Microsoft Entra ID: Follow-up on SMS first-factor sign-in retirement and upcoming changes

Microsoft is retiring SMS first-factor sign-in for Microsoft Entra ID workforce tenants worldwide starting February 1, 2027, to enhance security. Organizations must identify affected users, migrate them to phishing-resistant methods like passkeys, and update policies to avoid sign-in disruptions and comply with new requirements. To improve security and reduce reliance on vulnerable authentication methods, Microsoft is continuing the retirement of SMS first-factor sign-in in Microsoft Entra ID. Microsoft recommends phishing-resistant authentication methods, such as passkeys, as the preferred sign-in experience because they help reduce the risk of phishing, fraud, and account compromise associated with phone-based authentication. Microsoft previously retired SMS first-factor sign-in for Microsoft Entra ID Free tenants and stopped enabling SMS sign-in for newly created tenants. This communication provides an update on the next phase of the retirement effort and actions organizations should take to prepare. Microsoft has announced previous retirement actions in Message Center posts MC1426371, MC1448374, and MC1449181. This retirement applies only to Microsoft Entra ID workforce tenant authentication scenarios. It does not apply to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Rollout schedule Worldwide and GCC: Beginning February 1, 2027, SMS first-factor sign-in will be retired for Microsoft Entra ID tenants. Impact on your organization Who is affected Organizations that: Allow users to sign in using SMS first-factor authentication. Rely on SMS first-factor sign-in as a primary authentication method. Platforms and services Microsoft Entra ID SMS first-factor passwordless sign-in (SignInNoPassword) What will happen After February 1, 2027: Users will no longer be able to authenticate by using their phone number and an SMS one-time passcode as a primary sign-in method. Existing SMS first-factor sign-in configurations will no longer be honored. Management and configuration experiences for SMS first-factor sign-in will be removed from Microsoft administration experiences. Attempts to sign in by using a registered phone number and SMS one-time passcode will be blocked. Users who have another registered authentication method can continue signing in. Organizations that do not migrate affected users before the retirement date may experience sign-in disruptions. Action required and recommendations If your organization uses SMS first-factor sign-in, complete the following […]

The post Microsoft Entra ID: Follow-up on SMS first-factor sign-in retirement and upcoming changes appeared first on M365 Admin.