Microsoft MFA Changes: 2026–2027 Deadlines
Learn how Microsoft MFA changes affect SMS and voice authentication, key 2026–2027 deadlines, and the steps your organization should take.
Key Takeaways
- Microsoft began enabling passkeys by default for users configured for SMS or voice multifactor authentication (MFA) on September 1, 2026.
- Microsoft-provided SMS and voice MFA will be retired February 1, 2027 for most affected users, with a July 1, 2027 deadline for Global Administrators and external users.
- Beginning October 30, 2026, organizations that need to retain SMS or voice MFA can select and configure a supported third-party telecom provider.
- Microsoft passkeys offer stronger protection against phishing and credential theft through device-based or synchronized authentication.
- Organizations should audit existing MFA methods, configure passkeys, support user registration, and prepare recovery procedures before the applicable retirement date.
Important: Microsoft MFA Changes — Action Required
What Your Organization Needs to Know Before Key Deadlines
Microsoft is making significant changes to how users authenticate across its cloud services, including Microsoft 365, Azure, and the Microsoft Admin Center. These changes affect every organization using Microsoft 365 or Azure services and require action before several upcoming deadlines.
This communication summarizes what is changing, when it happens, and what your organization needs to do to avoid disruption.
Why Is Microsoft Doing This?
Microsoft is replacing older authentication methods — particularly SMS text codes and voice calls — with more secure, phishing-resistant alternatives called passkeys. This is part of their global Secure Future Initiative (SFI), designed to protect organizations from increasingly sophisticated credential-based attacks.
The changes are mandatory. There is no permanent opt-out.
Key Date Summary
|
Date |
What Happens |
|
September 1, 2026 |
Passkeys become the default authentication method. SMS and voice codes are deprioritized but still work as a fallback. Microsoft begins prompting users to register a passkey. |
|
September 18, 2026 |
Microsoft publishes a list of approved third-party telecom providers for organizations that require SMS/voice to continue (e.g. for regulatory or accessibility reasons). |
|
October 30, 2026 |
Deadline to configure a third-party telecom provider if your organization needs to retain SMS/voice MFA beyond February 2027. |
|
February 1, 2027 |
Hard cutoff. Microsoft’s built-in SMS and voice MFA is fully retired. Users who have only SMS or voice as their MFA method will be blocked from signing in until they register a passkey. |
What Is Changing: SMS and Voice MFA
Microsoft will retire its built-in SMS text code and voice call authentication on 1 February 2027. After this date, any user who relies solely on these methods to verify their identity will be unable to sign in until they register a new authentication method.
From September 1, 2026 onwards:
- Users with SMS or voice MFA enabled will automatically be prompted to register a passkey the next time they sign in
- Users can skip this prompt for now — sign-ins will not be immediately disrupted
- However, this prompt becomes a hard block on February 1, 2027
If your organization has regulatory, accessibility, or operational reasons to retain SMS or voice codes, you will need to engage a supported third-party telecom provider before October 30, 2026.
What Is Replacing SMS and Voice? Passkeys.
A passkey is a modern, highly secure login method that replaces the need for a password and a separate SMS code. Instead of receiving a text message, users verify their identity using:
- A fingerprint or face scan on their phone or laptop
- A PIN on their device
- A physical security key (such as a YubiKey, plugged into a USB port)
Your Organization’s Passkey Options
|
Method |
Best For |
Cost |
|
Microsoft Authenticator app (passkey) |
Most staff |
Free |
|
Windows Hello for Business |
Windows-heavy environments |
Free (built-in) |
|
Synced passkeys (iCloud / Google) |
BYOD and mixed-device environments |
Free |
|
FIDO2 hardware security keys (e.g. YubiKey) |
Privileged users, IT admins, regulated roles |
Varying costs |
What Your Organization Needs to Do
The following steps should be taken as soon as possible — ideally this week.
- Identify all users on SMS or voice MFA. Run an audit of your Microsoft Entra ID (formerly Azure AD) to understand which users are currently relying on SMS or voice codes.
- Enable passkeys in your tenant. Configure passkeys as an available authentication method in your Entra ID Authentication Methods Policy before Microsoft does it automatically on 1 September.
- Launch a proactive registration campaign. Set up a guided prompt in Entra ID to walk users through passkey registration. Starting this early gives users time to register before any disruption occurs.
- Communicate with your users now. Staff need to know what is changing, why, and how to register. Clear, timely communication significantly reduces help desk calls.
Actions Before October 30, 2026
- Assess whether any users have a genuine need for SMS or voice MFA (e.g. accessibility requirements, no smartphone). For those users, identify and configure a supported third-party telecom provider.
- Plan hardware security key procurement if any privileged or admin users should be upgraded to physical keys (recommended for IT administrators and finance roles).
Actions Before February 1, 2027
- Ensure all users have registered a passkey or an alternative modern authentication method (Microsoft Authenticator, Windows Hello, or hardware key).
- Decommission any workflows or automated processes that rely on SMS or voice codes for authentication.
- Train your IT help desk on passkey recovery scenarios, particularly for users who lose access to their registered device.
What Happens If You Do Nothing?
- September 1, 2026: Users begin receiving repeated prompts to register a passkey. This can cause confusion and an increase in help desk queries if staff are not prepared.
- February 1, 2027: Users with only SMS or voice MFA are blocked from signing in to Microsoft 365 and Azure services. This includes access to email, Teams, SharePoint, OneDrive, and any connected applications.
The impact of inaction is a preventable service disruption affecting your entire workforce.
Need Help?
If you would like assistance auditing your current MFA setup, configuring passkeys in your environment, or communicating these changes to your staff, please get in touch with us. We are here to help ensure this transition is smooth and disruption-free for your organization.
By Ryan Thompson, Microsoft Partnership Manager, Logically
Last updated October 2026
FAQs
What are Microsoft MFA changes?
Microsoft MFA changes are introducing passkeys as the default phishing-resistant authentication method in Microsoft Entra ID while phasing out Microsoft's built-in SMS text and voice call authentication.
When will Microsoft retire SMS and voice MFA?
Microsoft will retire its built-in SMS text and voice call authentication for most affected users on February 1, 2027.
What is a Microsoft passkey?
A passkey is a phishing-resistant authentication credential that uses cryptographic keys instead of traditional passwords and one-time text codes.
Can organizations continue using SMS or voice authentication?
Organizations with regulatory, accessibility, or operational requirements to retain SMS or voice authentication can select a supported third-party telecom provider through the Microsoft Security Store beginning October 30, 2026.
What happens if employees do not register a passkey?
After this date, users who rely exclusively on these methods will need to register a passkey before continuing to access their accounts unless their organization has configured a supported third-party telecom provider.
How can organizations prepare for Microsoft MFA changes?
Proactive MFA planning helps organizations reduce sign-in disruptions, strengthen identity security, and maintain access to critical business systems.
