Entra ID SMS and Voice Authentication Retirement 

Microsoft Entra ID is undergoing one of its most significant identity security shifts: making passkeys the default authentication experience and retiring native, Microsoft-provided SMS and voice authentication. This represents a move away from phishable shared secrets toward cryptographic, FIDO2-based phishing-resistant standards.

Here is what the retirement roadmap looks like, what automatic passkey enablement actually does, how to execute a temporary opt-out via the Graph API to buy time for your end customers, and how to deploy the opt-out setting to multiple tenants at scale using Plentics.

Timeline

Microsoft’s deprecation strategy occurs across three main milestones:

• September 1, 2026 – Automated Migration Begins:
  Tenants with users enabled for SMS or voice, those users are auto-enabled and nudged for Passkey registration upon MFA sign-in.
• October 30, 2026 – Third-Party Telecom Integration Opens:
  Customers who need to continue using SMS or voice will be able to select and configure a telecom provider from the Microsoft Security Store.
• February 1, 2027 – Hard Retirement & Enforcement:
  Native Microsoft-provided SMS and voice authentication shuts off completely. Users who rely solely on telephony MFA will hit a mandatory, non-skippable passkey registration prompt upon sign-in.

What This Change Means

The Retirement of Native Telephony

Microsoft will no longer act as the underlying telecom delivery provider for SMS codes or phone calls. If your organization must retain SMS/voice MFA for specific edge-case users post-February 2027, you must onboard a partner telecom carrier through the Microsoft Security Store and absorb the associated per-message operational costs.

Passkeys by Default

Beginning September 1, 2026, Microsoft introduces Passkey Dynamic Migration. Rather than forcibly creating passkeys, Entra ID will:

1. Auto-enable the Passkey (FIDO2) policy for users relying on SMS/voice.
2. Target those users with an Entra-managed Registration Campaign.
3. Prompt users at sign-in with a registration “nudge” (which users can initially snooze).

Once registered, Entra ID works alongside System-Preferred Authentication to offer the passkey first on subsequent authentications.

What the Temporary Opt-Out Means

Organizations often need time to update internal documentation, align help desk processes, or deploy hardware security keys. To accommodate this, Microsoft allows a temporary opt-out from the automatic September 1, 2026 rollout.

What Opt-Out Does:

• Pauses Microsoft’s automated policy modification on September 1, 2026
• Prevents Microsoft from automatically putting SMS/voice users into a Microsoft-managed passkey Registration Campaign
• Gives identity teams granular control to roll out passkeys on their own timeline between September 2026 and February 2027

What Opt-Out Does Not Do:

• It does NOT extend native SMS or voice MFA past February 1, 2027
• It is not a permanent exemption. On February 1, 2027, native SMS/voice will stop working across all tenants regardless of opt-out status

How to Temporarily Opt-Out via Microsoft Graph

To temporarily opt-out from the automatic passkey enablement and registration campaign, you need to use Graph API to set passkeyDynamicMigration property to true. Simplest way to do this is to use Graph Explorer:

1. Create a new PATCH request to https://graph.microsoft.com/beta/authenticationMethodsPolicy
2. Add Request body:
   • { “optOutSettings”: { “passkeyDynamicMigration”: true } }
3. Add Request Headers:
   • Key: Content-Type
   • Value: application/json
4. Navigate to Modify Permissions tab and ensure Graph Explorer has Policy.ReadWrite.AuthenticationMethod permissions to your tenant
5. Run query

You can verify that the passkeyDynamicMigration value has been changed to true by running a GET query and reviewing the response:

Temporarily Opt-Out at Scale with Plentics

With Plentics Tenant Management, you can deploy the opt-out setting across your customer tenants:

1. Update the opt-out setting to your template tenant with the instructions from the previous step
2. Navigate to Plentics portal -> Tenant Management -> Create configurations
3. Select your template tenant as a source tenant
4. Select Authentication Methods Policy from the configuration list
   • Do notice that the configuration also includes Registration campaign and Settings from Microsoft Entra Admin Center → Security → Authentication methods page.
5. Select target tenant(s) and confirm

Summary & Next Steps

The retirement of native SMS and voice authentication marks a critical point in modern identity architecture. Transitioning from phone-based authentication to phishing-resistant passkeys eliminates the single largest vector for credential compromise while drastically improving the user sign-in experience.

Whether you let Microsoft auto-enable passkeys or temporarily opt out via the Graph API to execute a phased rollout, the destination remains the same: native telephony MFA will cease functioning on February 1, 2027. Identity teams should leverage the temporary opt-out window to audit legacy user dependencies, update helpdesk workflows, and drive controlled FIDO2 adoption long before the hard enforcement deadline.