Microsoft reminds admins to migrate Entra ID users to passkeys
Microsoft reminds admins to migrate Entra ID users to passkeys before SMS first-factor sign-in is retired in February 2027.
Microsoft is reminding administrators to migrate Entra ID users to phishing-resistant authentication methods like passkeys before the February 2027 retirement of SMS first-factor sign-in. SMS sign-in was retired for Free tenants in August due to account compromise risks, and passkeys are now the default authentication experience for new Entra ID users. The retirement applies only to workforce tenant scenarios, not to Azure AD B2C.
- Microsoft will retire SMS first-factor sign-in for Entra ID in February 2027 due to phishing risks.
- Admins must migrate users to passkeys, FIDO2 keys, or QR code authentication before the deadline.
Full article414 words · extracted from bleepingcomputer.com · click to collapse
Microsoft has reminded administrators to migrate Entra ID users to phishing-resistant methods, such as passkeys, to avoid sign-in disruptions after it retires SMS first-factor sign-in starting in February 2027.
Admins also have alternatives, including QR code authentication, FIDO2 security keys, and other Entra ID-supported authentication methods.
Before this date, organizations should ensure all users use a phishing-resistant method because they will no longer be able to use SMS or voice to complete multifactor authentication and sign in to their accounts.
"The retirement of SMS sign-in as a first-factor authentication method applies even when you use Choose Your Own Telephony Provider to continue using SMS or voice as multifactor authentication method," Microsoft said in a Microsoft 365 Message Center update on Friday.
"If your organization currently uses SMS sign-in for first-factor authentication, migrate users to supported alternatives based on their scenarios."
Microsoft retired SMS first-factor sign-in for Microsoft Entra ID Free tenants in August due to phishing, fraud, and account compromise risks and no longer enables SMS sign-in for newly created tenants.
The retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios.
Microsoft has shared detailed guidance on deploying and managing phishing-resistant passwordless authentication in Entra ID on this dedicated documentation page.
Passkeys now default Entra ID authentication method
In July, Microsoft also announced that passkeys will start rolling out as the default authentication experience for the Entra ID enterprise identity service starting this month.
"As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multifactor authentication, they'll be prompted to register a passkey," Microsoft said.
"Following this transition, on February 1, 2027, Microsoft will retire Microsoft-provided telecom delivery for SMS and voice authentication and will no longer offer SMS and voice as a native Microsoft Entra capability"
Admins with Global Reader, Authentication Policy Administrator, or Security Reader roles can find SMS or voice auth users by running the Entra SMS/Voice Policy Scanner PowerShell script.
Organizations that must use phone-based authentication have to configure third-party telecom providers through the Microsoft Security Store.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.