Is Microsoft Retiring SMS and Voice MFA? What Australian Businesses Need to Do Before 2027

Microsoft is retiring the SMS and voice authentication delivery it currently provides through Microsoft Entra ID. From 1 February 2027, Microsoft-provided SMS and voice authentication will end for most users, with Global Administrators and external users following a later deadline of 1 July 2027.

This change is part of Microsoft’s move towards stronger, phishing-resistant authentication methods such as passkeys. It does not mean that ordinary SMS messages, phone calls, Microsoft 365 services or Microsoft Teams Calling are being discontinued. It specifically affects how Microsoft Entra ID provides SMS and voice verification for authentication and self-service password reset. The transition has already started. Since 1 September 2026, Microsoft has been automatically enabling passkeys for users who have SMS or voice authentication enabled and prompting them to register a passkey when they sign in.

Businesses should review their existing authentication settings, identify affected users and prepare an alternative before the relevant retirement date. Here’s what the change means and what your organisation should do next.

What Is Microsoft Actually Retiring?

Microsoft is retiring the SMS and automated voice authentication services it provides through Microsoft Entra ID. These methods have traditionally allowed users to verify their identity by receiving a text message with a code or answering an automated phone call.

The retirement covers:

• SMS Verification Codes: Microsoft will stop delivering native SMS codes used for Microsoft Entra ID sign-ins.
• Automated Voice Calls: Users will no longer be able to rely on Microsoft’s native voice calls to complete MFA.
• Self-Service Password Reset (SSPR): The change also affects SMS and voice verification used when employees reset their passwords without contacting IT.

Microsoft is making this change to encourage stronger authentication methods that offer better protection against phishing and other identity-based attacks.

It is important to understand what this announcement does not affect. Microsoft is not discontinuing ordinary SMS messages, mobile phone services, business phone systems or Microsoft Teams Calling. The change specifically relates to Microsoft’s built-in SMS and voice authentication delivery through Entra ID.

You can read Microsoft’s official SMS and voice authentication retirement announcement for the full details. Microsoft has also published frequently asked questions about SMS and voice retirement to help organisations understand the changes.

When Is Microsoft Retiring SMS and Voice MFA?

Microsoft is introducing the retirement in stages, giving organisations time to move affected users to alternative authentication methods.

Date	What happens
1 September 2026	Microsoft automatically enabled passkeys for users who had SMS or voice authentication enabled. Registration prompts began appearing during sign-in after MFA.
1 February 2027	Microsoft-provided SMS and voice authentication is retired for most users.
1 July 2027	The retirement applies to Global Administrators and external users, who have a later deadline.

The September 2026 rollout is already underway. Affected users may receive passkey registration prompts when they next sign in and complete MFA. These prompts are initially snoozable by default.

From 1 February 2027, users covered by the first retirement date will no longer be able to rely on Microsoft’s native SMS or voice delivery. If their only available MFA method is SMS or voice, they will receive a mandatory passkey registration prompt before continuing to sign in.

One important distinction is that internal guest users follow the February 2027 deadline, not the later July deadline. You can review Microsoft’s official MFA retirement timeline for more information about the rollout.

Which Microsoft 365 Users and Businesses Are Affected?

This change affects organisations that use Microsoft Entra ID to manage employee sign-ins and identity verification. If your business relies on SMS or automated voice calls for MFA, you will need to review those settings before the retirement dates.

The users most likely to be affected include:

• Employees Using SMS Verification: Staff who receive Microsoft sign-in codes through text messages.
• Users Relying on Voice Calls: Employees who verify their identity by answering automated phone calls.
• Administrators and Privileged Accounts: Users with elevated access who still depend on SMS or voice authentication.
• Internal Guest Users: Guest accounts within an organisation that use these authentication methods.
• Self-Service Password Reset Users: Employees who use SMS or voice verification when resetting their Microsoft 365 passwords.

Administrators should check both the Microsoft Entra Authentication Methods Policy and any legacy MFA settings to identify users who still depend on these methods. It is also important to understand the different deadlines. Most users, including internal guest users, fall under the 1 February 2027 retirement date. Global Administrators and external users have until 1 July 2027.

Businesses can follow Microsoft’s guidance on identifying users who still use SMS or voice authentication to review their current setup and prepare for the change.

What Can Replace SMS and Voice Authentication?

Microsoft recommends moving towards stronger authentication methods that offer better protection against phishing and account compromise. Businesses have several alternatives to consider, depending on their employees, devices and security requirements.

