Microsoft to retire Entra ID Microsoft-provided SMS and voice MFA on February 1, 2027, pushing admins to passkeys
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:04; os links antigos trazem para cá.
Microsoft will begin retiring Microsoft-provided SMS and voice authentication in Microsoft Entra ID on February 1, 2027, and has again urged administrators to move users to phishing-resistant methods, with passkeys as the recommended replacement (bleepingcomputer.com). The reminder was issued on October 27 as Message Center notification MC1528000, covering Worldwide and Government Community Cloud (GCC) environments, with rollout expected to finish in early February (gbhackers.com). It follows announcements from July 2026 and an earlier reminder in September (gbhackers.com, bleepingcomputer.com). The change applies only to Entra ID workforce tenants, not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios (bleepingcomputer.com). Microsoft cites phishing and SIM-swap attacks as the main reasons. Organizations should treat February 1, 2027 as the migration deadline, and those that do not use Microsoft-provided SMS or voice authentication need take no action (gbhackers.com).
Detalhes técnicos
- The retirement targets Microsoft's delivery service, not every implementation of SMS or voice authentication in Entra ID (gbhackers.com).
- Alternatives include passkeys, QR code authentication, FIDO2 security keys and other supported Entra ID sign-in methods (bleepingcomputer.com).
- Users with another registered sign-in method keep using it and are not forced to register a passkey. Accounts whose only method is SMS or voice get one final telephone-based verification, then must register a passkey to keep signing in (gbhackers.com).
- Passkeys use public-key cryptography: the authenticator signs a challenge with its private key and Entra verifies it with the registered public key. This binds authentication to the legitimate service and reduces exposure to credential phishing (gbhackers.com).
- In SIM-swap attacks, criminals move a victim's number to a SIM they control and can intercept authentication messages and calls. Moving delivery to another telecom provider does not remove these weaknesses (gbhackers.com).
- Organizations that must keep phone-based authentication can configure Choose Your Own Telephony Provider (CYOT) through the Microsoft Security Store, available from October 30, 2026. The chosen provider delivers messages or calls, while Entra still enforces authentication-method policies. Customers manage provider selection, agreements, coverage and monitoring. Existing customer-managed telecom configurations are unaffected (gbhackers.com, bleepingcomputer.com).
- In July, Microsoft announced that passkeys would become the default authentication experience in Entra ID from September. As the rollout reaches each organization, users enabled for SMS or voice are automatically enabled for passkeys and are prompted to register one at their next MFA (bleepingcomputer.com).
- In August, Microsoft retired SMS first-factor sign-in for Entra ID Free tenants and stopped enabling it for new tenants, citing phishing, fraud and account compromise risks (bleepingcomputer.com).
- gbhackers.com notes reported passkey enrollment phishing campaigns that use migration-themed messaging to register attacker-controlled credentials.
Remediação
- Migrate all users to a phishing-resistant method, or configure CYOT, before February 1, 2027 (bleepingcomputer.com, gbhackers.com).
- Inventory affected users and prioritize accounts whose only method is SMS or voice (gbhackers.com).
- Admins with the Authentication Policy Administrator, Global Reader or Security Reader roles can identify users with SMS or voice authentication using the Entra SMS/Voice Policy Scanner PowerShell script (bleepingcomputer.com).
- Give helpdesk teams clear instructions on the deadline and on mandatory passkey enrollment for telephone-only users (gbhackers.com).
- Communicate about the migration through trusted channels to counter migration-themed phishing (gbhackers.com).
- Use Microsoft's documentation on deploying and managing phishing-resistant passwordless authentication in Entra ID (bleepingcomputer.com).
Relatos divergentes
- bleepingcomputer.com says users still relying on SMS or voice will not be able to complete MFA after the retirement. gbhackers.com is more specific: only accounts with no other method are affected, and they get one last phone-based verification before having to register a passkey. The two are compatible, and the gbhackers.com account is more detailed and more recent.
