Microsoft has told Entra ID administrators, again, that phone-based multifactor authentication is being switched off. After 1 February 2027 a Microsoft-provided SMS code or voice call will no longer complete a sign-in for a workforce tenant.
What happened
The reminder went out through the Microsoft 365 Message Center this week. Microsoft-provided SMS and voice delivery retires from 1 February 2027, and the company's stated reason is that both methods are exposed to phishing and SIM-swap attacks. Passkeys are the recommended replacement, with QR code authentication and FIDO2 security keys also supported.
The groundwork has already been laid in stages. Passkeys began rolling out as the default Entra ID authentication experience from September 2026, and users who were enabled for SMS or voice are being switched on for passkeys automatically and prompted to register one at their next MFA challenge. In August, Microsoft also retired SMS as a first-factor sign-in method for Entra ID Free tenants and stopped enabling it for new tenants.
Who is affected
- Microsoft 365 and Entra ID workforce tenants where staff still use SMS or voice as their MFA method
- Shared or kiosk accounts where the phone number belongs to one person rather than the role
- Users issued a hardware token years ago who never finished registering it in Entra ID
- Not affected: Azure AD B2C and Microsoft Entra External ID customer identity scenarios, which are excluded from this retirement
What to do now
Inventory every account still authenticating by phone, then migrate it rather than discovering it on 1 February.
- Run the Entra SMS/Voice Policy Scanner PowerShell script, available to holders of the Authentication Policy Administrator, Global Reader or Security Reader role, to list affected users.
- Decide per user group between passkeys, QR code authentication and FIDO2 security keys. Shared mailboxes and reception-style accounts usually need a different answer from field staff.
- If phone authentication genuinely cannot be dropped, configure a customer-managed telecom provider through the Microsoft Security Store. Without that step there is no SMS or voice fallback after the cutoff.
- Brief the service desk before the change lands, because the first visible symptom will be user sign-in failures rather than an alert.
What this means for South African businesses
Most local Microsoft 365 tenants bought licences and then handed out phone numbers as MFA because it was the fastest option at onboarding. Those numbers follow people out of the business, and a SIM swap on a staff handset is one of the cheapest account takeovers available here. The deadline is the useful part: it forces a migration that closes a real weakness rather than just satisfying a compliance line.
Source: BleepingComputer, 28 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.