Microsoft Entra ID SMS MFA retirement forces passkey or third-party shift

Microsoft Entra ID is discontinuing native support for SMS and voice multi-factor authentication, a move that directly impacts identity management operations. According to a report by Neowin, this retirement is necessitated by the significant phishing risks inherent in these older verification methods. Organizations relying on these default options must now transition to more secure alternatives, such as passkeys, or integrate third-party telecom providers to ensure continuous user access and avoid operational lockouts.

The risk

The primary security concern driving this change is the vulnerability of SMS and voice calls to phishing attacks. These methods are increasingly targeted by adversaries who can intercept or redirect verification codes, bypassing traditional multi-factor protections. By removing native support for these channels, Microsoft aims to reduce the attack surface available to threat actors. However, this shift introduces an operational risk for organizations that have not yet prepared alternative authentication workflows, potentially leading to service disruptions if users are unable to verify their identities during the transition period.

Who is exposed

Any organization utilizing Microsoft Entra ID for identity and access management is exposed to this change. Specifically, teams that have relied on the default SMS or voice multi-factor authentication options for their workforce will be directly affected. Users who have not configured alternative authentication methods, such as passkeys or authenticator apps, face the risk of account lockout once the native support is fully retired. This affects both internal employees and external partners who may depend on these legacy verification methods to access corporate resources and cloud services.

Cost and compliance

The source material does not provide specific details regarding the financial costs associated with this transition or its direct impact on regulatory compliance frameworks. Organizations will need to evaluate the internal costs of migrating to passkeys or the potential subscription fees for third-party telecom providers. Compliance implications may vary depending on industry-specific regulations that mandate certain authentication standards, but the source does not specify how this change aligns with or disrupts existing compliance obligations for affected enterprises.

What happens next

Managers should immediately audit their current multi-factor authentication configurations to identify reliance on SMS or voice methods. Teams must plan the deployment of passkeys or evaluate third-party telecom providers to replace the retired native options. Communicating this change to all users is essential to prevent confusion and ensure a smooth transition before the native support is fully discontinued, thereby avoiding unexpected access issues.

Questions to ask your suppliers

Leadership should ask identity vendors whether their solutions support passkeys and how they handle legacy SMS fallbacks. IT directors need to determine if third-party telecom integrations are required and who manages the associated costs. Security teams must verify that new authentication methods meet internal policy requirements. Human resources should be informed to help guide employees through the transition. Procurement should review vendor contracts for any changes in service levels. This ensures all operational aspects are covered.

Background: Phishing

Phishing is not just about fake links or poor spelling. It exploits human psychology, bypasses technical filters through legitimate channels, and targets individuals regardless of their technical skill. Relying solely on software leaves critical gaps that human verification and multi-factor authentication must fill.

Read the full guide: Phishing Myths Debunked: Why Common Beliefs Leave You Vulnerable

What to do and how to stay safe: Microsoft Entra ID

• Inventory all user accounts currently relying on SMS or voice multi-factor authentication to assess the scope of the impact.
• Evaluate the feasibility of deploying passkeys across your organization, considering device compatibility and user training requirements.
• Research third-party telecom providers that can offer secure SMS or voice authentication if passkeys are not immediately viable for all users.
• Develop a communication plan to inform users about the upcoming changes and provide clear instructions on setting up alternative authentication methods.

Step-by-step guide: Implement MFA for Cloud Accounts: A Step-by-Step Rollout Plan

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why is Microsoft removing SMS authentication from Entra ID?

Microsoft is retiring native SMS and voice MFA due to the high phishing risks associated with these methods, as reported by Neowin.

What are the alternatives to SMS MFA in Entra ID?

Organizations must adopt passkeys or bring in third-party telecom providers to replace the retired native SMS and voice authentication options.

What happens if an organization does not switch from SMS MFA?

Users may face account lockouts if they cannot authenticate using the remaining supported methods, such as passkeys or third-party integrations.