Microsoft SMS MFA Retirement: The Two Dates, and What Happens to Authenticator

Microsoft is ending phone-based multi-factor authentication in Entra ID, and the first of two deadlines arrives at the start of September. If your organization signs in to Microsoft 365 and anyone still receives a code by text message or a phone call, the Microsoft SMS MFA retirement is going to reach them.

The dates are firm, one of them cannot be opted out of, and the question most administrators actually have is one Microsoft’s own FAQ does not answer: what happens to the Authenticator app. This piece covers both.

The two dates that matter

Microsoft’s retirement documentation sets out a two-stage timeline.

Microsoft’s language on the second date leaves no room: "There is no opt out from this February 1 behavior. It will be enforced for all tenants."

The September date is a nudge with unlimited snoozes. The February date stops people working. Plan the Microsoft SMS MFA retirement against February and treat September as the window you have been given to prepare.

What the Microsoft SMS MFA retirement actually covers

The scope is narrower than the headlines suggest, and the distinction matters for planning.

What is being retired is Microsoft-provided telecom delivery: text messages and voice calls sent through Microsoft’s own infrastructure as an Entra ID authentication method.

What is not being retired is everything else. Passkeys, Windows Hello for Business, FIDO2 security keys, and other phishing-resistant methods continue unchanged. Users already on those methods are unaffected by either date.

There is also a genuine escape hatch that most coverage has skipped. From October 30, 2026, organizations can configure a customer-managed telecom provider through the Microsoft Security Store and keep SMS and voice running on their own carrier relationship. Microsoft is exiting the business of sending you the text. It is not, at least not yet, forbidding the method.

What happens to Microsoft Authenticator

This is the question everyone asks, and Microsoft’s retirement FAQ does not address it at all. The FAQ covers SMS and voice and stops there. So the answer has to be assembled from the surrounding documentation, and it comes in two parts.

Authenticator is not being retired, and its push notifications still work. Tony Redmond of Office 365 for IT Pros put it plainly: "Using the Microsoft Authenticator app to respond to MFA challenges also remains an option." A user whose method is Authenticator push is not in scope for the February blocking prompt, because that prompt targets users whose only available method is SMS or voice.

But Authenticator’s role is changing underneath that. Across the retirement documentation and the announcement, Authenticator appears in exactly one capacity: "Passkey in Microsoft Authenticator," listed as a device-bound passkey option alongside Windows Hello and FIDO2 keys. Microsoft is describing the app as a place to hold a passkey, not as a code generator.

That is the practical answer. Authenticator survives, and the thing most people use it for is being quietly demoted. Push approval and time-based codes are not phishing-resistant, and phishing resistance is the axis Microsoft is now sorting methods along. Nothing breaks in February. But an organization that migrates from SMS to Authenticator push has moved from a method Microsoft is retiring to a method Microsoft no longer counts as strong, which is a smaller step than it looks.

The move that actually finishes the job is registering a passkey, and Authenticator can hold it. Our explainer on passkeys covers the underlying standards, and our piece on authenticator apps covers where TOTP sits in the factor hierarchy and why SS7 interception and SIM swapping made phone-based codes untenable in the first place.

Why Microsoft says it is doing this

The reasoning is stated in the announcement from Nadim Abdo, Corporate Vice President of Identity and Network Access Engineering: methods that use SMS or voice "rely on shared secrets or channels that attackers increasingly intercept, phish, or manipulate," and "the threat environment has changed in speed, scale, and sophistication."

The number attached to that is the one worth carrying into a budget conversation. Citing Microsoft Threat Intelligence and the Microsoft Digital Defense Report 2025, the post reports AI-enabled phishing campaigns reaching click-through rates as high as 54 percent, against roughly 12 percent for traditional campaigns.

Treat that as Microsoft’s own figure rather than an independent finding, because it is. It is also directionally consistent with what every other vendor and CERT has reported over the past two years, and it is a more honest justification than the usual appeal to best practice. Phishing got substantially better at working, and a code a user can read aloud to an attacker stopped being adequate.

The bootstrap problem nobody has solved

There is an unresolved circularity here that deserves attention before anyone plans a September rollout.

Registering a passkey in Entra ID currently requires completing MFA first. For a user whose only method is SMS, and for whom SMS is the thing being taken away, the sequencing works only while SMS still functions. It works in September. In February it becomes a problem for anyone who has not moved, and for any new starter provisioned after the cutover.

Temporary Access Pass is the standard answer to that circularity, and administrators who have not configured it should do so before this becomes urgent rather than during. Redmond’s broader assessment is worth repeating: he judged the timeline potentially "too aggressive because many of the implementation details are not yet fully worked out."

That is a fair read. It is not a reason to wait, because the February date has no opt out. It is a reason to run the migration early enough that you hit the unresolved details while SMS still works as a fallback.

Who this breaks, and how badly

Four groups absorb most of the pain of the Microsoft SMS MFA retirement, and none of them are the office workers this planning usually centers on.

Frontline and shared-device staff. Warehouse, retail, clinical and field workers who sign in on shared terminals and may not carry a personal smartphone. A device-bound passkey assumes a device that belongs to one person. FIDO2 security keys are the answer, and they cost money and need a distribution and replacement process.

Users on older or unmanaged devices. Passkey registration needs an eligible device. The population that does not have one is small and it is not zero, and it skews toward the same people in the first group.

Anyone provisioned after February. See the bootstrap problem above.

Your help desk. A blocking prompt at sign-in, hitting a population that has ignored unlimited snoozes since September, arriving on a Monday. Microsoft’s own documentation warns that unprepared tenants will see sign-in disturbances.

What to do between now and September

The sequence that works is unglamorous and it is mostly reporting. Nothing about the Microsoft SMS MFA retirement rewards improvisation in January.

Find out who is actually affected. Run the authentication methods report and get a count of users whose only registered method is SMS or voice. Every decision below depends on that number, and it is usually larger than the identity team expects.

Buy time deliberately, not by accident. The September default can be deferred through the Graph API, using Policy.ReadWrite.AuthenticationMethod:

PATCH https://graph.microsoft.com/beta/policies/authenticationmethodspolicy
Content-Type: application/json

{
   "optOutSettings": {
     "passkeyDynamicMigration": true
   }
}

That buys until February 1 and not one day past it. Use it only if you have a migration plan the deferral protects, because opting out of the nudge removes the mechanism that would otherwise have moved your users for free.

Configure Temporary Access Pass now. It is the recovery path for every edge case below, and it is easier to set up calmly than during an incident.

Order security keys for the shared-device population. This has a procurement lead time and a distribution problem attached, which is why it is the first thing to start and the last thing to finish.

Let the September nudge do the work for everyone else. For ordinary staff on personal work phones, the automatic enablement and prompting is the cheapest migration you will ever run. Do not opt out of it on their behalf.

Our identity and access management primer covers the wider lifecycle questions this touches, and if MFA itself is new ground for your organization, what multi-factor authentication is covers the fundamentals this assumes.

Frequently Asked Questions