Entra SMS voice retirement: choose a telephony provider

What changed

Microsoft is retiring its own SMS and voice delivery for authentication. The dates and behaviour below are as Microsoft Learn gives them.

• 1 February 2027: Learn gives this as the retirement date for Microsoft-provided SMS and voice for all users except Global Administrators and external users. Internal guests are in this group.
• 1 July 2027: Learn gives this date for Global Administrators and external users.
• Blocking prompt: Learn says users in scope whose only MFA method is SMS or voice get a blocking prompt to register a passkey from the retirement date. It says there is no opt-out from that behaviour for users in scope of the February date.
• No provider, no SMS or voice: the Learn FAQ says that if no telephony provider is configured, in-scope users can’t use SMS or voice for MFA from their retirement date.
• SSPR too: the FAQ says the retirement applies across Entra, including SSPR. Users can still use SMS and voice for SSPR through a provider from Microsoft Security Store.

Two earlier dates matter as well.

• Learn says that from 1 September 2026, users enabled for SMS or voice (in the authentication methods policy or legacy MFA settings) are auto-enabled for passkeys. The registration campaign is set to Microsoft Managed, with unlimited snoozes by default.
• Learn lists a temporary tenant opt-out from that automatic passkey enablement, covering 1 September 2026 to 1 February 2027. It does not stop enforcement on the retirement dates. Learn says there is no opt-out for enforcement and that it applies to all tenants.

The provider option:

• Learn says the CYOT configuration experience becomes available beginning 30 October 2026. MC1519855 gives the same date for general availability worldwide.
• Soprano and Telesign are named as the initial providers, in Microsoft Security Store. Learn says more are expected by general availability.
• You can configure one provider per channel: one for SMS and one for voice.

Who is affected

• Anyone whose MFA depends on Mobile phone, Alternate Mobile Phone or Office phone methods, or who is enabled for SMS or voice in the authentication methods policy or legacy MFA settings.
• Global Administrators, on the later date. If you are still working out your emergency access design, read break-glass accounts with passkeys.
• Internal guests, who are in the 1 February group. The FAQ says passkey support for B2B and internal guest users is planned by the end of calendar 2026. Check that against your tenant before you rely on it.
• External MFA users, but only if they are also enabled for SMS or voice. The FAQ says external MFA methods themselves are not retired.

Limits to know before you plan:

• The FAQ says the timeline applies to public cloud only.
• Azure AD B2C is unaffected. The FAQ says Entra External ID is changed in a later, separate announcement.
• CYOT covers Entra ID only, not External ID or Azure AD B2C.
• CYOT does not support SMS sign-in as a primary authentication method.

Why it matters

• No quiet fallback. With no provider and no passkey, in-scope users face the blocking prompt, or lose SMS and voice for MFA.
• Provider is your problem. Learn says your organisation is responsible for selecting the provider, reviewing regional coverage and terms, completing the agreement, configuring it for Entra and monitoring the service.
• Extra cost and moving parts. Cost has two parts: the provider’s SMS and voice charges, and a routing function deployed in your own Azure subscription. Microsoft expects the Azure consumption charges to be minimal. Provider pricing varies by provider and region. The FAQ says moving users to passkeys carries no additional cost.
• Resilience is undocumented. The pages do not document a provider SLA or failover, or whether the routing function can run multi-region. Treat that as a design question for the provider and your own architecture.
• Policy still applies. Learn says Entra still enforces authentication method policies when you use a provider. For wider MFA context, see the Conditional Access baseline.

Decide per population

Population	Suggested starting point
Most staff with a smartphone or security key	Passkeys. Microsoft recommends them over SMS or voice.
Users with a documented business, regulatory or technical need for telephony	Provider, scoped to a group.
Global Administrators	Passkeys, with the 1 July 2027 date from Learn. Confirm the date in Message Center.
Internal guests	Plan for 1 February 2027. Check passkey support for them in your tenant.
SSPR-only phone use	Decide separately. The provider route covers SSPR.

Learn lists two passkey types: synced passkeys and device-bound passkeys (Authenticator passkey, Entra Passkey on Windows, FIDO2 security key).

Runbook

1. Find who uses SMS or voice

   Use two sources.

   • Run Microsoft’s PowerShell script, microsoft/entra-sms-voice-usage-analyzer, linked from Learn. It needs one of Global Reader, Authentication Policy Administrator or Security Reader. Follow the usage instructions in the repository for parameters.
   • In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Activity. The Registration and Usage tabs help you see phone method registration and use. Learn says the Activity report needs Entra ID P1 or P2. Read access comes from roles including Reports Reader, Security Reader and Global Reader.

   Learn also says the registration details list excludes disabled and soft-deleted users. Report data can lag by up to 36 hours. Sign-ins satisfied by a token claim are excluded, and MFA enforced by a third-party provider is not counted as MFA. Treat the numbers as a guide, not a final count.

2. Split the list by retirement date

   Mark Global Administrators and external users (1 July 2027 per Learn) separately from everyone else, including internal guests (1 February 2027 per Learn). Record who has a documented need for telephony.

3. Take the passkey route for most users

   Learn describes this as a targeting change on the registration campaign. The default State is already Microsoft Managed, so the thing you change is who the campaign targets.

