central-it white logo
Get Started
central-it white logo

Microsoft Is Switching Off SMS And Voice MFA – Here’s What Your Business Needs To Do

Get Started

For many years, SMS and voice-based multi-factor authentication (MFA) have been widely used to add an extra layer of protection to online accounts, including Microsoft 365. While these methods have historically been a significant improvement over relying solely on passwords, cyber threats have evolved, and attackers have become increasingly effective at bypassing them through techniques such as phishing, SIM swapping and social engineering.
 
Recognising these risks, Microsoft is moving away from SMS and voice-based authentication methods and is prioritising more secure, phishing-resistant alternatives such as passkeys, Microsoft Authenticator and FIDO2 security keys. If your organisation currently relies on SMS or voice calls as its primary MFA method, now is the time to understand the change and begin planning your transition to stronger authentication methods.

WHAT IS CHANGING AND WHEN?

It's important to highlight, that this change isn't immediate. Below is a breakdown of the planned phased-approach from Microsoft.

01 Sep 2026
01 Sep 2026

Passkeys become the preferred sign-in method

Users who currently rely on SMS or voice-based MFA will begin seeing prompts encouraging them to register a passkey. When completing a sign-in, Microsoft may offer passkey setup as the recommended authentication method. At this stage, registration remains optional and users can choose to continue using their existing authentication method.
30 Oct 2026
30 Oct 2026

Deadline for organisations that still require SMS or voice MFA

Some organisations may have business, operational or compliance requirements that necessitate the continued use of SMS or voice-based authentication. In these circumstances, organisations must transition to a third-party telephony integration via the Microsoft Entra ID Telephony APIs before this date. Unlike Microsoft’s built-in SMS and voice capability, these third-party services are chargeable and priced by the chosen provider.
01 Feb 2027
01 Feb 2027

Microsoft-provided SMS and voice MFA are retired

Microsoft’s built-in SMS and voice authentication services will be permanently disabled. Users who have not registered an alternative authentication method, such as a passkey, Microsoft Authenticator or a FIDO2 security key, may be unable to complete multi-factor authentication challenges and access Microsoft 365 services. There is no option to continue using Microsoft’s native SMS or voice MFA beyond this date.

WHY ARE MICROSOFT DOING THIS?

Cyber criminals are increasingly targeting people rather than technology. While passwords remain a common target, attackers have become highly effective at capturing SMS codes and exploiting voice-based authentication through phishing, social engineering and SIM-swapping attacks.

Microsoft's own telemetry shows that traditional authentication methods are becoming less effective against modern attack techniques. As a result, the company is encouraging organisations to adopt phishing-resistant authentication methods such as passkeys, Microsoft Authenticator and FIDO2 security keys.Unlike SMS or voice-based MFA, passkeys are tied to a trusted device and use cryptographic verification. This means there is no code to intercept, steal or trick users into revealing, significantly reducing the risk of account compromise.

SMS and voice MFA were originally introduced to improve security beyond passwords. However, as attackers have adapted their techniques, these methods no longer provide the level of protection required against today's threats. Passkeys and phishing-resistant authentication methods offer a stronger, simpler and more secure alternative.

WHAT IS A PASSKEY?

A passkey is a modern, phishing-resistant way of signing in that removes the need for SMS codes, voice calls and, in many cases, passwords altogether. Instead of receiving a code and typing it into a login page, you verify your identity using something you have or something you are, such as Face ID, Windows Hello, a fingerprint, your mobile device or a FIDO2 security key.Behind the scenes, passkeys use cryptographic keys stored securely on a trusted device to prove your identity. Because there is no one-time code to enter, intercept or share, passkeys offer significantly greater protection against phishing, social engineering and account compromise attempts.

Choose the passkey that works best for you

DEVICE-BASED PASSKEY

Stored securely on a smartphone, tablet or computer, device-based passkeys use built-in security features such as Face ID, Touch ID, Windows Hello and Android biometrics. These passkeys can often be synchronised across multiple devices using services such as iCloud Keychain and Google Password Manager, making them both secure and convenient.

HARDWARE SECURITY KEYS

Hardware security keys are physical devices, commonly referred to as FIDO2 security keys, that connect via USB-A, USB-C, NFC or Bluetooth. They provide one of the highest levels of protection available and are particularly well suited to administrators, privileged accounts and users working in high-risk environments.

MOBILE AUTHENTICATOR PASSKEY

These passkeys are stored within an authenticator application on your mobile device. For example, Microsoft Authenticator can act as a passkey provider for Microsoft 365 and other supported services, allowing users to sign in securely using device authentication such as biometrics or a PIN.

WHAT THIS MEANS FOR YOU

If your organisation currently uses SMS or voice-based MFA in Microsoft 365, whether as a primary or backup authentication method, these changes are likely to affect your users. The good news is that there is plenty of time to prepare, and taking action now can help ensure a smooth transition before Microsoft retires these authentication methods.

If you'd like help assessing your current setup or planning a passkey rollout, Central IT Solutions can help.

Get Started
Picture of Craig Jones

Craig Jones

Service Delivery Director at Central IT Solutions Ltd

Recent Posts