Microsoft has again urged administrators using Entra ID to move users to passkeys and other phishing-resistant authentication methods before the company retires SMS and voice authentication in February 2027. For businesses that rely on Microsoft identity services for employee access, the announcement is a practical reminder that legacy multi-factor authentication methods may soon create both security and operational risks.

What happened

According to the report, Microsoft reminded Entra ID administrators that SMS and voice-based authentication are scheduled for retirement in February 2027. The company is encouraging organisations to migrate users to phishing-resistant methods, including passkeys, to avoid potential sign-in disruption once those older options are removed.

Passkeys are designed to replace passwords and weaker second-factor methods with cryptographic authentication tied to a device or security platform. Microsoft has positioned them as a stronger defence against phishing and account takeover than SMS-based codes or voice calls.

Why it matters for European businesses

For many European companies, Entra ID sits at the centre of access to Microsoft 365, cloud applications, internal systems and third-party SaaS tools. A change to supported authentication methods is therefore not just a security update; it can affect day-to-day operations, employee onboarding, helpdesk workload and business continuity.

SMS-based authentication has long been used because it is simple to deploy, but it is also more exposed to phishing, SIM-swapping and social engineering than modern phishing-resistant alternatives. Moving to passkeys or similar methods can reduce account compromise risk, especially for staff handling finance, administration, customer data or privileged IT access.

The timing also matters. Large user migrations often take longer than expected because they involve policy changes, end-user communication, compatibility checks and support for personal and company-managed devices. Businesses that wait too long may face avoidable disruption as the retirement date approaches.

Who may be affected

The change is most relevant for organisations that use Microsoft Entra ID for workforce identity and still depend on SMS or voice for multi-factor authentication. This may include:

• Small and mid-sized businesses using Microsoft 365 with basic or legacy MFA setups
• Companies with frontline or distributed workers who authenticate on mobile devices
• IT teams managing hybrid identity environments or older conditional access policies
• Organisations with regulated data or higher security requirements that need stronger identity assurance
• Digital agencies and service providers administering Microsoft tenants on behalf of clients

Businesses with bring-your-own-device environments may also need to review how passkeys will be deployed across different operating systems, browsers and device types.

What companies should consider

European businesses using Entra ID should treat this as a planning milestone rather than a last-minute technical change. Useful steps may include:

• Audit current authentication methods: identify where SMS and voice are still enabled and which user groups rely on them
• Prioritise high-risk accounts: migrate administrators, finance teams and other sensitive roles to phishing-resistant methods first
• Test passkey rollout: check device compatibility, user experience and recovery processes before broad deployment
• Review support and fallback options: make sure account recovery and onboarding workflows still work when older methods are removed
• Update internal policies and training: explain the security reason for the change and prepare users for new sign-in steps
• Coordinate with suppliers or external IT partners: confirm responsibility for tenant configuration, communications and rollout timing

Microsoft's reminder does not create a new legal requirement by itself, but it does signal an upcoming platform change with clear security and operational consequences. For businesses already strengthening identity controls under broader cybersecurity programmes, the retirement of SMS and voice authentication is another reason to accelerate adoption of phishing-resistant access methods.