Action required: Prepare users who can’t use passkeys for SMS and voice retirement

What and why

You’re receiving this message because we detected sign-ins in your tenant involving users who have only SMS and/or voice registered and use sessions that don’t support passkeys.

When Microsoft-provided SMS and voice authentication is retired, these users may be blocked from completing MFA in those sessions unless they register a compatible alternative method or your organization configures customer-managed telephony.

Rollout schedule

These are phased rollout start dates, not a single cutoff for every organization. Affected users can be blocked when the applicable rollout reaches your tenant.

Important

Microsoft can’t provide each tenant with the specific date the retirement behavior will reach it. Prepare your organization before February 1, 2027, even if the rollout reaches your tenant later. Don’t wait for users to encounter a blocked sign-in before registering an alternative method or configuring customer-managed telephony. The separate rollout for Global Administrators and external users begins July 1, 2027, as shown above.

Impact on your organization

Who is affected

• Users who have only SMS and/or voice registered and sign in through browser or device sessions that don’t support passkeys.
• Detection of these sign-ins doesn’t mean every user or every sign-in in your tenant is affected by this compatibility issue. A user might be able to use passkeys in one environment but still need an alternative method for another.

Platforms and services

• Microsoft Entra ID sign-in experiences on browser, operating system, or device combinations that don’t support passkeys. Examples can include embedded browser experiences, unsupported browser and operating system combinations, native apps without a supported authentication broker, and environments with platform-specific limitations. Review the passkey compatibility matrix for current support and known limitations.
• Access to applications and services through those sign-in experiences.

What will happen

When the applicable retirement rollout reaches your tenant:

• Microsoft-provided SMS and voice will no longer be available to complete MFA.
• Users with no other available MFA method won’t be able to complete passkey registration in a session that doesn’t support passkeys.
• Without a compatible alternative method or configured customer-managed telephony, these users will be blocked from signing in through that session and will need administrator assistance.

Registering a passkey on another browser or device doesn’t make the original session support passkeys. Users who continue using that session still need a compatible authentication method.

Action required and recommendations

• Identify affected users and sign-in environments. Use the tenant list provided with this message to identify users detected in potentially affected sign-ins. For each user, confirm that SMS and/or voice are their only registered MFA methods, then review the browsers, devices, native apps, and embedded sign-in experiences they use. Compare those environments with the Passkey (FIDO2) authentication matrix with Microsoft Entra ID. Include every sign-in environment users need for work; testing only their primary browser can miss another required experience.
• Register a compatible alternative method. Before retirement reaches your tenant, have affected users register a method that works in their required sign-in environments, such as:
  • Microsoft Authenticator push notifications
  • Passwordless phone sign-in with Microsoft Authenticator
  • Time-based one-time passwords (TOTP), such as verification codes from Microsoft Authenticator

Confirm that the selected method is supported in the affected session, enabled for the user, and permitted by applicable Conditional Access policies and authentication strengths. Installing Microsoft Authenticator alone isn’t enough; users must complete the relevant registration and setup.

• Configure customer-managed telephony if SMS or voice is still required. If affected users must continue using SMS or voice, plan a supported Choose your own telephony provider for SMS and voice authentication deployment. When available for your tenant, configure the provider for the affected population. Test the provider with the same browsers, devices, applications, and policies those users rely on before the retirement rollout reaches your tenant.
• Test and communicate. Test the selected alternative method or customer-managed telephony provider using the same browser and device combinations affected users rely on. Verify that users can complete MFA and access the applications they need under your existing policies. Tell users which method to register, how to set it up, and when to complete registration. Notify your helpdesk about the changes and the support path for users who can’t complete sign-in.

Compliance considerations

Choose alternative authentication methods that meet your organization’s security and compliance requirements and work in the affected sign-in environments. If you require SMS or voice, review the customer-managed provider’s coverage, terms, privacy, and compliance capabilities before deployment.