Microsoft pushes Entra ID admins to adopt passkeys before legacy SMS and voice login end in 2027

Microsoft has issued a fresh advisory to administrators of its Entra ID service, urging them to transition users to passkey‑based authentication before the company phases out SMS and voice verification in February 2027.

The reminder follows earlier communications about the upcoming retirement of these legacy methods, which have long been considered vulnerable to phishing and SIM‑swap attacks. Microsoft says continued reliance on SMS or voice could lead to account lockouts once the features are disabled.

Passkeys, which store cryptographic keys on a device and require biometric or PIN verification, are promoted as a phishing‑resistant alternative. They work across Windows, Android, iOS and macOS and are compatible with the FIDO2 standard that many enterprises already support.

Entra ID administrators are instructed to audit current authentication configurations, identify accounts that still depend on SMS or voice, and enable passkey enrollment through Azure AD Conditional Access policies or the Microsoft Authenticator app. Microsoft also provides migration guides and tooling to automate bulk updates.

The shift aligns with a broader industry move away from knowledge‑based credentials toward passwordless solutions. Major cloud providers, including Google and Apple, have made similar commitments, citing reduced risk of credential theft and lower support costs.

For organizations that cannot immediately adopt passkeys, Microsoft recommends interim measures such as hardware security keys or authenticator apps that generate time‑based one‑time passwords. These methods still meet the company’s definition of “phishing‑resistant” and can buy time while users transition.

The deadline of February 2027 gives enterprises roughly three years to complete the migration. Microsoft has indicated that failure to do so may result in authentication failures for affected users, potentially disrupting access to cloud services, email and other critical workloads.