt after each group's date.
As you work through sign-in readiness, it is worth a parallel look at who can reach your SharePoint content at all. The external user audit guide covers finding the guest accounts this change also reaches, and the guide to finding sites without an owner helps confirm every site has someone who can help its users through the change.
Frequently Asked Questions
When does Microsoft stop providing SMS and voice MFA?
On 1 February 2027 for most users, and on 1 July 2027 for Global Administrators and external users. Internal guest users follow the February date. After a user's date, if SMS or voice is their only method, they must register a passkey at sign-in before they can continue.
Is SMS MFA going away completely?
No. What retires is the SMS and voice delivery Microsoft provides itself. From 30 October 2026 a tenant can choose a telephony provider in Microsoft Security Store, and users covered by it keep SMS or voice after the retirement date. Microsoft still recommends passkeys for everyone else.
Will users lose access to SharePoint and Microsoft 365?
Not permanently. A user whose only available method is SMS or voice meets a blocking prompt at sign-in after their retirement date and must register a passkey before continuing. Until they do, they cannot reach SharePoint Online or any other Microsoft 365 service. Users who already have another method registered are not stopped.
Can a tenant opt out of MC1426371?
Only from the automatic part. A temporary opt-out delays the passkey and Registration Campaign enablement that ran from 1 September 2026, until 1 February 2027. There is no opt-out from the retirement itself or from the blocking passkey prompt after each population's date.
Sources: Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (updated 23 September 2026); Microsoft 365 Message Center MC1426371, version 2 of 15 September 2026 (merill.net archive).