- Sources cite different earlier notices: a September reminder (bleepingcomputer.com) and July 2026 announcements (gbhackers.com). Both are consistent with the July announcement and later reminders described in the sources.
Linha do tempo
-
Microsoft to retire Entra ID SMS and voice authentication on February 1, 2027, pushing passkeys
ler a análise desta fonte ocultar
Microsoft will begin retiring Microsoft-provided SMS and voice authentication in Microsoft Entra ID on February 1, 2027. The change covers Worldwide and Government Community Cloud (GCC) environments, with rollout expected to finish in early February. The October 27 reminder, published as Message Center notification MC1528000, follows announcements issued in July 2026. Microsoft cites phishing and SIM-swap attacks as the main reasons and recommends passkeys as a phishing-resistant replacement. Organizations should treat February 1 as the migration deadline.
Technical Details
- The retirement targets Microsoft's delivery service, not every implementation of SMS or voice authentication in Entra ID.
- Users with another registered sign-in method keep using it and are not forced to register a passkey.
- Accounts whose only method is SMS or voice get one final telephone-based verification, then must register a passkey to keep signing in.
- Passkeys use public-key cryptography: the authenticator signs a challenge with its private key and Entra verifies it with the registered public key. This binds authentication to the legitimate service and reduces exposure to credential phishing.
- In SIM-swap attacks, criminals transfer a victim's number to a SIM they control and can intercept authentication messages and calls. Moving delivery to another telecom provider does not remove these weaknesses.
- Organizations that must keep telephone authentication can configure Choose Your Own Telephony Provider (CYOT) through the Microsoft Security Store, available from October 30, 2026. The chosen provider delivers messages or calls, while Entra still enforces authentication-method policies. Customers manage provider selection, agreements, coverage and monitoring.
- Existing customer-managed telecom configurations are unaffected.
- The article notes reported passkey enrollment phishing campaigns that use migration-themed messaging to register attacker-controlled credentials.
Remediation
- Inventory affected users and prioritize accounts whose only method is SMS or voice.
- Complete passkey registration, or CYOT configuration, before February 1, 2027.
- Give helpdesk teams clear instructions on the deadline and on mandatory passkey enrollment for telephone-only users.
- Communicate about the migration through trusted channels to counter migration-themed phishing.
- Organizations that do not use Microsoft-provided SMS or voice authentication need take no action.
-
Microsoft reminds Entra ID admins to migrate users to passkeys before SMS and voice MFA retire on February 1, 2027
ler a análise desta fonte ocultar
Microsoft has again urged Entra ID administrators to move users to phishing-resistant authentication before it retires Microsoft-provided SMS and voice authentication starting February 1, 2027. Users still relying on these methods will not be able to complete multifactor authentication after the retirement. The change applies only to Entra ID workforce tenants, not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Microsoft says SMS and voice are vulnerable to phishing and SIM-swap attacks and recommends passkeys. The notice was published in a Microsoft 365 Message Center update and follows an earlier reminder in September.
Technical Details
- Alternatives to SMS and voice include passkeys, QR code authentication, FIDO2 security keys and other supported Entra ID sign-in methods.
- Organizations that must keep phone-based authentication can configure a customer-managed telecom provider (CYOT) through the Microsoft Security Store.
- In July, Microsoft announced that passkeys would become the default authentication experience in Entra ID from September. As the rollout reaches each organization, users enabled for SMS or voice are automatically enabled for passkeys and are prompted to register one at their next MFA.
- In August, Microsoft retired SMS first-factor sign-in for Entra ID Free tenants and stopped enabling it for new tenants, citing phishing, fraud and account compromise risks.
Remediation
- Migrate all users to a phishing-resistant method before February 1, 2027.
- Admins with the Authentication Policy Administrator, Global Reader or Security Reader roles can identify users with SMS or voice authentication using the Entra SMS/Voice Policy Scanner PowerShell script.
- Use Microsoft's documentation on deploying and managing phishing-resistant passwordless authentication in Entra ID.