Microsoft admits SMS and voice MFA can’t stop AI attacks, mandates passkeys in Entra by February 2027

Microsoft is still on the path to make one of its most consequential identity security transitions in years, and IT admins should treat this news as a countdown rather than a suggestion from the company.

As we’ve reported, Microsoft’s timeline is fixed, and the company seems ready to enforce its switch from SMS and voice authentication methods to Passkeys to mitigate an ever-expanding threat landscape.

According to the latest Microsoft Intra Authentication blog post, the company has seen SMS and voice authentication become less of a security vault and more of a liability in the age of AI.

AI has changed the economics of phishing and socially engineered attack vectors by leveraging fake sign-in pages, automating credential theft, and running SIM-swap operations at scale, and in half the time.

Microsoft has been making this argument for years, not just since AI accelerated things. Alex Weinert, the company’s identity security lead, wrote back in 2020 that SMS is roughly 40% less effective at stopping bad actors compared to the Microsoft Authenticator app, based on Microsoft’s own MFA research at the time. The issue has only widened since, which is partly why the company is finally cutting the cord.

Microsoft’s solution: Passkeys.

Microsoft believes that Passkeys will help solve this issue by removing shared secrets from the authentication flow, thereby reducing the number of vectors through which unwitting users can deliver Trojan horses.

How Does Passkey Solve Microsoft’s Authentication Problems

Microsoft’s Passkey solution relies on public-key cryptography tied to a user’s device. The kicker is that the private key never leaves the device, so attackers cannot steal it via a fake prompt or a cloned login page.

It’s worth knowing there are two flavors of passkey Entra supports, since the choice affects how you plan a rollout. Synced passkeys live in a platform credential manager like iCloud Keychain or Google Password Manager and follow the user across devices, which suits people who already use one of those ecosystems. Device-bound passkeys are tied to a single piece of hardware, whether that’s Windows Hello for Business, a FIDO2 security key, or the Microsoft Authenticator app. Microsoft’s guidance nudges toward device-bound credentials like FIDO2 security keys for admins and highly regulated users, and synced passkeys for everyone else, which is a reasonable starting point if you’re not sure where to draw the line.

The groundwork for the Passkey transition has been months in the making as Microsoft sprinkles the same sort of authentication across Windows 11 and Microsoft accounts, phasing out SMS codes in the process. Entra is simply the enterprise version of this change catching up.

Entra’s Passkey retirement timeline explained

On September 1, 2026, you will be prompted to register a passkey during your next MFA challenge. On September 18, 2026, Microsoft will publish telecom provider details for organizations that require SMS or voice for regulatory or operational reasons. Then, by October 30, 2026, you will be forced to configure a supported telecom provider through the Microsoft Security Store if you can’t get off telephony-based MFA.

Lastly, on February 1, 2027, Microsoft-provided SMS and voice authentication will officially be dead. Unlike the Windows 10 security patch saga, where public pressure bought consumers an extra year of ESU, Microsoft has been unusually blunt about this one.

The company’s documentation states that there is no opt-out from the February 1 enforcement and that it applies to every tenant, full stop. The one flexibility Microsoft is offering is a temporary opt-out that only covers the period between September 1, 2026 and February 1, 2027, meant to give admins breathing room to finish their migration. API support for that temporary opt-out becomes available August 1, 2026.

Also, you need to know what “dead” means here, since it isn’t an account lockout. After February 1, 2027, anyone whose only registered MFA method is SMS or voice will hit a blocking prompt to register a passkey the next time they sign in. They can’t skip it, and they can’t sign in until they complete it. Data won’t be lost, and the account will not be disabled, but nobody is getting into their account without setting up a passkey first, so this is a problem worth solving before the deadline.

How to prepare your organization for the Passkey shift

As far as you’re concerned, preparation should start now. Your first step is to identify who in your tenant is still using SMS or voice authentication. Fortunately, Microsoft provides a policy scanner to help speed up your investigations.

The scanner Microsoft provides is a PowerShell script published on GitHub, and you’ll need one of the Global Reader, Authentication Policy Administrator, or Security Reader roles to run it. Any tenant that comes back with a non-zero result is in scope for this whole migration.

After identifying the stragglers, you can now get down to business by drafting communications early enough to let them know the shift is on its way. You’ll also have enough time to identify device compatibility and passkey registration support, using Windows Hello for Business, FIDO2 security keys, or platform-stored passkeys on mobile and desktop systems.

The following are the minimum requirements for switching to passkeys:

• Windows 10 22H2 for Windows Hello for Business
• Windows 11 22H2 for the best passkey experience
• macOS 13 Ventura
• iOS 17
• Android 14

Anything older than that can still work through external FIDO2 security keys, but the built-in platform experience won’t be available. If you’re unsure how much of your fleet meets these numbers, Microsoft’s phishing-resistant passwordless deployment guide includes a readiness workbook that pulls this straight from your sign-in logs.

The company also suggests enabling a registration campaign ahead of the September 1 auto-enrolment!

Once you have communications and verified device support, you can start the migration to phishing-resistant methods, or you can contract with your preferred telecom provider to continue using SMS or voice. If your organization has to maintain telephony-based MFA, you’ll need to set your configurations in place before February 2027. As far as we know, Microsoft is dead set on February 2027 as its cutoff date with no extended support lifelines.

Migrating existing SMS and voice users to passkeys costs nothing extra since passkeys are included in every Microsoft Entra plan, but a customer-managed telecom provider through the Security Store is a paid add-on, priced per message and varying by provider and region.

The retirement isn’t limited to standard sign-in either. It covers self-service password reset (SSPR) too, so any SSPR flows that use SMS or voice need the same attention. B2B and guest users are in scope as well, though Microsoft says passkey support for that group is planned to land by the end of 2026, so external users are slightly later. Note that this whole timeline currently applies to public cloud tenants only, with other cloud environments following on a separate schedule Microsoft hasn’t detailed yet.

Microsoft’s decision is a bit of a headache for IT admins and adds another to-do on your list, but it’s designed to be a much smaller and less costly headache than having your whole system succumb to a user-introduced phishing scheme as they become more prevalent thanks to AI.

The post Microsoft admits SMS and voice MFA can’t stop AI attacks, mandates passkeys in Entra by February 2027 appeared first on Windows Latest