Cybersecurity
Microsoft retires SMS sign-in in February 2027
Microsoft told Entra ID administrators to move users to phishing-resistant methods such as passkeys before SMS first-factor sign-in ends in February 2027, with QR codes and FIDO2 keys also listed.
- Microsoft told administrators to move Entra ID users to phishing-resistant sign-in methods before SMS first-factor sign-in ends in February 2027.
- Microsoft said QR code authentication, FIDO2 security keys and other Entra ID-supported methods could be used instead.
- Microsoft said the retirement also applied when organisations used Choose Your Own Telephony Provider for SMS or voice multifactor authentication.
- Microsoft said the change applied only to Microsoft Entra ID workforce tenant authentication and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios.
- Microsoft said it had already retired SMS first-factor sign-in for Microsoft Entra ID Free tenants in August and no longer enabled it for new tenants.
Microsoft told administrators to move Entra ID users to phishing-resistant sign-in methods, including passkeys, before SMS first-factor sign-in is withdrawn in February 2027. It also named QR code authentication and FIDO2 security keys among the available replacements.
The company said organisations should make sure all users were on a phishing-resistant method because SMS and voice would no longer be available for multifactor sign-in after the change. It added that the retirement still applied when Choose Your Own Telephony Provider was being used for SMS or voice.
Microsoft said the retirement covered only Microsoft Entra ID workforce tenant authentication. It said the change did not apply to Azure AD B2C or Microsoft Entra External ID customer identity setups.
Microsoft said it had already ended SMS first-factor sign-in for Microsoft Entra ID Free tenants in August and had stopped allowing it for new tenants. It also said passkeys were being rolled out as the default sign-in experience, with affected users prompted to register one at their next multifactor step.
Named in this story
Companies
- Microsoft
- issued the reminder and retirement schedule
Products and systems
- Microsoft Entra ID
- was the identity service affected
- passkeys
- were one of the recommended replacement methods
- QR code authentication
- was listed as an alternative sign-in method
- FIDO2 security keys
- were listed as an alternative sign-in method
- Microsoft 365 Message Center
- carried the update cited by Microsoft
- Choose Your Own Telephony Provider
- was said not to avoid the retirement
- Microsoft Entra ID Free tenants
- had already lost SMS first-factor sign-in in August
- Azure AD B2C
- was excluded from the retirement
- Microsoft Entra External ID
- was excluded from the retirement
- Microsoft Security Store
- was named as the place to configure third-party telecom providers
How the source tells it
The article read as a routine Microsoft notice, with mild urgency created by the retirement deadline and repeated migration advice.
- urgency A fixed retirement date and repeated migration instructions