Entra ID SMS and Voice MFA Retirement: The Dates Have Split. What Australian Businesses Need to Do Before 1 February 2027

If your Entra ID tenant still sends six-digit codes by text, 1 February 2027 is the day Microsoft stops delivering them for most of your users. That much has been known since Message Center announcement MC1426371 went out in July.

What has changed is nearly everything around that date. Microsoft revised the notice in September, and if your plan is built on what you read in July, it is out of date in three places: the date has split in two, SMS sign-in is being retired outright, and the option to keep SMS under your own contract is now open, with real providers and real plumbing to deploy.

There is also a decision buried in this that Microsoft will make for you if you do not: what kind of passkeys your users end up with.

TLDR

• Microsoft-provided SMS and voice MFA retires on 1 February 2027 for most users, and on 1 July 2027 for Global Administrators and external users. Internal guests stay on the February date.
• Passkeys have been the default since 1 September 2026. Users enabled for SMS or voice were automatically enabled for every passkey type, synced passkeys included. If you want a say in that, set a passkey profile before your users register.
• SMS sign-in (phone number plus a texted code, no password) is retired on 1 February 2027 under a separate notice, MC1474104, and bringing your own telephony provider does not save it.
• You can keep SMS and voice as a second factor through your own telephony provider. Configuration has been open since 30 October 2026. Microsoft recommends finishing setup at least four weeks before the cut-off, which makes early January your real deadline, and mid-December if your change freeze starts before Christmas.
• Microsoft's notice does not say what happens to self-service password reset, which still lists SMS and voice as methods and does not accept a passkey. Plan as if the phone option goes with the telephony.

What changed since the July announcement

Sources: MC1426371 (updated 15 September 2026), MC1474104, MC1459133 and Microsoft Learn's retirement overview.

The timeline as it stands

A temporary opt-out exists, and it only covers the September to February changes: the default passkey enablement and the registration nudges. Microsoft's wording on the dates themselves is "There is no opt out for enforcement."

On the day, a user whose only MFA method is a phone gets a blocking passkey registration prompt at their next sign-in. They register on the spot and continue. Multiply that moment by every unmigrated user and you can picture the first week of February at the service desk.

Your real deadline is before Christmas

Read the dates again with an Australian calendar next to them. Microsoft recommends having a telephony provider configured at least four weeks before 1 February, which lands on about 4 January. Most organisations I work with stop making production changes in the third week of December and do not properly restart until mid-January.

So if any part of your plan involves keeping SMS, the contract, the Azure deployment and the testing all need to be finished by mid-December. If your plan is passkeys only, the same window is when your registration campaign needs to do most of its work, because nobody registers a passkey from the beach.

Why this is a good decision

SMS made sense as a second factor when the alternative was a password alone. Its weaknesses are now well documented: codes get phished in real time by adversary-in-the-middle kits, intercepted through SIM swaps, and read straight off lock screens. Australians are not short of people trying, either: the National Anti-Scam Centre counted AU$2.18 billion in reported scam losses in 2025.

The regulatory direction matches. ASD's Essential Eight expects phishing-resistant MFA from Maturity Level Two, and a texted code does not meet that bar. If your organisation is chasing ML2, every SMS-registered user is a finding waiting to be written, and Microsoft retiring the method does part of your uplift for you. We map the rest of the Microsoft 365 controls to each maturity level on our Essential Eight page.

Passkeys are the replacement. The credential is bound to the real sign-in domain, so a fake login page has nothing to harvest. If passkeys are new territory for your team, Phil's Passkeys Explained covers how they work in plain language, and the Labs Passkey 101 goes a level deeper into the protocol.

Decide your passkey strategy before the default decides it for you

This is the part most retirement plans skip. "Move everyone to passkeys" is not one decision. It is three, and Microsoft has already answered the first one on your behalf: users who were enabled for SMS or voice have been automatically enabled for all passkey types.

Entra ID supports two kinds of passkey. A device-bound passkey lives on one piece of hardware, either a FIDO2 security key or the Microsoft Authenticator app, and cannot be copied off it. A synced passkey lives in a password manager such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden, and follows the user to every device signed in to that account.

Both are phishing resistant. They differ in what you can prove about them and what they cost to run, and that is where the three questions come from.

1. Are you willing to accept the risk of synced passkeys?

A synced passkey is as secure as the account it syncs through, and that account is usually a personal Apple or Google account you do not manage. Its recovery process is not yours. Its other devices are not yours. An employee's passkey for your tenant can end up on a family iPad, and it will still be there after they leave unless you remove the registration. Microsoft's own guidance is to treat synced passkeys as phishing resistant "but with the same security posture as other unattested authenticators".

For most of a workforce that is still a large step up from a texted code, and the user experience is the best of any method. For administrators, for anyone handling regulated data, and for organisations with sovereignty or Maturity Level Three obligations, it deserves a deliberate yes or no rather than a default.

