Microsoft Mandates Migration to Phishing-Resistant Authentication for Entra ID Users Before 2027 Retirement
Microsoft is urging Entra ID administrators to migrate users to phishing-resistant authentication methods before retiring SMS and voice authentication on February 1, 2027. This critical transition is necessary to mitigate risks associated with phishing and SIM-swap attacks.
BleepingComputer
Microsoft has issued a formal warning to Entra ID administrators regarding the upcoming retirement of SMS and voice authentication methods. These methods will cease to be supported starting February 1, 2027, requiring organizations to complete their migration before the deadline to prevent sign-in disruptions.
Microsoft stated that SMS and voice authentication are vulnerable to phishing and SIM-swap attacks. Consequently, the company strongly recommends that administrators transition all users to stronger, phishing-resistant protection.
Administrators have several supported options for migration, including passkeys, FIDO2 security keys, and QR code authentication. Microsoft specifically recommends passkeys as the preferred method for achieving robust, phishing-resistant security.
This retirement process applies exclusively to Microsoft Entra ID workforce tenant authentication scenarios. It does not affect customer identity scenarios managed through Azure AD B2C or Microsoft Entra External ID.
As part of a broader security rollout, Microsoft began rolling out passkeys as the default authentication experience for the Entra ID enterprise identity service in September. Users currently relying on SMS or voice authentication will be automatically prompted to register a passkey the next time they perform multi-factor authentication.
For organizations that must retain phone-based authentication due to specific operational requirements, Microsoft advises configuring third-party telecom providers through the Microsoft Security Store. This allows organizations to maintain phone-based access while bypassing the native Microsoft retirement.
Microsoft previously provided guidance on identifying users who still rely on vulnerable methods. Administrators with specific roles, such as Authentication Policy Administrator or Security Reader, can utilize the Entra SMS/Voice Policy Scanner PowerShell script to locate affected users.
This directive follows a prior action taken in August, when Microsoft retired SMS first-factor sign-in for Microsoft Entra ID Free tenants due to risks related to fraud and account compromise.