Retirement of Microsoft-provided SMS and voice authentication

Tyler Doman 0 Reputation points
2026-09-23T17:22:04.2533333+00:00

I'm trying to understand if I have a conditional access policy that only enforces MFA when a user authenticates remotely, will a user logging on the company network (i.e., not remotely) be forced to register a passkey after the Feb. 1st deadline if they haven't registered a passkey before the deadline and still have SMS/voice MFA as their only MFA authentication method?

The article below states the following happens after Feb. 1st, "Users in scope for the February 1 retirement whose only available MFA method is SMS or voice are required to register a passkey during sign-in to continue accessing their account."

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement?

So this makes me think they will be forced to register a passkey even if there is no conditional access policy forcing MFA/passkey authentication on them when they sign in from a local office network. However, I can't say that's how it will behave for certain and I'm wondering if anyone has anything they've found that clarifies this question?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-09-23T17:22:19.8066667+00:00

    Yes. After the applicable retirement date, the blocking behavior is tied to the SMS/voice retirement enforcement, not to whether a Conditional Access policy happens to require MFA from a specific location.

    For users in scope of the February 1, 2027 retirement, if their only available MFA method is SMS or voice, they are required to register a passkey during sign-in to continue accessing their account. The documentation states this prompt is blocking and that there is no opt out for users in scope of the February 1 retirement.

    That means a user signing in from the corporate network is still subject to this enforcement if all of the following are true:

    1. The user is in the February 1, 2027 retirement scope.
    2. The user still relies on Microsoft-provided SMS or voice.
    3. The user’s only available MFA method is SMS or voice.
    4. No customer-managed telecom provider has been configured and the user migrated to it before the retirement date.

    A few important scope details:

    • February 1, 2027 applies to all users except Global Administrators and external users.
    • Global Administrators and external users follow July 1, 2027 instead.
    • Internal guest users still follow February 1, 2027.

    If the organization needs to keep using SMS or voice after the retirement date, the supported path is to configure a customer-managed telecom provider through the Microsoft Security Store before the applicable deadline. If that is configured and affected users are migrated before the deadline, those users won’t receive the blocking passkey registration prompt as part of this retirement enforcement.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.