2. Are you prepared for the overhead of device-bound passkeys?

Device-bound means every credential is tied to a thing that can be lost, broken or replaced. A new phone means registering again. A lost security key means a recovery process, and that process is now the weakest point in the chain, so it needs a Temporary Access Pass procedure and a help desk that verifies the caller properly before issuing one. Security keys add purchasing, shipping, spares and a stocktake. Budget AU$70 to AU$120 a key, two per person if you want a backup, plus the hours.

None of that is a reason to avoid device-bound passkeys. It is a reason to decide who actually needs them, so the overhead lands on a few hundred people and not the whole directory.

3. Do you require attestation?

Attestation is the authenticator proving its make and model at registration. With it enforced, Entra knows a credential really is a YubiKey 5 or a passkey in Microsoft Authenticator. Without it, in Microsoft's words, Entra "can't guarantee any attribute about a passkey, including if it's synced or device-bound".

Two consequences follow. First, synced passkeys do not support attestation, so enforcing attestation is also how you exclude them: the two questions are really one setting. Second, attestation is only checked at registration. Turning it on later does not remove the passkeys people have already registered, which is why this decision belongs before your campaign peaks and not after.

What that looks like in the tenant

Entra's passkey profiles let you answer these per group instead of once for the tenant. Each profile sets the allowed passkey types, attestation enforcement, and an allow or block list of specific authenticator models. You get up to three profiles including the default, so spend them carefully. A split that works for most organisations:

The split date helps here. Global Administrators have until 1 July 2027, which is enough time to buy keys and do it properly, and not an excuse to leave your most privileged accounts on SMS for an extra five months. If you already use authentication contexts for step-up, an authentication strength that demands an attested device-bound passkey is the natural control to put in front of privileged actions.

Password reset: the gap nobody announced

Microsoft's notice and the Learn overview talk about MFA. Neither says what happens to self-service password reset, and that silence is a problem, because SSPR is where a lot of SMS usage actually lives.

Here is what the documentation does say today. The SSPR methods list still includes SMS and voice call. The authentication methods table marks every kind of passkey as "No" for SSPR. Microsoft is rolling out a password change option for users who have signed in with a passkey, but describes it as "separate from SSPR": it helps someone who is already signed in, and does nothing for someone who is locked out.

Until Microsoft says otherwise, I would plan as if SMS reset stops when Microsoft's telephony does. The work is the same either way, and it is cheap: make sure every user who resets by text today has Microsoft Authenticator and one more method registered for reset, such as email or an OATH token.

Skip this and each forgotten password becomes a service desk call. We budget an assisted reset at roughly AU$40 to AU$70 of support time. A few hundred of those in February will cost more than the planning you avoided, and every one of them is also a chance for someone to talk your service desk into resetting the wrong account.

SMS is load-bearing in parts of your business

Plenty of organisations lean on SMS because it is the only factor that fits the job. Retail and aged care staff on shared devices with no corporate smartphone. Contractors who refuse company apps on personal phones. Break-glass accounts verified by a mobile number in a safe.

Sort those into the two dates before you plan anything. Shared-device staff and contractors who are members of your tenant are on the February date. So are internal guests. Break-glass accounts holding Global Administrator, and external users signing in from their own tenant, are on the July date. Passkey support for B2B users is arriving in the same order: internal guests through late November 2026, external users at a date Microsoft has not yet announced.

For the residual group that truly needs SMS, the own-provider route exists. Treat it as a narrow exception with a price, an owner and a review date.

SMS sign-in is being retired outright

While you are in the tenant, hunt down one specific feature: SMS-based sign-in, built for frontline workers, where typing a phone number and a texted code signs the user in with no password involved. The switch is the Use for sign-in toggle inside the SMS authentication method policy, and in the tenants we review, almost nobody can say from memory whether it is on.

That feature has its own notice, MC1474104, and it is blunter than the main one. From 1 February 2027, in workforce tenants, sign-in attempts with a phone number and a texted code "will be blocked". Bringing your own telephony provider does not change that: the retirement applies even when you keep SMS as a second factor under your own contract. Entra ID Free tenants have already lost it.

So the people using SMS sign-in today are not in the "register a passkey and carry on" group. They are the group with no fallback at all, and they are usually your frontline staff. Filter the sign-in logs for the SMS sign-in method, find out who depends on it, and move them first. Microsoft names passkeys, QR code authentication and FIDO2 security keys as the alternatives, and for shared devices with no personal phone, a security key or QR code sign-in is usually the one that fits.

What keeping SMS will cost

Keeping SMS as a second factor means Microsoft's choose your own telephony provider model. Entra still generates and checks the code. Delivery moves to a provider you contract through the Microsoft Security Store, currently Soprano, Telesign or Infobip, through an Azure Function deployed in your own subscription.

