When will SMS and voice calls be phased out of Microsoft MFA?
The change will be implemented in stages. From 1 September 2026, Microsoft will automatically start enabling passkeys for users who have SMS or voice calls enabled.
That 1 February 2027 Microsoft will cease providing SMS and voice calls as a method of authentication.
This means that companies which currently rely on these methods need to be prepared before the change comes into force.
Why is Microsoft changing MFA?
Text messages and voice calls do not offer the same protection against modern cyber threats as phishing-resistant authentication methods. Among other things, text messages can be vulnerable to phishing, SIM swapping and other types of account attacks.
Microsoft is therefore moving towards passkeys and other more secure authentication methods to strengthen the protection of user accounts, Microsoft 365 and the company’s cloud services.
How is your business affected?
If users within the organisation currently use SMS or voice calls for MFA, this change may affect how they sign in to Microsoft 365 and other services that use Microsoft Entra ID.
The extent of the impact will depend on how your Microsoft environment is currently configured.
It is therefore important to find out whether you are affected and what the change will mean for your specific IT environment before Microsoft carries out the transition.
Do you need help with Microsoft MFA and Entra ID?
Are you unsure which authentication methods you currently use, or how Microsoft’s changes will affect your organisation? We help businesses with Microsoft 365, Microsoft Entra ID, MFA, IT security and cyber security.
Please get in touch and we’ll go through how the change will affect you and help you prepare your organisation for Microsoft’s new requirements.
Contact us at