Microsoft Ending Text and Voice Call Multi-Factor Authentication (MFA) Delivery Choices
Microsoft has announced plans to retire its built-in SMS text message and voice call delivery for Multifactor Authentication (MFA) in Microsoft Entra ID, marking a significant shift toward more secure, phishing-resistant authentication methods.
As of September 1st, 2026, Microsoft began encouraging eligible users to register passkeys, which are becoming the company’s preferred MFA method.
Why Microsoft is retiring text and voice MFA
The move comes as cybercriminals increasingly target traditional MFA methods through tactics such as phishing, social engineering, and SIM-swapping attacks.
According to Microsoft, SMS and voice-based authentication no longer provide the level of protection needed against modern identity threats. Passkeys offer stronger security by leveraging device-based authentication such as biometrics or PIN verification.
The timeline
For most organizations and standard users, Microsoft-provided SMS and voice authentication will be retired on February 1, 2027.
Organizations that still require text messages or phone calls for MFA will need to configure a third-party telephony provider through the Microsoft Security Store. Global Administrators and external users have an extended deadline until July 1, 2027.
How to prepare
Businesses should begin reviewing their current MFA deployment now and identify users who still rely on text messages or phone calls for verification.
Transitioning to passkeys, Microsoft Authenticator, Windows Hello for Business, or other phishing-resistant authentication methods can help improve security while avoiding disruption when the retirement dates arrive.
As cyberattacks continue to evolve, Microsoft’s decision reflects a broader industry trend away from phone-based authentication and toward stronger identity protection designed to withstand modern threats.
Questions? Click here to contact Catalyst IT.