The change applies to organisations that allow SMS first-factor authentication, known in Microsoft’s documentation as SignInNoPassword. Once the retirement takes effect, users will no longer be able to enter their phone number and an SMS one-time passcode as their primary credential, and existing configurations enabling that sign-in route will stop being honoured.
Microsoft has advised administrators to identify users who still rely on the method and migrate them to alternatives before the deadline. Management and configuration controls for SMS first-factor sign-in are also due to be removed from Microsoft administration experiences as part of the retirement.
The move is separate from, but closely aligned with, Microsoft’s broader withdrawal of Microsoft-provided SMS and voice delivery for authentication in Entra ID. That service is also scheduled to end for most users on February 1, 2027, with a later July 1 deadline for Global Administrators and external users.
Microsoft is steering organisations towards phishing-resistant authentication, particularly passkeys, Windows Hello for Business and FIDO2 security keys. Passkeys were made the default authentication experience for Entra ID from September 1, 2026 for users enabled for SMS or voice, with affected users automatically enabled and prompted to register when performing multifactor authentication.
The company says SMS and voice methods provide weaker protection against phishing, interception, SIM-swapping and social-engineering attacks than credentials based on public-key cryptography. Passkeys do not rely on shared secrets sent across telecom networks and are designed to resist credential phishing.
For organisations that still have business, regulatory, technical or operational reasons to retain SMS or voice authentication, Microsoft is allowing the use of customer-managed telecom providers through the Microsoft Security Store. Those organisations must configure and migrate affected users to a supported provider before the applicable retirement date if they want SMS or voice to remain available for multifactor authentication.
The first-factor SMS change, however, removes the passwordless phone-number-and-code flow itself as a primary sign-in option. Microsoft’s message to administrators says organisations relying on that configuration should move users to another primary authentication method before February 1 to prevent disruption.
SMS first-factor authentication has been used particularly in environments where employees may not have conventional corporate devices or where frontline staff need a simpler passwordless sign-in process. Its removal therefore requires administrators to review not only authentication policy but also device availability, registration procedures and account recovery arrangements for affected workers.
Microsoft’s broader passkey migration programme is already changing the sign-in experience for users who have SMS or voice enabled. Those users can continue using existing supported methods during the transition, but Microsoft is increasingly prompting eligible users to establish passkeys ahead of enforcement deadlines.
Users whose only available multifactor method remains Microsoft-provided SMS or voice after February 1, and whose organisations have not configured an external telecom provider, will face a blocking requirement to register a passkey before they can continue accessing their accounts. Microsoft says there will be no opt-out from that enforcement for users covered by the February retirement.
Internal guest users are included in the February 1 timetable for the broader telecom retirement. Global Administrators and external users receive additional time, with Microsoft-provided SMS and voice delivery for those groups scheduled to end on July 1, 2027.
The company has urged administrators to use Entra authentication method policies and reporting tools to determine which users still depend on SMS or voice. Organisations are also being encouraged to pilot alternative sign-in methods with affected groups before making wider changes.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
