Clarissa Hana
Microsoft is once again issuing a critical alert to administrators of Microsoft Entra ID (formerly Azure Active Directory), strongly advising them to transition users away from SMS and voice-based multi-factor authentication (MFA) methods. The company has set a firm deadline of February 1, 2027, for the retirement of its own provided SMS and voice authentication services, a move aimed at bolstering security and mitigating significant risks associated with these legacy authentication vectors. This directive specifically targets workforce tenant authentication scenarios within Entra ID, explicitly excluding customer identity management platforms like Azure AD B2C and Microsoft Entra External ID.
The urgency stems from the inherent vulnerabilities of SMS and voice calls to sophisticated cyberattacks, including phishing campaigns and SIM-swap fraud. These methods, while once widely adopted for their perceived ease of use, are no longer considered sufficiently secure against modern threat actors. Microsoft’s proactive stance aims to prevent widespread sign-in disruptions for organizations that continue to rely on these outdated authentication mechanisms. Administrators are reminded that by the retirement date, users who have not migrated will be unable to complete multi-factor authentication and subsequently log into their accounts using these methods.
To facilitate this transition, Microsoft is highlighting a range of phishing-resistant authentication alternatives. These include the increasingly promoted passkeys, QR code authentication, and FIDO2 security keys, alongside other supported sign-in methods available within Entra ID. The company has been systematically phasing out less secure authentication options, underscoring a broader industry-wide shift towards more robust security protocols.
A recent update disseminated through the Microsoft 365 Message Center reiterated the impending retirement of Microsoft-provided SMS and voice authentication services, effective February 1, 2027. The communication stressed the importance of completing the migration before the rollout begins to avert any interruption to the user sign-in experience. Microsoft explicitly stated, "SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store."
This advisory builds upon previous communications from Microsoft, including a reminder issued in September. During that period, the company highlighted the availability of the Entra SMS/Voice Policy Scanner PowerShell script, a valuable tool designed to assist administrators. This script empowers administrators with specific roles, such as Authentication Policy Administrator, Global Reader, or Security Reader, to identify users within their organizations who are still utilizing SMS or voice for authentication. This proactive identification is crucial for targeted migration efforts.
For organizations that have a critical need to maintain phone-based authentication capabilities, Microsoft has outlined a path forward. These entities must configure third-party telecom providers through the Microsoft Security Store. This approach effectively outsources the management and delivery of SMS and voice authentication, allowing organizations to retain these methods while shifting the direct operational responsibility and security management to a specialized provider. This strategy acknowledges that a complete and immediate eradication of phone-based authentication may not be feasible for all organizations, offering a conditional extension under specific management frameworks.
The Strategic Shift Towards Passkeys as the Default Authentication Method
The push to retire SMS and voice authentication is intrinsically linked to Microsoft’s strategic embrace of passkeys as the default authentication experience for Entra ID. This significant change began its rollout in July, with passkeys slated to become the primary authentication method for the Entra ID enterprise identity service starting in September.
As this rollout progresses across individual organizations, users who are currently enabled for SMS or voice authentication will automatically be transitioned to passkey registration. The next time these users are prompted for multi-factor authentication, they will receive a directive to register a passkey. This automated enablement is designed to streamline the migration process and encourage wider adoption of the more secure passkey technology.
Following this phased transition, the official retirement of Microsoft-provided telecom delivery for SMS and voice authentication is scheduled for February 1, 2027. At this juncture, SMS and voice will cease to be offered as native capabilities within Microsoft Entra ID. This signifies a definitive end to Microsoft’s direct support for these authentication methods within its flagship identity management service.
The company’s commitment to enhancing security has also led to the discontinuation of other less secure authentication practices. In August, Microsoft retired SMS as a first-factor sign-in method for Microsoft Entra ID Free tenants. This decision was driven by the escalating risks of phishing, fraud, and account compromise associated with SMS-based initial authentication. Furthermore, Microsoft has ceased enabling SMS first-factor sign-in for newly created tenants, preemptively preventing the adoption of this insecure method from the outset.
Understanding the Risks of SMS and Voice Authentication
The vulnerabilities inherent in SMS and voice authentication are well-documented and pose significant threats to organizational security.
-
Phishing Attacks: Both SMS and voice calls are susceptible to phishing. Attackers can impersonate legitimate entities, such as Microsoft or banks, and trick users into revealing their one-time passcodes (OTPs) or other sensitive information. This can be achieved through deceptive text messages (smishing) or fraudulent phone calls. Once an attacker obtains an OTP, they can bypass MFA and gain unauthorized access to an account.
