Microsoft Is Retiring Its Own Text-Message and Phone-Call Sign-In Codes. Here Are Your Three Paths Before February 1
Starting October 30, Microsoft Entra ID lets organizations bring their own SMS and voice provider, ahead of Microsoft retiring its built-in text and call codes on February 1, 2027. Users who rely only on those methods will be pushed to register a passkey. Here is how to choose a path and layer your sign-in defenses.
Here Is How Layered Defenses Help Your Team Move Past Text-Message Codes Without Locking Anyone Out
For years, the six-digit code sent by text message has been the default second step for a lot of Microsoft 365 users. That era is ending. Microsoft will stop delivering its own SMS and voice-call codes for most Entra ID users on February 1, 2027, and next week it opens an option for organizations that still need those methods to bring a telephony provider of their own.
This Pick is based on Petri’s report and Microsoft Learn’s documentation on the SMS and voice retirement, choosing a telephony provider and the provider FAQ.
The dates that matter
- September 1, 2026 (already passed): passkeys became the default sign-in experience and were automatically enabled for users set up for SMS or voice.
- October 30, 2026: organizations can begin configuring a third-party telephony provider, which Microsoft calls Choose Your Own Telephony Provider, through Microsoft Security Store.
- February 1, 2027: Microsoft-provided SMS and voice delivery retires for all users except Global Administrators and external users.
- July 1, 2027: the same retirement reaches Global Administrators and external users.
If users still depend on Microsoft’s SMS or voice on their retirement date and no provider is configured, they can no longer use those methods to satisfy MFA. Per Petri and Microsoft’s guidance, users whose only method is SMS or voice can face a mandatory, blocking prompt to register a passkey during sign-in.
Path 1: Move people to passkeys (Microsoft’s recommended route)
Microsoft recommends passkeys as the primary migration path wherever possible. Passkeys resist phishing in a way text codes do not, and they are already turned on for many of your users. Alternatives such as FIDO2 security keys and QR code authentication cover people who cannot use a personal phone.
Path 2: Keep SMS or voice for specific groups with your own provider
Some organizations have a compliance or operational reason they cannot drop telephony. Choose Your Own Telephony Provider lets them keep it, with Microsoft still running the policies and sign-in experience. The fine print:
- Initial providers in the private preview are Soprano and Telesign, with more promised by general availability. Pricing is in Microsoft Security Store.
- You can set one provider for SMS and one for voice.
- It requires a routing function deployed in your Azure subscription, which carries standard Azure consumption charges on top of the provider’s fees.
- You take on the contract, vendor management and compliance review that Microsoft used to handle.
- It works only with Microsoft Entra ID, not Entra External ID or Azure AD B2C.
- It does not keep SMS working as a primary, password-free sign-in method. That retirement applies regardless.
Path 3: Do nothing
This is the path that causes Monday-morning help desk calls. Users who rely only on SMS or voice will hit a blocking passkey prompt with no opt-out. Microsoft’s temporary opt-out from that migration experience only runs from September 1, 2026, to February 1, 2027.
The layers around the change
Layer 1: Know who still uses text and call codes
Microsoft’s retirement guidance includes a PowerShell script to find users registered for SMS or voice. Run it, then sort people into “can move to a passkey” and “has a real reason to keep a phone method.”
Layer 2: Phishing-resistant sign-in for most people
Passkeys, whether in an authenticator app or on a hardware key such as a FIDO2 security key, should become the normal way in, starting with administrators and finance staff.
Layer 3: Conditional Access that requires strong methods
Use authentication strength or similar policies in your identity platform, for example Microsoft Entra Conditional Access, to require phishing-resistant methods for sensitive apps and admin roles, so a fallback code is never enough to reach the crown jewels.
Layer 4: A deliberate exception, not a forgotten one
If you choose a telephony provider, limit it to the named groups that need it and review that list every quarter.
Layer 5: Watch sign-ins and plan recovery
Alert on risky sign-ins and new authentication methods being registered, and have a verified process for people who lose their device, so the help desk does not become the easiest way to take over an account.
What this means for your company
You have about three months. This month, pull the list of users still on text or call codes, decide which path each group takes, and start enrolling passkeys with your leadership and finance team first. If a group truly needs SMS or voice, budget for a provider and the Azure setup before February, not after. Product names here are examples only. The protection comes from stacking these layers, so retiring one weak method strengthens your defenses instead of locking people out.
Need help moving your team off text-message codes and onto phishing-resistant sign-in without disrupting the workday? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