That gives you two bills and one new responsibility:

• The provider's charges for SMS and voice delivery. Pricing sits in each provider's Security Store listing, and offers vary between per-user and per-message.
• Azure consumption for the function and its supporting resources.
• Fraud controls are yours. Microsoft's responsibility table puts "configuring fraud controls" on the customer. Today, junk traffic aimed at your tenant's phone prompts is Microsoft's cost. Under your own contract it lands on your invoice. Telcos call it artificially inflated traffic, or SMS pumping, and Twitter reportedly lost about US$60 million a year to it before restricting SMS 2FA in 2023. Set destination restrictions and a spending cap with your provider on day one.

Until you have quotes in hand, Australian commercial SMS rates give you a planning number. These are our estimates, not provider pricing.

Call it AU$10,000 a year to keep 500 users on SMS, before contract overhead, plus an integration to run and a weaker factor to show for it. The same 500 users on passkeys cost nothing per sign-in and take real-time phishing of the sign-in off the table.

That maths is why I would migrate first and contract a provider only for whoever is left. Move your heaviest SMS users now and the future bill shrinks with every wave.

What if you are not ready for passkeys?

February does not force passkeys on everyone. The retirement removes Microsoft-provided SMS and voice, and the blocking prompt only catches users with no other registered method. Microsoft Authenticator push and TOTP codes continue unchanged, which makes the app the realistic bridge for tenants mid-transition. Push approvals still fall short of the phishing-resistant bar the Essential Eight expects at Maturity Level Two, so the bridge should stay temporary.

Passkey readiness has its own gotchas. Virtual desktops and remote sessions handle WebAuthn inconsistently, older browser fleets fail quietly, and the cross-device QR flow needs Bluetooth working on both devices. Shared-device and no-phone cohorts point to FIDO2 keys. Those are the ones we hit most often on passkey rollouts, and every tenant adds one of its own.

Two controls to set now

Every tenant's migration looks different. Two controls apply everywhere.

Stop the intake. Scope the SMS method so new starters never register a phone number as an authentication method. Every new hire who lands on SMS this month joins the February pile. Microsoft's SMS and voice usage analyzer will tell you how big the existing pile is.

If you would like that view read back to you with a plan attached, that is a standard piece of our Secure Microsoft Entra ID work, and you can book a 30-min discussion to walk through your numbers.

Backup methods, always. A user with one registered method is a lockout waiting for a lost phone. Require a second method at registration and keep a Temporary Access Pass process for day one and for recovery. That habit also covers the password reset gap without drama.

For a 50-seat business on Business Premium, those two controls plus Authenticator cover most of the risk in a quarter. For a 5,000-seat enterprise the exposure concentrates in guests, frontline scale and Essential Eight evidence, and the passkey profile decisions above carry most of the weight.

FAQ

When does Microsoft retire SMS and voice MFA in Entra ID? 1 February 2027 for most users, including internal guests. 1 July 2027 for Global Administrators and external users. Neither date has an opt-out.

Will users be locked out on 1 February 2027? Not if they can register a passkey. Phone-only users get a blocking passkey registration prompt at sign-in, register, and continue. Anyone holding another method, such as Authenticator, signs in as normal. Users who rely on SMS sign-in with no password are the exception: that method is blocked.

Can we keep SMS after the retirement? As a second factor, yes, through your own telephony provider from the Microsoft Security Store. You pay the provider and the Azure costs, and you own the fraud controls. Microsoft recommends finishing setup four weeks before 1 February 2027. SMS sign-in as a first factor cannot be kept.

Does this affect self-service password reset? Microsoft's notice does not say. SSPR still lists SMS and voice as methods, and a passkey cannot be used to reset a password. Register an alternative reset method for every user who resets by text today.

Are synced passkeys good enough? They are phishing resistant, and for most staff they are a large improvement on SMS. They cannot be attested, so you cannot prove where the credential lives. Use device-bound passkeys with attestation enforced for administrators and for any cohort where you need that proof.

Does SMS still count for Essential Eight? Not at Maturity Level Two or Three, which expect phishing-resistant methods.

Is Microsoft Authenticator enough? Passkeys in Authenticator are device-bound and meet the phishing-resistant bar. Standard push approvals with number matching do not, so aim for the passkey, with the push as a stepping stone.

Mandatory plug

This is the work Modern 42 does: Australian owned identity engineering across Canberra, Sydney, Melbourne and Brisbane. We run the usage analysis, design the passkey profiles, run rollouts across corporate, frontline and BYO fleets, and scope the telephony exception so it stays an exception. It sits on our Secure Microsoft Entra ID line, usually alongside a Conditional Access review, and for Microsoft 365 customers working towards a maturity level it feeds straight into Essential Eight evidence.

If you want a second pair of eyes on your plan, book a 30-min discussion to talk through your MFA options. No commitment, and an engineer on the line rather than a salesperson. Bring your usage numbers and we will tell you where the risks sit.