Microsoft to End SMS and Voice Sign-In for Entra ID by February 2027

Key points

• Microsoft will stop accepting SMS-based and voice-call verification for Entra ID in February 2027.
• Entra ID administrators must migrate affected users to passkeys or other supported credentials.
• Incomplete migrations may cause sign-in interruptions for staff and students.
• No CVE is associated with this change; it is a planned authentication lifecycle shift.

Microsoft has set February 2027 as the point when Entra ID will no longer accept text-message codes or voice-call verification as authentication methods. The change affects tenant administrators and the end users they manage, and it is a planned lifecycle shift rather than a response to a vulnerability. No CVE has been assigned.

Administrators will need to inventory accounts still relying on those older methods and move them to passkeys or other supported credentials. Because the cutoff is organization-wide, incomplete migrations can produce login interruptions for staff and students who have not enrolled in a replacement method.

For K-12 districts, the operational risk is concentrated in help-desk load and account recovery. Users who depend on phone-based verification may need extra support to register a passkey, especially on shared devices or where accessibility needs require additional planning. Early communication and tested enrollment workflows will reduce last-minute disruption.

The shift aligns with a wider move toward phishing-resistant credentials, but the immediate task is local migration. IT teams should treat the date as a planning deadline: identify affected populations, prioritize privileged accounts, and schedule user communications well before the 2027 cutoff.

Watch for Microsoft guidance updates, tenant-level reports on authentication method usage, and any timeline clarification. Districts should also monitor enrollment progress and help-desk trends so that remaining SMS or voice-dependent accounts are addressed before support ends.

What to do now

1. Use Entra ID authentication-method reports to identify accounts still registered for SMS or voice verification.
2. Migrate privileged and administrator accounts to passkeys first, then move standard user populations in phases.
3. Pilot passkey enrollment with a small group and document help-desk procedures before broad rollout.
4. Set a migration schedule with milestones ahead of February 2027 and track completion by school or department.
5. Communicate the change to users early and provide clear enrollment instructions and support sessions.
6. Review account recovery and access policies to prevent lockouts when legacy phone-based methods are removed.
7. Assess shared-device and accessibility needs, and confirm which supported alternatives are available for affected users.

Original source

BleepingComputer