1. Passkeys

Passkeys are one of Microsoft’s recommended replacement options. They use cryptographic authentication instead of verification codes sent through text messages or phone calls.

Businesses can consider:

• Synced Passkeys: Stored through supported credential managers and available across compatible devices.
• Device-Bound Passkeys: Linked to a specific device rather than synchronised across multiple devices.
• Microsoft Authenticator Passkeys: Registered and used through supported versions of Microsoft Authenticator and compatible devices.

Passkeys are designed to resist phishing, SIM-swap and replay attacks, making them a strong option for organisations looking to improve sign-in security.

2. Windows Hello for Business

Windows Hello for Business allows employees to sign in using supported biometric methods, such as facial recognition or fingerprints, or a PIN linked to their business device.

Unlike an ordinary Windows device PIN, Windows Hello for Business uses an organisation-managed authentication process designed for business environments. It can provide a convenient way for employees to access their work accounts without relying on SMS codes.

3. FIDO2 Security Keys

FIDO2 security keys are physical devices that employees can use to verify their identity when signing in. They provide another phishing-resistant authentication option and can be useful for staff who work across different devices or need a physical alternative to passkeys.

4. External Telephony Providers

Some businesses may have genuine operational, regulatory or technical reasons to continue using SMS or voice authentication.

In these cases, organisations can select a supported telephony provider through Microsoft Security Store. This provides an alternative way to continue using SMS or voice verification after Microsoft’s native service is retired.

Businesses should keep in mind that:

• A supported provider must be selected and configured.
• Provider pricing and usage charges may apply.
• Affected users must be migrated to the alternative service before their applicable retirement date.
• SMS and voice authentication will not continue automatically after Microsoft’s native service is withdrawn.

For further guidance, see Microsoft’s instructions on how to enable passkeys in Microsoft Entra ID.

What Should Your Business Do Before February 2027?

With the first retirement deadline approaching, businesses should review their Microsoft Entra settings and make sure employees have suitable alternatives to SMS and voice authentication.

Here are six practical steps to help your organisation prepare.

1. Identify Employees Using SMS or Voice MFA

Review your Microsoft Entra authentication methods and identify users who still depend on SMS verification codes or automated voice calls.

Include privileged accounts, internal guest users and employees who use these methods for self-service password resets.

2. Choose the Replacement Authentication Method

Decide which authentication methods are suitable for different employees and their devices.

Prioritise passkeys and other phishing-resistant methods where supported. FIDO2 security keys may also be useful for employees who need a physical authentication option.

3. Test the New Authentication Method

Before making changes across the organisation, set up a small pilot group to test the replacement methods.

Check that they work with employee devices, browsers, business applications and existing Conditional Access policies. This can help identify compatibility issues before a wider rollout.

4. Communicate the Changes to Employees

Let employees know why the authentication process is changing, which method they need to register and when they should complete the setup.

Provide clear instructions and allow time for questions. Employees should understand how to sign in and access their accounts once the old methods are retired.

5. Review Password Reset and Account Recovery

Check whether SMS and voice verification are currently used for Microsoft Entra self-service password resets.

Make sure employees have an appropriate alternative for resetting their passwords and recovering account access before removing the existing authentication methods.

6. Arrange a Telephony Provider If SMS or Voice Is Still Required

If your business has a genuine operational, regulatory or technical reason to continue using SMS or voice authentication, review the supported telephony providers available through Microsoft Security Store.

Complete the provider selection, configuration and user migration before the applicable retirement deadline.

If your organisation needs help reviewing its Microsoft 365 environment, Broadconnect’s managed IT services can help with IT support, system management and technology requirements.

For additional guidance, refer to Microsoft’s passkey deployment guidance.

Frequently Asked Questions

Prepare Your Business for Microsoft’s MFA Changes

Microsoft’s retirement of native SMS and voice authentication is an important change for organisations using Microsoft 365 and Microsoft Entra ID. Businesses that still depend on these methods should identify affected users, select suitable alternatives and test their new authentication setup before the applicable deadline. Moving towards passkeys and other phishing-resistant authentication methods can also help strengthen account security and reduce reliance on verification codes sent through text messages or phone calls.

Broadconnect provides managed IT services for Australian businesses, including Microsoft 365 support, ongoing IT assistance, system monitoring and technology implementation. Need help reviewing your Microsoft 365 environment or planning your IT requirements? Speak with Broadconnect about our Managed IT Services.

Call: 1300 880 330
Email: hello@broadconnect.com.au
Follow us on Facebook, LinkedIn, and Instagram for updates and offers.