Microsoft Entra’s SMS MFA Retirement: Why Passkeys Are Becoming the Enterprise Default

Microsoft’s Entra ID documentation now lays out a clear transition away from Microsoft-provided SMS and voice authentication. According to the Microsoft Learn page, passkeys become the default authentication experience for affected users on September 1, 2026, and Microsoft-provided SMS and voice delivery is scheduled for retirement on February 1, 2027.

This does not mean every online service will stop using SMS OTP. It does mean one of the biggest enterprise identity platforms is treating SMS and voice as weaker authentication channels and pushing organizations toward phishing-resistant methods.

What passkeys change

Passkeys use cryptographic credentials instead of shared secrets. A user signs in with a device-bound or synced credential, often unlocked with biometrics or a device PIN. This makes common attacks harder because a scammer cannot simply ask for a six-digit code and reuse it on a phishing page.

Microsoft’s guidance also mentions resistance to SIM-swap and replay attacks. That is the core issue with SMS-based MFA: whoever controls the number at the time of verification may be able to complete the login.

What this means for businesses

Businesses should start separating low-risk verification from high-risk account access. SMS can still be useful for phone-number confirmation, onboarding, alerts, and fallback scenarios. But admin accounts, financial accounts, developer consoles, and customer data systems deserve stronger authentication.

For teams building products, this shift changes testing priorities. You still need to test SMS delivery, phone-number formatting, retry limits, blocked numbers, and user experience. You also need to test passkey enrollment, recovery, device migration, and support workflows.

Practical takeaways

• Audit where SMS or voice is the only MFA method for important accounts.
• Move high-risk users to passkeys, hardware keys, or authenticator-based methods.
• Keep SMS verification clear, rate-limited, and protected from social engineering.
• Test recovery flows so users are not locked out when they change phones.
• Use virtual numbers responsibly for QA and legitimate verification testing.

Where BillioPlus fits

BillioPlus remains useful for developers and businesses that need to test SMS login, onboarding, and OTP delivery across services. The broader industry direction is not “never use SMS.” It is “do not rely on SMS alone for your most sensitive authentication.”

Sources

• Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication