Microsoft to Block SMS and Voice Authentication in Entra ID

Microsoft has warned administrators to stop using SMS- and voice-based authentication in Microsoft Entra ID, saying the methods are too vulnerable to phishing, SIM-swapping, replay attacks, and increasingly effective AI-assisted social engineering. The company will begin prompting Entra users who still rely on phone-based verification to register a passkey starting September 1, with Microsoft positioning passkeys and Microsoft Authenticator as phishing-resistant, passwordless alternatives.

Microsoft plans to permanently disable SMS and voice verification for all Entra ID accounts on February 1, 2027, with no tenant opt-out reported. The company is also moving to phase out text-based verification and account recovery for personal Microsoft accounts, though it has not announced a final consumer cutoff date. The shift is expected to force organizations to update onboarding and recovery processes, support users on older devices, and reduce the risk of account compromise tied to phone-based authentication.