   1. Sign in to the Microsoft Entra admin center as Authentication Policy Administrator.
   2. Go to Entra ID > Authentication methods > Registration campaign.
   3. Write down the current State and target group in your change record.
   4. Set the target to the group of users enabled for SMS and voice, as Learn describes. Leave State on Microsoft Managed if that is what it shows. If it shows something else, set it to Microsoft Managed.
   5. Save, then reopen Registration campaign. You have it right when State reads Microsoft Managed and the target is the SMS and voice group you chose. If it still shows the old target, the save did not take, so repeat step 4.

   If you are happy with the default tenant-wide behaviour and do not want to target a specific group, steps 4 and 5 need no change. Keep the note from step 3 so you have a record.

   To see whether users are acting on the prompt, return to Entra ID > Authentication methods > Activity and review the Registration tab and the per-user registration details over the following days. Microsoft’s published material does not state which entries show a passkey registration, so confirm what you see in your tenant. Remember the report can lag by up to 36 hours.

   Learn also describes a temporary opt-out from automatic passkey enablement, using a Microsoft Graph beta PATCH on the authentication methods policy to set optOutSettings.passkeyDynamicMigration to true. It needs the Policy.ReadWrite.AuthenticationMethod permission. Take the exact request from Learn, not from this post. It does not stop enforcement on the retirement dates.

4. Take the provider route for the exceptions

   Microsoft’s migration steps are to pick a provider, deploy the routing function, select users or groups, evaluate, then roll out gradually. Configuration is in the Microsoft Entra admin center.

   1. Pick a provider from Microsoft Security Store. Soprano and Telesign are the initial providers named. Soprano is priced per user or per transaction, and Telesign is listed as Telesign Verify for Microsoft Entra.
   2. Ask the provider about UK coverage and number handling. The Microsoft pages do not confirm it.
   3. Confirm purchasing prerequisites. MC1519855 lists an Azure billing subscription, a resource group and the appropriate Azure subscription role. Microsoft’s published material does not name that role, so confirm it in Microsoft’s documentation or the Security Store listing.
   4. Deploy the routing function in your Azure subscription. Learn says it securely connects Entra ID with your provider.
   5. Select the users or groups. Keep them to the populations with a recorded need.
   6. Run evaluation mode. Learn says it validates that authentication requests route to your provider without changing the experience for users, who keep receiving messages through the existing delivery method.
   7. Roll out gradually, group by group.

   Learn gives 30 October 2026 for when the configuration experience becomes available. This post does not give portal paths for the provider configuration itself. Follow the current Learn page and your provider’s own setup instructions, and confirm each step in your tenant once the experience is available to you.

5. Plan for SSPR separately

   The FAQ says SMS and voice for SSPR remain possible through a provider. If your SSPR design depends on phone methods, include it in the scoping. A different SSPR change is covered in Entra SSPR registered methods change.

6. Communicate

   Tell affected users which route they are on, the date that applies to them per Learn, and how to register a passkey. Say that the blocking prompt cannot be skipped. Learn’s FAQ says users who remain on Microsoft-provided SMS or voice still get the prompt, and users moved to a provider do not.

Checks

Work through these before the retirement date that applies to each group:

• ✓

  You have a list of users enabled for SMS or voice, split by 1 February and 1 July dates.

• ✓

  Your tenant's Message Center has been read for MC1519855, and the 1 July 2027 scope is confirmed.

• ✓

  Each user with a telephony requirement is in a provider-scoped group, with the need recorded.

• ✓

  Evaluation mode has been run for the provider-scoped groups before you roll out gradually.

• ✓

  The registration campaign State and target group, reopened after saving, match what you intended and what you recorded.

• ✓

  Internal guests have a confirmed route, passkey or provider.

• ✓

  Provider pricing, UK coverage and support terms are agreed in writing.

• ✓

  Cost owner is named for provider charges and the routing function.

Rollback

• Evaluation mode: Learn says it does not change the user experience, so there is nothing to undo for users.
• Registration campaign: if you changed State or the target group, put them back to the values you noted in the runbook. If you kept the default and only confirmed it, there is nothing to undo.
• Temporary opt-out: Learn describes setting the opt-out to true. Microsoft’s published material does not describe reversing it, so check Learn for the supported way to undo it before you rely on one.
• Provider rollout: Microsoft’s published material does not document a rollback procedure. Because rollout is by group, keep groups small and keep a note of membership changes, so you can pull users back out. Confirm behaviour with Microsoft and your provider.
• The retirement itself: nothing here reverses it. Learn says there is no opt-out for enforcement on the retirement dates.

Common pitfalls

• Trusting the summary. The Message Center summary and detail wording differ on the 1 July 2027 group. Read the detail and Learn, then confirm in your tenant.
• Treating the provider as a free fallback. There are provider charges, an Azure routing function and ongoing monitoring for you to own.
• Assuming UK coverage. The Microsoft pages do not confirm +44 handling for Soprano or Telesign. Test with real UK mobiles and landlines during evaluation.
• Expecting SMS sign-in to survive. CYOT does not support SMS sign-in as a primary authentication method.
• Forgetting the audience limits. CYOT covers Entra ID, not External ID or Azure AD B2C, and the timeline is public cloud only.
• Counting from the report alone. Activity data lags by up to 36 hours and excludes disabled and soft-deleted users. Cross-check with the script.
• Assuming the opt-out helps. The temporary passkey opt-out covers automatic enablement only. It does not stop enforcement.
• Ignoring guests. Internal guests sit in the 1 February group, and passkey support for them is described as planned by the end of calendar 2026.
• Using a provider for everyone. Microsoft’s guidance is passkeys first. Keep telephony to the populations that need it.