Microsoft has scheduled customer-managed telephony-provider selection and configuration through Microsoft Security Store to begin Oct. 30, 2026, as Microsoft Entra ID moves users enabled for SMS or voice toward passkeys. Microsoft-provided SMS and voice are scheduled to retire on Feb. 1, 2027 for most users and internal guests, and on July 1, 2027 for Global Administrators and external users.
Passkey enablement is not user registration
Microsoft began automatically enabling passkeys on Sept. 1, 2026 for users enabled for SMS or voice in the Authentication Methods Policy or legacy multifactor authentication settings. That policy change does not register a passkey for each person. Users still need to create one.
The Microsoft-managed registration campaign can prompt users after they sign in and complete multifactor authentication. The prompt is snoozable by default, so automatic enablement does not mean every user has already enrolled.
The retirement date depends on the user group
Microsoft’s schedule sets two dates for retiring its own SMS and voice delivery:
| User group | Scheduled retirement date |
| Most users and internal guests | Feb. 1, 2027 |
| Global Administrators and external users | July 1, 2027 |
After the relevant date, a user whose only available multifactor authentication method is SMS or voice must register a passkey to continue signing in. Users with another available authentication method can use that instead.
Microsoft is retiring its delivery service, not every telephony option
The change covers SMS and voice delivery provided by Microsoft. Organizations with a legitimate business, regulatory, or technical need can use a customer-managed telephony provider through Microsoft Security Store. Microsoft schedules the start of provider selection and configuration for Oct. 30, 2026.
The retirement also applies to SMS and voice used for Microsoft Entra self-service password reset. The published timetable applies to public-cloud environments.
What administrators can plan for
Administrators can identify users enabled for SMS or voice, then distinguish policy enablement from completed passkey registration when planning the transition. Microsoft says passkeys are available across Entra ID editions, including Free, without an additional license.
A temporary Microsoft Graph opt-out can delay automatic passkey enablement and the registration campaign during the transition. It uses the Policy.ReadWrite.AuthenticationMethod permission and the passkeyDynamicMigration policy property; it does not change the applicable retirement deadline.
