๐ Secure Bits ๐ก
๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐ท๐๐๐ ๐ฝ๐๐ ๐ฎ ๐ต๐ฎ๐ฟ๐ฑ ๐ฑ๐ฒ๐ฎ๐ฑ๐น๐ถ๐ป๐ฒ ๐ผ๐ป ๐ฆ๐ ๐ฆ ๐ฎ๐ป๐ฑ ๐ฉ๐ผ๐ถ๐ฐ๐ฒ ๐ ๐๐.
If you still have SMS or Voice call enabled anywhere in your Authentication methods policy, mark two dates: ๐ฆ๐ฒ๐ฝ๐๐ฒ๐บ๐ฏ๐ฒ๐ฟ ๐ญ, ๐ฎ๐ฌ๐ฎ๐ฒ and ๐๐ฒ๐ฏ๐ฟ๐๐ฎ๐ฟ๐ ๐ญ, ๐ฎ๐ฌ๐ฎ๐ณ.
๐ช๐ต๐ฎ๐’๐ ๐ต๐ฎ๐ฝ๐ฝ๐ฒ๐ป๐ถ๐ป๐ด:
– Microsoft is making passkeys the default sign-in experience and retiring its own SMS/voice telecom delivery
– ๐๐ฟ๐ผ๐บ ๐ฆ๐ฒ๐ฝ๐๐ฒ๐บ๐ฏ๐ฒ๐ฟ ๐ญ, ๐ฎ๐ฌ๐ฎ๐ฒ, every user still enabled for SMS or Voice gets auto-enrolled into a passkey profile, and the Microsoft-managed registration campaign starts nudging them at sign-in. By default those nudges can be snoozed indefinitely, so don’t assume nudging alone gets you there
– ๐๐ฟ๐ผ๐บ ๐๐ฒ๐ฏ๐ฟ๐๐ฎ๐ฟ๐ ๐ญ, ๐ฎ๐ฌ๐ฎ๐ณ, Microsoft-provided SMS and voice delivery is gone from Entra ID entirely
โ ๏ธ ๐ช๐ต๐ฎ๐ ๐ต๐ฎ๐ฝ๐ฝ๐ฒ๐ป๐ ๐ผ๐ป ๐๐ฒ๐ฏ๐ฟ๐๐ฎ๐ฟ๐ ๐ญ, ๐ฎ๐ฌ๐ฎ๐ณ ๐ถ๐ณ ๐๐ผ๐ ๐ฑ๐ผ ๐ป๐ผ๐๐ต๐ถ๐ป๐ด:
– Nobody gets locked out outright, but any user whose only MFA method is SMS or voice hits a blocking passkey registration prompt at sign-in. No skip button โ they register a passkey on the spot, or they don’t get in
– The same retirement applies to SSPR, not just MFA
– If you have a genuine regulatory or operational reason to keep a telecom channel, that’s still possible, but only through a customer-managed provider in the new Microsoft Security Store, at your own cost.
๐ช๐ต๐ฎ๐ ๐๐ผ ๐ฑ๐ผ ๐ฏ๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐ฆ๐ฒ๐ฝ๐๐ฒ๐บ๐ฏ๐ฒ๐ฟ:
– ๐ ๐ฎ๐ธ๐ฒ ๐ฎ ๐น๐ถ๐๐ ๐ผ๐ณ ๐๐๐ฒ๐ฟ๐ ๐๐ต๐ฎ๐ ๐๐๐ถ๐น๐น ๐ฟ๐ฒ๐น๐ ๐ผ๐ป ๐ฆ๐ ๐ฆ ๐ผ๐ฟ ๐ฉ๐ผ๐ถ๐ฐ๐ฒ. Microsoft published a PowerShell script for this (entra-sms-voice-usage-analyzer) โ you just need Global Reader, Authentication Policy Administrator, or Security Reader
– ๐๐ป๐ฎ๐ฏ๐น๐ฒ ๐ฃ๐ฎ๐๐๐ธ๐ฒ๐ (๐๐๐๐ข๐ฎ) ๐ฎ๐ ๐ฎ๐ป ๐ฎ๐๐๐ต๐ฒ๐ป๐๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐บ๐ฒ๐๐ต๐ผ๐ฑ if it is disabled, and get those users into a passkey-enabled policy
– ๐ง๐๐ฟ๐ป ๐ผ๐ป ๐๐ต๐ฒ ๐ฅ๐ฒ๐ด๐ถ๐๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐๐ฎ๐บ๐ฝ๐ฎ๐ถ๐ด๐ป, scoped to users using SMS or Voice, before Microsoft flips it to Microsoft Managed for you on September 1
– ๐๐ผ๐บ๐บ๐๐ป๐ถ๐ฐ๐ฎ๐๐ฒ ๐ฒ๐๐ฒ๐ฟ๐ ๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ ๐ถ๐ป ๐ฝ๐ต๐ฎ๐๐ฒ๐. Tell people it’s happening and why, then tell them exactly how to register (Windows Hello, Authenticator passkey, security key), then chase the stragglers
– If a business unit genuinely needs SMS, start ๐ฒ๐๐ฎ๐น๐๐ฎ๐๐ถ๐ป๐ด ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ฆ๐๐ผ๐ฟ๐ฒ ๐๐ต๐ฎ๐ ๐๐ถ๐น๐น ๐ต๐ฎ๐๐ฒ ๐ฎ ๐น๐ถ๐๐ ๐ผ๐ณ ๐ฎ๐ฝ๐ฝ๐ฟ๐ผ๐๐ฒ๐ฑ ๐๐ต๐ถ๐ฟ๐ฑ-๐ฝ๐ฎ๐ฟ๐๐ ๐๐ฒ๐น๐ฒ๐ฐ๐ผ๐บ ๐ฝ๐ฟ๐ผ๐๐ถ๐ฑ๐ฒ๐ฟ๐ once details land in September 2026
โ This isn’t really new guidance โ it’s Microsoft turning a best practice we’ve been recommending for years into a forced migration. Tenants that already disabled SMS and Voice have nothing to do here.
๐ฌ ๐๐ผ๐ ๐บ๐ฎ๐ป๐ ๐ผ๐ณ ๐๐ผ๐๐ฟ ๐๐๐ฒ๐ฟ๐ ๐ฎ๐ฟ๐ฒ ๐๐๐ถ๐น๐น ๐ผ๐ป ๐ฆ๐ ๐ฆ ๐๐ผ๐ฑ๐ฎ๐?
Author: Martin Strnad
