Microsoft retires SMS login for business accounts by 2027

Microsoft is officially retiring the ability to use a text message as the first step to log in to business accounts, according to a recent announcement. The company says it will retire SMS first-factor sign-in for Microsoft Entra ID starting in February 2027.

If your business uses Microsoft Entra ID for work, this changes how you prove who you are. You can no longer use a text message to start the login process. You need to switch to a more secure method before that deadline to avoid being locked out.

Microsoft is rolling out passkeys as the default authentication method for Entra ID. This means users who currently use SMS or voice will be prompted to register a passkey the next time they sign in. A passkey is a digital key that lives on your device, like a phone or laptop.

The company already ended SMS first-factor sign-in for free tenants in August due to phishing risks. This change applies only to workforce tenant authentication scenarios. It doesn’t affect customer identity scenarios for services like Azure AD B2C or Microsoft Entra External ID.

What to check this week

If your office relies on Microsoft Entra ID, here’s what you should do now.

• Check if your organization uses SMS sign-in by running the Entra SMS/Voice Policy Scanner PowerShell script. You need Global Reader, Authentication Policy Administrator, or Security Reader roles to run this. (Microsoft)
• Migrate users to supported alternatives like passkeys, QR code authentication, or FIDO2 security keys based on their specific work scenarios.
• If your organization must continue using phone-based authentication, configure third-party telecom providers through the Microsoft Security Store.

We’d rather you turned on passkeys and complained about the extra step than got locked out later. It’s a boring fix, but it works.

Sources: BleepingComputer.