Cybersecurity

Microsoft Stops Sending Your MFA Texts in February

Microsoft stops delivering SMS and voice MFA codes in Entra ID on 1 February 2027 and makes passkeys the default from 1 September 2026. The retirement date is fixed, but the price of the only alternative is not published until 18 September, so the migration has to be planned before the fallback can be costed.

CybersecurityBy Servola Tech Desk2026-07-144 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Microsoft Stops Sending Your MFA Texts in February

Key takeaways

Microsoft retires native SMS and voice MFA delivery in Entra ID on 1 February 2027 with no opt-out, and it will not publish the price of the replacement telecom providers until 18 September 2026, so every European organisation has to plan this migration before it can cost the fallback.
From 1 September 2026, users currently enabled for SMS or voice are automatically enabled for passkeys and prompted to register one at their next sign-in. A temporary opt-out covers that window and the API to apply it arrives on 1 August 2026, which is the real date in this announcement.
The staff this strands are the ones without a company phone: shop-floor, shift and contractor accounts that used a texted code precisely because there was no device to enrol. Passkeys need a device or a hardware key, and that is a procurement line, not a policy toggle.

The dates Microsoft has already fixed

Microsoft published the change on 13 July in a security-blog post that reads like a routine identity upgrade, and it carries four dates. From 1 September 2026, every Entra ID user currently enabled for SMS or voice authentication is automatically enabled for passkeys and prompted to register one at their next multifactor prompt. On 18 September, Microsoft says it will name the supported telecom providers, their pricing and their commercial terms in the Microsoft Security Store. From 30 October, administrators can select and configure one of those providers.

The date that ends the argument is 1 February 2027. On that day Microsoft discontinues SMS and voice delivery as a native capability of Entra ID. Tenants that have not contracted a customer-managed telecom provider by then cannot use a texted or spoken code as a second factor at all, and users who depended on one must register a passkey before they can sign in. Microsoft states plainly that after that date there is no opt-out.

A deadline arrives before a price

Read those dates in order and the sequencing is the story. The retirement is fixed for 1 February 2027. The price of the only supported way to keep SMS and voice is not published until 18 September 2026, and cannot be configured until 30 October. An organisation therefore has to decide how it will move tens of thousands of authentication events before it can put a number on the alternative to moving them.

This is not a security decision dressed up as a billing one. It is both at once. A capability that shipped inside the Entra licence becomes, for anyone who still needs it, a contracted purchase from a third-party carrier through Microsoft's marketplace. The phishable method is being removed, which is defensible, and the supported way to keep it becomes a procurement exercise with a supplier, a contract and a cost that nobody outside Microsoft can quote yet.

The accounts that break have no phone

Passkeys assume a person has a device they control and can authenticate on with a biometric or a PIN. Most desk-based staff do. The accounts that leaned on a texted code are frequently the ones that do not: warehouse and shop-floor workers on shared terminals, shift staff with no company handset, seasonal and contract workers, and field engineers whose personal phone was never enrolled in anything. SMS was the lowest-common-denominator second factor precisely because it required no enrolment and no managed device.

Replacing it for those users means issuing something, either a managed phone or a FIDO2 hardware key per head, and that is a capital line and a logistics job rather than a settings change. In the UK the NCSC has spent years urging organisations off SMS codes towards phishing-resistant methods, so the direction is not a surprise. The bill for the last mile of users is. That decision is not one an identity administrator can take alone in the final week of January 2027.

What to settle before 1 August

The useful deadline is not February. Microsoft's own guidance puts the temporary opt-out for the September-to-February window, and the API needed to apply it, at 1 August 2026. That is roughly two weeks away, and it is the moment an organisation needs an answer to one question: do we let the passkey rollout begin on 1 September, or do we hold it while we work out who cannot be enrolled?

Answering that needs a count, not an opinion. Pull the list of accounts whose only registered method is SMS or voice, split it into people who own an enrollable device and people who do not, then price the second group. If the number is small, take the rollout and finish early. If it is not, take the opt-out in August, use the autumn to buy keys or handsets, and treat 18 September as the day you learn what the fallback would have cost instead.

Frequently asked questions

Does this mean we are forced onto passkeys?

Not strictly, but the alternatives narrow. After 1 February 2027 Microsoft no longer delivers SMS or voice codes itself. You can keep them only by contracting a supported telecom provider through the Microsoft Security Store, whose pricing Microsoft says it will publish on 18 September 2026. Other phishing-resistant methods, including authenticator apps and FIDO2 security keys, remain available. What disappears is the free, native texted code.

Can we delay the September rollout?

For that window, yes. Microsoft's documentation describes a temporary opt-out covering 1 September 2026 to 1 February 2027, with API support and instructions arriving on 1 August 2026. It buys time to enrol people rather than an exemption, because the February retirement applies either way.

Why remove a method that still works?

Because it works for attackers too. Microsoft cites its Digital Defense Report 2025, which found AI-enabled phishing campaigns reaching click-through rates as high as 54 per cent against roughly 12 per cent for traditional campaigns. A texted code is a shared secret that a convincing page can ask for and a person can hand over. Microsoft's framing is that passkeys rely on public-key cryptography rather than shared secrets, which makes them phishing-resistant by design.

Microsoft is retiring the weakest second factor it ships, and on the security merits it should. The point to be clear-eyed about is that the announcement fixes the day the option disappears while leaving the price of keeping it unpublished for another two months. Count the accounts that have nothing attached to them but a phone number, and do it before August, because that count is the whole decision.

Microsoft Entra IDpasskeysmultifactor authenticationSMS OTPphishing-resistant MFAMicrosoft Security Storeidentity management

18 npm packages, one trusted account

On Jul 8 2026 a trusted contributor's account pushed a backdoor into 18 npm packages through Injective Labs' own OIDC pipeline. Here is what owners should check.

2 min read

Cybersecurity

Progress tells ShareFile users to pull the plug

Progress Software told ShareFile customers to physically shut down on-prem Storage Zone Controllers over a credible threat. No patch, no CVE. What owners should learn.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.