Microsoft is Retiring SMS and Voice MFA: What You Need to Know

Microsoft is making changes to how you authenticate to Microsoft 365 and other services using Microsoft Entra ID.

From 1 February 2027, Microsoft will retire its built-in SMS and voice authentication services for MFA.

Microsoft is moving customers towards more secure, phishing-resistant authentication methods such as passkeys, Microsoft Authenticator, Windows Hello and FIDO2 security keys. 

What does this mean for your business?

If you currently rely on text messages or phone calls to complete MFA, you will need to move to another authentication method.

From 1 September 2026, Microsoft will begin automatically enabling passkey registration for people currently using SMS or voice MFA. You may see prompts encouraging you to register a passkey when signing in.

The change is ultimately about improving security. SMS and voice authentication are more vulnerable to phishing, SIM-swap attacks and other forms of account compromise than modern authentication methods. Passkeys provide a significantly stronger level of protection.

What should you do?

There is no need to panic, but it is worth getting ahead of the change.

We recommend:

• Identify anyone currently using SMS or voice MFA
• Move your team to a stronger authentication method, such as Microsoft Authenticator or passkeys
• Let your team know about the upcoming change so they understand what to expect
• Start the transition early, rather than waiting until February 2027

For organisations with a genuine regulatory or operational requirement to continue using SMS or voice, Microsoft will offer customer-managed telecommunications providers through the Microsoft Security Store. However, Microsoft recommends passkeys as the preferred approach wherever possible.

How TechPath can help

If you’re a TechPath Managed IT client, we’ll be in touch.

We’re reviewing our clients’ Microsoft 365 environments and will contact anyone affected by this change. We’ll explain what needs to be done and help you move to a more secure MFA option.

Not a TechPath Managed IT client? We can review your Microsoft Entra environment, identify whether you’re affected, and help you transition to a stronger authentication method. 

If your business still relies on SMS or phone calls for MFA, now is a good time to start planning the change. Contact the TechPath team to learn more.

Learn more about Microsoft’s SMS and Voice MFA retirement.