October 23–30, 2026 | Trust Player Zero
On October 27, Microsoft reminded Entra ID administrators that Microsoft-provided SMS and voice authentication will begin retiring on February 1, 2027. The change was announced in July, and Microsoft began moving users toward passkeys in September.
The latest reminder makes the operational consequence clearer. Users who still rely on SMS or voice may be required to register a passkey before they can finish signing in. For someone with a compatible device and IT support nearby, that may be a minor interruption. For someone working remotely, using an older device, or trying to access a time-sensitive business system, it could be more difficult.
The security benefit is straightforward. Passkeys provide stronger protection against phishing and SIM-swap attacks. But completing the migration requires knowing which people still depend on the methods being retired, what alternatives they have, and whether those alternatives actually work.
Microsoft: two deadlines, different users
Microsoft's retirement guidance establishes two dates.
Beginning February 1, 2027, Microsoft-provided SMS and voice authentication will be retired for most Entra ID workforce users. Internal guest users are included in that first phase.
Global Administrators and external users have until July 1, 2027. The change applies to Entra ID workforce authentication in the public cloud, rather than Azure AD B2C or Entra External ID customer authentication scenarios.
That distinction matters when an IT team is reviewing its accounts. A spreadsheet with a single category for guest users may hide different migration deadlines.
Microsoft's October 27 Message Center notice also explains what happens to users whose only registered authentication method is SMS or voice. They can use that method one final time to verify their identity, but must then register a passkey before continuing. The registration prompt cannot be skipped.
A user who already has another supported authentication method can use it instead.
Being enabled for passkeys does not prove someone is ready
Since September, Microsoft has been automatically enabling passkeys for users configured for SMS or voice authentication and prompting them to register during sign-in.
Those prompts can be postponed during the transition period. As a result, an administrator may see that passkeys are enabled in policy while some users have yet to register one.
There are several different things worth checking: which methods a user is allowed to use, which methods they have registered, and which methods they actually use.
Microsoft's Authentication Methods Activity report separates registration from usage. Its data can lag by up to 36 hours, so recent changes may need to be checked again.
For a security leader, a tenant-wide MFA percentage is a starting point. It does not identify every person who will encounter a blocking registration prompt in February.
Exceptions need a business reason
Microsoft recognizes that some organizations may have regulatory or operational reasons to continue using SMS or voice authentication. Those organizations can use a customer-managed telephony provider through the Microsoft Security Store.
That creates a decision for regulated businesses.
Consider a lender with employees who work across different devices, or an insurer with a team that needs access outside normal IT support hours. Some users may need additional preparation before moving to passkeys. Others may have a legitimate reason to retain telephone-based authentication.
These are scenarios to assess, rather than reported incidents.
For each exception, document why it is necessary, which users it covers, who approves it, and when it should be reviewed again. Test the provider and the sign-in process before relying on them.
Keeping SMS or voice available also means accepting the security limitations that led Microsoft to move away from those methods. An exception should remain visible to the people responsible for that decision.
Make the migration visible before February
Start with the users who are still enabled for SMS or voice. Microsoft provides an Entra SMS/Voice Policy Scanner to help administrators identify them.
Then look at their registered methods and recent authentication activity. Separate users who already have a working alternative from those who depend on a retiring method.
Prioritize accounts according to the work they support. A rarely used account may still be important if it belongs to someone responsible for a critical operational process. Internal guests need particular attention because their deadline differs from that of external users.
For each affected group, agree on who will communicate the change, help with registration, and handle recovery when someone loses a device or cannot complete sign-in. Microsoft's deployment guidance recommends planning around different user groups and preparing backup authentication methods.
Finally, confirm the result. A completed registration is useful evidence, but testing a successful sign-in with the intended method gives the team greater confidence that the transition will work.
Keep the remaining exceptions and unsuccessful migrations visible until they are resolved.
What TPZ is testing
At Trust Player Zero, we are starting with a practical question: can a team see enough reliable identity and access information to make a decision, assign responsibility, and understand what remains unresolved?
Our Microsoft Entra integration is read-only today. When configured for live data, it can read portions of MFA registration and directory-role information, with known coverage limits. It does not establish complete passkey-migration readiness, enforce authentication policies, or configure authentication methods.
The Design Partner Beta is intended to test evidence-backed identity and access findings, including privileged users with MFA-registration gaps, and a customer review process that keeps the finding and its disposition connected. Passkey migration itself is outside that specific beta target.
Microsoft's deadline offers a useful example of why the distinction between configuration and confirmed results matters.
By February, an IT or security leader should be able to identify who still depends on a retiring authentication method, what their alternative is, and who is responsible for getting them ready.
Otherwise, the first clear sign of an unfinished migration may be a support request from someone who cannot complete sign-in when they need to work.
Explore the TPZ Design Partner Beta
Microsoft-first organizations with lean IT and security teams can review the TPZ Design Partner Beta and discuss an identity or access workflow worth testing.
Editorial note: The operational scenarios and recommendations are TPZ's analysis, rather than reported incidents involving Microsoft customers. Microsoft's retirement schedule and technical guidance were checked on October 30, 2026. Organizations should consult Microsoft's current guidance before making changes.
