Microsoft to retire Entra ID SMS and voice authentication by 2027

Microsoft will retire native SMS and voice authentication for Entra ID workforce tenants starting February 1, 2027, pushing administrators toward phishing-resistant passkeys ^[9]. This retirement process does not apply to Microsoft Entra External ID customer identity scenarios or Azure AD B2C ^[9].

Microsoft to Retire SMS and Voice Authentication by 2027

Microsoft is urging Entra ID administrators to migrate users to passkeys and other phishing-resistant methods to avoid sign-in disruptions ^[9]. The company stated that "SMS and voice are vulnerable to phishing and SIM-swap attacks" ^[9]. As part of this transition, Microsoft announced in July that passkeys would begin rolling out as the default authentication experience for the Entra ID enterprise identity service starting in September ^[9]. Under this rollout, users enabled for SMS or voice will be automatically enabled for passkeys and prompted to register them during their next MFA challenge ^[9].

To assist with the transition, Microsoft provided the Entra SMS/Voice Policy Scanner PowerShell script, which admins—specifically those with Global Reader, Security Reader, or Authentication Policy Administrator roles—can use to identify users still relying on vulnerable authentication ^[9]. While passkeys are the recommended path, admins may also choose FIDO2 security keys or QR code authentication ^[9]. Organizations that must retain phone-based authentication are required to configure a customer-managed telecom provider (CYOT) through the Microsoft Security Store ^[9].

The Shift Toward Identity-Layer Attacks

The phase-out of legacy MFA coincides with a shift in attacker behavior. Modern identity attacks often target the identity layer itself rather than just attempting to steal credentials ^[2]. According to AvePoint, attackers are modifying Conditional Access policies, creating rogue applications, and abusing privileged accounts to establish persistence ^[2]. These techniques allow attackers to impact entire Microsoft 365 environments by altering the underlying identity infrastructure ^[2].

This trend is mirrored in other cloud ecosystems. Huntress reports that attackers are treating Google Workspace as an identity control plane rather than a productivity layer, using the platform as a central identity hub for SaaS applications and financial workflows ^[1]. Modern vectors include session hijacking via stolen browser cookies, OAuth token theft, and device code phishing ^[1]. Because these attacks target tokens created after authentication, they effectively bypass traditional password and 2FA codes ^[1].

Emerging Risks and the Passkey Transition

While passkeys are designed to be phishing-resistant, new risks have emerged regarding where those keys are stored. On October 6, 2026, SMBC Nikko Securities issued a warning about the hijacking of Apple and Google accounts where passkeys are saved ^[7]. Passkeys are typically synced across devices using Google Password Manager or Apple's iCloud Keychain ^[7].

This transition comes amid a period of high-volume data leaks. Between September and October 2026, the image-sharing service Gyazo reported a breach of 23.62 million users on September 16 ^[7]. Additionally, the Yakiniku King official app reported a leak of 10.79 million member records on October 5, and skyticket reported 14.64 million customer records leaked or potentially leaked on October 9, 2026 ^[7].

The Challenges of Entra ID Recovery and Backup

The shift toward treating identity as critical infrastructure highlights gaps in native recovery tools. Microsoft provides no native item-level restore for Entra ID, and deleted objects cannot be recovered after a 30-day window ^[3]. This lack of native backup is viewed as a major risk because Entra ID provides the authentication and authorization for Azure resources, Dynamics 365, and Microsoft 365 ^[3].

Losing Entra ID configurations can force organizations to recreate permissions manually, a process described by AvePoint as slow and risky ^[3]. Rushed reconstruction can lead IT teams to miss critical security measures ^[3]. While the Microsoft Entra ID service has supported protecting Device BitLocker Recovery Keys since an October 2023 release, other identity configurations often require third-party backup solutions to ensure business continuity ^[4][3].

To address these gaps, tools like AvePoint Cloud Backup offer a "Compare method" for the Microsoft Entra ID service, allowing admins to compare two recovery points or compare backup data against a production environment to identify configuration drift or malicious changes ^[6].

What we don't know

• What specific identity telemetry is required to detect the stealthy native platform reconfiguration described by Huntress?
• Which other phishing-resistant methods beyond passkeys does Microsoft recommend for specific industry use cases?
• How does the Compare method in AvePoint's recovery tool specifically identify malicious configuration drift versus legitimate changes?