-
SIM-Swap Fraud: This attack vector involves an attacker convincing a mobile carrier to port a victim’s phone number to a SIM card controlled by the attacker. Once this is achieved, all incoming calls and SMS messages, including authentication codes, are rerouted to the attacker. This allows them to intercept sensitive information and compromise accounts that rely on SMS or voice-based MFA. The Federal Communications Commission (FCC) has reported a significant increase in SIM-swap fraud cases, highlighting the growing prevalence of this threat.
-
Man-in-the-Middle Attacks: While less common than phishing or SIM-swapping for SMS/voice, sophisticated attackers can potentially intercept communications. In some scenarios, if the communication channel is not adequately secured, an attacker could intercept the authentication codes.
-
Lack of Cryptographic Security: Unlike modern authentication methods like FIDO2 or passkeys, SMS and voice calls transmit authentication codes over insecure channels. There is no end-to-end encryption to protect the codes during transmission, making them vulnerable to interception.
-
User Convenience vs. Security Trade-off: Historically, SMS and voice authentication were favored for their perceived convenience. They leveraged existing infrastructure (mobile phones) and did not require users to carry or manage separate hardware tokens or install new software. However, this convenience comes at a steep security price, which organizations can no longer afford to overlook given the current threat landscape.
The Evolving Landscape of Identity and Access Management
Microsoft’s strategic pivot underscores a broader industry-wide movement towards passwordless and phishing-resistant authentication. The adoption of passkeys and FIDO2 security keys represents a significant leap forward in securing digital identities.
-
Passkeys: Based on the FIDO Alliance standards, passkeys allow users to authenticate using biometric data (fingerprint or facial recognition) or a device PIN. These credentials are cryptographically bound to the website or application and are stored securely on the user’s device. They are inherently phishing-resistant because they are not transmitted over networks and cannot be reused across different sites. Microsoft’s integration of passkeys as a default option is a strong signal of their future in authentication.
-
FIDO2 Security Keys: These are physical hardware devices that provide the highest level of phishing resistance. Users insert the key into their device or tap it wirelessly, and it generates a unique cryptographic signature for each login. They are immune to phishing attacks as they never expose sensitive information. Organizations that require the utmost security often mandate FIDO2 keys for their employees.
-
QR Code Authentication: This method involves scanning a QR code displayed on a login screen with a trusted device. The device then uses pre-established cryptographic keys to authenticate the user, offering a more secure alternative to OTPs.
The Broader Implications for Organizations
The impending retirement of SMS and voice authentication by Microsoft Entra ID has several critical implications for organizations:
-
Enhanced Security Posture: By migrating to phishing-resistant methods, organizations will significantly reduce their attack surface and bolster their overall security posture. This proactive measure can prevent costly data breaches and the associated financial and reputational damage. According to various cybersecurity reports, the average cost of a data breach continues to rise, with identity-related compromises being a significant factor. For instance, IBM’s 2023 Cost of a Data Breach Report indicated that the global average cost of a data breach reached $4.45 million.
-
Reduced Operational Burden: While the migration requires an initial investment of time and resources, it can lead to a reduced operational burden in the long run. Organizations will spend less time dealing with the aftermath of compromised accounts due to phishing or SIM-swap attacks that target legacy authentication methods.
-
Improved User Experience (Potentially): While the initial transition may involve a learning curve for some users, modern authentication methods like passkeys can ultimately offer a more seamless and convenient user experience. Eliminating the need to remember complex passwords or type in one-time codes can streamline the login process.
-
Compliance Requirements: Many regulatory frameworks and industry standards are increasingly emphasizing the need for stronger authentication mechanisms. Migrating away from vulnerable methods can help organizations meet these compliance obligations and avoid penalties.
-
Strategic Planning for Legacy Systems: Organizations that rely heavily on legacy applications that may not natively support modern authentication methods will need to develop a strategic plan for integration or modernization. This could involve using multi-factor authentication gateways or exploring alternative solutions to bridge the gap.
Microsoft has provided extensive documentation to guide administrators through this transition. A dedicated Microsoft Learn page offers detailed guidance on deploying and managing phishing-resistant, passwordless authentication within Entra ID, covering prerequisites, planning, and implementation strategies. This resource is invaluable for IT teams tasked with executing the migration effectively and ensuring a smooth experience for their users.
The February 1, 2027, deadline serves as a clear call to action for Entra ID administrators. Proactive planning, user education, and timely migration to phishing-resistant authentication methods are paramount to safeguarding organizational data and maintaining uninterrupted access in an increasingly complex cybersecurity landscape. The move away from SMS and voice authentication is not merely a technical update; it represents a fundamental shift towards a more secure and resilient digital future.
