Microsoft is moving away from text message and phone call Multi-Factor Authentication (MFA) in favor of more secure methods like Microsoft Authenticator and passkeys. Starting September 1, 2026, users who rely on SMS or voice MFA will begin receiving prompts to enroll in a more secure authentication method. Microsoft plans to fully retire its native SMS and voice MFA service on February 1, 2027.
Why the Change?
Text messages and phone calls are more vulnerable to phishing, SIM-swapping, and account takeover attacks. Microsoft is encouraging organizations to adopt phishing-resistant authentication methods to better protect user accounts.
What Should Businesses Do?
- Identify users currently using SMS or phone-call MFA.
- Transition users to Microsoft Authenticator.
- Begin evaluating passkeys and passwordless authentication.
- Communicate the changes to employees before enforcement deadlines.
Organizations that prepare now will avoid last-minute disruptions and improve their overall security posture.
Need help identifying affected users or deploying Microsoft Authenticator? Contact Mavidea 309-829-2000 ext. #2 and we’ll help make the transition seamless.
