Microsoft is retiring SMS and voice MFA: what your users see in February 2027

There is one date worth putting in a project plan rather than a settings backlog: on 1 February 2027 Microsoft retires SMS and voice call MFA. From that day, a user whose only registered method is SMS does not sign in. They are pushed into passkey registration mid-authentication, and until they finish it, they are not working.

This is not a checkbox. It is a project with a population to identify, a rollout to fund and a set of edge cases that have no obvious answer. And it starts with a single question that happens to be countable: how many of your users have nothing registered but SMS or voice?

The three dates #

Between September 2026 and February 2027 there is one escape hatch: an admin can defer the automatic migration by setting passkeyDynamicMigration through Microsoft Graph. That is a deferral, not an exemption. February does not move.

What users actually experience #

Two very different experiences depending on timing.

Before February 2027, an SMS user is invited to register a passkey. If they decline or postpone, they keep signing in as before. Many will postpone, which is the whole problem: the population you have to deal with is precisely the one that does not respond to prompts.

After 1 February 2027, the same user opens Outlook, types their password, and lands on a registration screen they did not ask for, without the corporate phone they never had, often on a shared workstation. Then they call the helpdesk. All of them, in the same week.

Who is actually affected #

In a 100 to 300 seat company the list is predictable, and it is never the desk workers who cause the trouble:

• Plant floor, production, logistics, field staff. No corporate smartphone,

sometimes no smartphone at all, frequently a workstation shared by three people.

• Contractors and temporary staff holding an account in your tenant with a

personal number registered two years ago.

• Executives who refused the authenticator app and were granted an exception

"for now".

• Service accounts running on a user identity. These are the quietest and the

most damaging, because no communication campaign reaches them and they take a business process down when they fail.

• Remote sites with poor connectivity, where SMS was chosen precisely because

the app did not work.

The countable question #

All the preparation reduces to one inventory: for every active user, which authentication methods are registered, and which users have only SMS or voice.

That number is the only thing you need in order to decide whether this is an email to send or a project to plan. Ten users is one afternoon. Eighty, half of them in production, means a rollout plan, physical security keys to order, and a budget line.

Until you have that number, every conversation on this topic is a guess.

A five-step plan #

1. Inventory registered authentication methods per user. Isolate the

SMS-or-voice-only population.

1. Segment that list by real constraint: corporate smartphone available,

shared workstation, no device at all, service account. The remedies differ.

1. Pick the replacement per segment. Passkey on a phone for people who have

one, FIDO2 physical security keys for the plant floor and shared machines, Windows Hello for Business on dedicated workstations. Rebuild service accounts on application identities rather than hunting for a second factor for them.

1. Handle exceptions early. The customer-managed telecom carve-out opening on

30 October 2026 requires a documented regulatory or operational need. If you think you have one, the case gets built in November, not January.

1. Communicate in waves, not once. One wave per segment, with the cutover date

in the message, and a fallback channel for the people who will get blocked anyway.

The part most people will miss #

Retiring SMS is good for security. SMS is interceptable, exposed to SIM swapping, and it does not defend against the attacks that define 2026 anyway: adversary-in-the-middle token theft, and device code phishing, where the user completes MFA correctly and still hands the attacker a valid session.

Which means the passkey migration solves a real problem, but not that one. A passkey is phishing-resistant at the moment of sign-in. It says nothing about what a stolen token can reach afterwards, or about the legacy authentication paths still open in your tenant.

So treat February 2027 as what it is: an imposed deadline, not an identity strategy.

How we approach this at Olyteck #

The Identity module in Olyteck Cyber reads your tenant's identity posture read-only, through Microsoft Graph, with no agent: MFA and Conditional Access posture, legacy authentication paths, disabled accounts still holding data, OAuth applications and the permissions they were granted. First report in 2 minutes, measured on a 200-employee tenant with 170 SharePoint sites. On a large tenant with no governance history the full deep scan keeps running in the background for hours, and we would rather say so than round it down.

Our reports always state their own coverage, for example "858 of 868 accounts analysed". A confident but incomplete answer about access is worse than no answer, and most tools in this market do not publish that line at all.

We do not replace your MFA migration plan. We give you the number it starts from.

FAQ #

Can I keep SMS MFA after 1 February 2027? #

Not with the Microsoft-provided service, which is being retired. The only planned route is a customer-managed telecom provider, available through the Microsoft Security Store from 30 October 2026, and reserved for documented regulatory or operational needs. It is not a general opt-out.

What exactly happens to a user who only has SMS? #

From 1 February 2027 they are blocked at sign-in until they register an accepted method. They do not lose the account, but they do not work until registration is complete, which assumes they have the necessary device in hand at that moment.

How do I defer the 1 September 2026 automatic migration? #

Set passkeyDynamicMigration to true through Microsoft Graph. The deferral runs to 1 February 2027 and changes nothing about that date. It exists so you can pick your own rollout schedule, not so you can skip the migration.

What about users with no corporate smartphone? #

That is the segment that costs money, and it needs pricing early. FIDO2 physical security keys are the usual answer for the plant floor and shared workstations, Windows Hello for Business for dedicated machines. Both involve a purchase, a lead time and a hand-over procedure.

Do passkeys protect against session theft? #

They protect the sign-in, not the session that follows. A passkey resists conventional phishing. It does not prevent a token obtained another way, for instance through device code phishing, from reaching whatever that user can reach. Which is why inventorying access stays a separate exercise from inventorying MFA methods.

Sources #

• Microsoft Learn, SMS and voice call MFA retirement, and its FAQ
• Microsoft Entra blog, *Passkeys are the default authentication method in

Microsoft Entra ID*, 13 July 2026

• Message Center MC1426371

Reflects Microsoft announcements as of 19 August 2026. These retirement dates have slipped once before: check your own tenant's Message Center before freezing a rollout plan.

Read next #

• Microsoft 365 Copilot readiness: the permissions checklist to run first
• AI agents in Microsoft 365: the new attack surface to audit
• How to find "anyone-with-the-link" sharing in Microsoft 365