Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorylow

Microsoft to retire Entra ID SMS and voice MFA from February 2027

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 29: GBHackers adds that Microsoft warns migration emails have been used in passkey-enrollment phishing, and names Choose Your Own Telephony Provider.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Microsoft will retire its Entra ID SMS and voice authentication starting February 1, 2027, and is steering users to passkeys.

Microsoft has told Entra ID administrators, in Message Center notice MC1528000 dated October 27, to move users off Microsoft-provided SMS and voice authentication before retirement begins February 1, 2027. BleepingComputer says the change covers workforce tenants only, not Azure AD B2C or Entra External ID; Cyber Security News and GBHackers say it applies to Worldwide and Government Community Cloud tenants and should finish in early February. Users with another method can keep it; telephone-only users may complete one more phone check, then must register a passkey. Organizations may keep phone delivery through a customer-managed provider, with configuration available from October 30, 2026. Existing providers are unaffected, and tenants that do not use Microsoft-provided SMS or voice need no action.

Key facts
  • Retirement of Microsoft-provided SMS and voice starts February 1, 2027, and should finish in early February.
  • Message Center notice MC1528000 is dated October 27 and cites phishing and SIM-swap risk.
  • Telephone-only users get one last phone check, then must register a passkey.
  • Customer-managed telephony configuration is due from October 30, 2026; existing setups stay.
  • Microsoft warns migration emails have been used in passkey-enrollment phishing.
  • BleepingComputer says Entra ID Free SMS first-factor sign-in was retired in August.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 27, 2026Microsoft posts Message Center notice MC1528000 on SMS and voice retirement. · Cyber Security News
  2. Oct 30, 2026Customer-managed telephony provider configuration is due to become available. · Cyber Security News
  3. Feb 1, 2027Microsoft begins retiring its Entra ID SMS and voice authentication. · BleepingComputer

What each outlet adds

beyond the shared facts
  • BleepingComputerWorkforce-only scope, excluding Azure AD B2C and Entra External ID, plus a scanner script.
  • Cyber Security NewsMC1528000, Worldwide and GCC scope, and one final phone sign-in.
  • GBHackersWarns migration emails are used in passkey-enrollment phishing; names CYOT.
Vendors
Microsoft
Products
Microsoft Entra IDAzure AD B2CMicrosoft Entra External IDEntra ID

Coverage

oldest first · one row per article · UTC
  1. · 2d ago BleepingComputerFirst report

    Microsoft tells Entra ID admins to leave SMS and voice before 2027

    Microsoft-provided SMS and voice MFA end February 1, 2027 for workforce tenants, not Azure AD B2C or Entra External ID.

  2. · 1d ago Cyber Security News

    Microsoft urges Entra ID admins to replace SMS and voice with passkeys

    Retirement of Microsoft-provided phone authentication starts February 1, 2027, in Worldwide and Government Community Cloud tenants.

  3. · 1d ago GBHackers

    Microsoft will retire Entra ID SMS and voice sign-in in February 2027

    Worldwide and GCC tenants must move telephone-only users to passkeys or another provider before February 1, 2027.