Microsoft Kills SMS MFA in Entra ID The Shift to Phishing-Resistant Passkeys Begins.

Microsoft to Phase Out SMS and Voice MFA on Entra ID in Favor of Phishing-Resistant Passkeys

Microsoft has announced a major paradigm shift in enterprise identity security: the gradual retirement of SMS and Voice Call-based One-Time Passwords (OTPs) for Multi-Factor Authentication (MFA) across Microsoft Entra ID (formerly Azure AD). In its place, Microsoft is pushing Passkeys built on FIDO2/WebAuthn open standards as the new default, elevating organizational security to a Phishing-Resistant baseline.

The decision stems from inherent cryptographic and architectural vulnerabilities in telecom-based authentication, such as SIM-swapping attacks, SS7/telecom interception, and adversary-in-the-middle (AiTM) phishing. By contrast, Passkeys bind authentication directly to the specific web domain and device, making them immune to standard credential-harvesting attacks.

Enforcement & Transition Timeline

Microsoft has outlined a multi-phase deprecation schedule to give IT administrators time to migrate their user bases:

• August 1, 2026 (Admin Opt-Out Option): Administrators can choose to temporarily disable the automatic Passkey registration prompts for end-users before the soft rollout begins.

• September 1, 2026 (Soft Nudge Phase): Users relying on SMS or Voice MFA will automatically encounter registration prompts during sign-in, encouraging them to set up a Passkey. During this phase, users can still skip the prompt.

• September 18, 2026 (Third-Party SMS Options Disclosed): For organizations with regulatory or operational requirements that mandate SMS, Microsoft will publish a list of supported third-party SMS providers along with integration costs.

• February 1, 2027 (Hard Enforcement & Deprecation): Microsoft-provided SMS and Voice OTP services will be permanently shut down. No opt-out or skip options will remain. Users who have not enrolled an alternative MFA method will be blocked at sign-in until they complete Passkey registration.

To assist IT teams in auditing their tenant readiness, Microsoft has released a dedicated PowerShell script that allows administrators to scan their Entra ID environments for affected user accounts and legacy MFA dependencies.

Why are traditional MFAs no longer sufficient? Traditional OTPs (whether sent via SMS or generated in a TOTP app) are vulnerable to modern proxy phishing toolkits (e.g., Evilginx). These toolkits emulate real-time login sessions and intercept both passwords and OTPs. Passkeys use asymmetric encryption directly linked to the browser's source URL, making them virtually immune to intrusive attacks.

Switching thousands of employees from SMS to an alternative system requires proactive change management. In addition to installing hardware security keys (e.g., YubiKeys) or platform Passkeys (Windows Hello, Apple Touch ID/Face ID), IT administrators should use Microsoft's provided PowerShell scripts to identify high-risk groups early on, gradually roll out Microsoft Authenticator apps or Passkeys to departments, and update their on-premises IT help desk device recovery guidelines.

Allowing integration with external SMS providers will be implemented starting in September. This would provide a significant security boost for sectors with stringent compliance requirements (such as healthcare or government) that might face legal or technical limitations that prevent the immediate full implementation of Passkey. However, organizations opting for an external SMS provider should consider it more of a temporary bridge than a long-term security solution.

 

 

Source: Microsoft Security Blog 

💬 AI Content Assistant

Ask me anything about this article. No data is stored for your question.

Microsoft to Phase Out SMS and Voice MFA on Entra ID in Favor of Phishing-Resistant Passkeys

Microsoft has announced a major paradigm shift in enterprise identity security: the gradual retirement of SMS and Voice Call-based One-Time Passwords (OTPs) for Multi-Factor Authentication (MFA) across Microsoft Entra ID (formerly Azure AD). In its place, Microsoft is pushing Passkeys built on FIDO2/WebAuthn open standards as the new default, elevating organizational security to a Phishing-Resistant baseline.

The decision stems from inherent cryptographic and architectural vulnerabilities in telecom-based authentication, such as SIM-swapping attacks, SS7/telecom interception, and adversary-in-the-middle (AiTM) phishing. By contrast, Passkeys bind authentication directly to the specific web domain and device, making them immune to standard credential-harvesting attacks.

Enforcement & Transition Timeline

Microsoft has outlined a multi-phase deprecation schedule to give IT administrators time to migrate their user bases:

• August 1, 2026 (Admin Opt-Out Option): Administrators can choose to temporarily disable the automatic Passkey registration prompts for end-users before the soft rollout begins.

• September 1, 2026 (Soft Nudge Phase): Users relying on SMS or Voice MFA will automatically encounter registration prompts during sign-in, encouraging them to set up a Passkey. During this phase, users can still skip the prompt.

• September 18, 2026 (Third-Party SMS Options Disclosed): For organizations with regulatory or operational requirements that mandate SMS, Microsoft will publish a list of supported third-party SMS providers along with integration costs.

• February 1, 2027 (Hard Enforcement & Deprecation): Microsoft-provided SMS and Voice OTP services will be permanently shut down. No opt-out or skip options will remain. Users who have not enrolled an alternative MFA method will be blocked at sign-in until they complete Passkey registration.

To assist IT teams in auditing their tenant readiness, Microsoft has released a dedicated PowerShell script that allows administrators to scan their Entra ID environments for affected user accounts and legacy MFA dependencies.

Why are traditional MFAs no longer sufficient? Traditional OTPs (whether sent via SMS or generated in a TOTP app) are vulnerable to modern proxy phishing toolkits (e.g., Evilginx). These toolkits emulate real-time login sessions and intercept both passwords and OTPs. Passkeys use asymmetric encryption directly linked to the browser's source URL, making them virtually immune to intrusive attacks.

Switching thousands of employees from SMS to an alternative system requires proactive change management. In addition to installing hardware security keys (e.g., YubiKeys) or platform Passkeys (Windows Hello, Apple Touch ID/Face ID), IT administrators should use Microsoft's provided PowerShell scripts to identify high-risk groups early on, gradually roll out Microsoft Authenticator apps or Passkeys to departments, and update their on-premises IT help desk device recovery guidelines.

Allowing integration with external SMS providers will be implemented starting in September. This would provide a significant security boost for sectors with stringent compliance requirements (such as healthcare or government) that might face legal or technical limitations that prevent the immediate full implementation of Passkey. However, organizations opting for an external SMS provider should consider it more of a temporary bridge than a long-term security solution.

 

 

Source: Microsoft Security Blog