Microsoft Message Center notice MC1528000, published October 27, 2026; telephony provider configuration available from October 30, 2026
Microsoft Will Retire Its Entra ID SMS and Voice Service on February 1, 2027: Passkeys or Your Own Telephony Provider
Microsoft reiterated in Message Center notice MC1528000, published October 27, that it will begin retiring Microsoft-provided SMS and voice authentication in Microsoft Entra ID on February 1, 2027, covering Worldwide and Government Community Cloud environments with rollout expected to finish in early February 2027. The scope is narrower than the headline suggests: the retirement targets Microsoft own telephony delivery service, not every use of text messages or phone calls for sign-in. Organizations that must retain telephone authentication can configure a customer-managed telephony provider, under the Choose Your Own Telephony Provider model, through the Microsoft Security Store, with Microsoft documentation putting that configuration experience as available beginning October 30, 2026; existing customer-managed configurations are unaffected, and organizations that do not use Microsoft-provided SMS or voice need take no action. Microsoft cites phishing and SIM-swap attacks as the reasons for moving away from telephone-based authentication and recommends passkeys, which use FIDO standards and origin-bound public-key cryptography, as the phishing-resistant replacement. The user experience splits by what is already registered: users who already have another sign-in method will use that method and are not forced to register a passkey, while users whose only registered method is SMS or voice will be allowed one final telephone-based verification and must then register a passkey to continue signing in. Microsoft advises administrators to treat February 1 as the migration deadline rather than waiting for the rollout to reach their tenant, following the original announcements in July 2026.
Executives
This is a dated, vendor-enforced identity change with a hard operational consequence: staff whose only second factor is a text message or phone call will hit a forced enrollment moment in February if nobody acts first. The cost of acting early is a planned enrollment campaign; the cost of waiting is a helpdesk surge in the same week every other unprepared tenant has one. Three months is enough time only if the inventory of affected users starts now.
CIO / CISO
Run Microsoft Entra SMS and Voice Policy Scanner or your equivalent reporting to list every account relying on Microsoft-provided telephone authentication, and sort it into users with another registered method, who need only communication, and telephone-only users, who need assisted passkey enrollment before February. Decide explicitly, per population, between passkey migration and a customer-managed telephony contract, and record the decision: keeping SMS through your own provider preserves the function while keeping the phishing and SIM-swap exposure Microsoft is exiting. Communicate through trusted channels only, because migration-themed messages are an active phishing lure for registering attacker-controlled credentials.
Engineers
Do the configuration work in the available window: the customer-managed provider setup opens October 30, so a telephony decision does not need to wait until January. Test the final-verification flow with a pilot telephone-only account so the helpdesk script reflects the real screens, and confirm that passkey policies, attestation settings, and fallback methods in your tenant match the population you intend to migrate before the broad communication goes out.
Everyone (non-IT)
If your work sign-in uses a code sent by text or phone call, expect your IT team to ask you to set up a passkey or another sign-in method in the coming months. Do that setup only through your organization official channels and links your IT team publishes in advance, never through an unexpected message asking you to enroll, because attackers copy exactly this kind of notice.